aswin1906/github-advisory-2019.csv

1schema_version,id,modified,published,withdrawn,aliases,summary,details,severity,affected,references,database_specific21.4.0,GHSA-4vr3-9v7h-5f8v,2021-12-03T14:36:23Z,2019-06-18T15:38:41Z,,[],Low severity vulnerability that affects Gw2Sharp,"## Leaking cached authenticated requests3 4### Impact5If you've been using one `MemoryCacheMethod` object in multiple instances of `Gw2WebApiClient` and are requesting authenticated endpoints with different access tokens, then you are likely to run into this bug.6 7When using an instance of `MemoryCacheMethod` and using it with multiple instances of `Gw2WebApiClient`, there's a possibility that cached authenticated responses are leaking to another request to the same endpoint, but with a different Guild Wars 2 access token. The latter request wouldn't start however, and would return the first cached response immediately. This means that the second response (or later responses) may contain the same data as the first response, therefore leaking data from another authenticated endpoint.8 9The occurence of this is limited however. The Guild Wars 2 API doesn't use the `Expires` header on most (if not all) authenticated endpoints. This header is checked when caching responses. If this header isn't available, the response isn't cached at all. You should still update to at least version 0.3.1 in order to be certain that it won't happen.10 11### Patches12This bug has been fixed in version 0.3.1. When using an authenticated endpoint, it will prepend the SHA-1 hash of the access token to the cache id.13 14### Workarounds15For version 0.3.0 and lower, you can use one separate instance of `MemoryCacheMethod` per `Gw2WebApiClient` if you need to use it.16 17### For more information18If you have any questions or comments about this advisory, you can open an issue in [the Gw2Sharp repository](https://github.com/Archomeda/Gw2Sharp) or contact me on [Discord](https://discord.gg/hNcpDT3).19",[],"[{'package': {'ecosystem': 'NuGet', 'name': 'Gw2Sharp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.3.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/Archomeda/Gw2Sharp/security/advisories/GHSA-4vr3-9v7h-5f8v'}, {'type': 'PACKAGE', 'url': 'https://github.com/Archomeda/Gw2Sharp'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-4vr3-9v7h-5f8v'}]","{'cwe_ids': [], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:59:21Z', 'nvd_published_at': None}"201.4.0,GHSA-6fmm-47qc-p4m4,2023-09-07T21:41:55Z,2019-06-13T16:12:26Z,,['CVE-2019-5438'],Unauthorized File Access in harp,"All versions of `harp` are vulnerable to Unauthorized File Access. If a symlink in the project's base directory points to a file outside of the directory, the file is served. This could allow an attacker to access sensitive files on the server.21 22 23## Recommendation24 25No fix is currently available. Consider using an alternative module until a fix is made available.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'harp'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.40.3'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-5438'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/530289'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/816'}]","{'cwe_ids': ['CWE-22'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T16:10:29Z', 'nvd_published_at': None}"261.4.0,GHSA-pm52-wwrw-c282,2021-08-16T14:32:10Z,2019-06-13T18:59:06Z,,[],Command Injection in wiki-plugin-datalog,"Versions of `wiki-plugin-datalog` prior to 0.1.6 are vulnerable to Command Injection. The package failed to sanitize URLs on the curl endpoint, allowing attackers to inject commands and possibly achieving Remote Code Execution on the system.27 28 29## Recommendation30 31Upgrade to version 0.1.6 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'wiki-plugin-datalog'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.1.6'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/WardCunningham/wiki-plugin-datalog/commit/020aa6201319e5b76301a61b65268c94dc242fa7'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-WIKIPLUGINDATALOG-449540'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/926'}]","{'cwe_ids': ['CWE-94'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T18:50:56Z', 'nvd_published_at': None}"321.4.0,GHSA-cj6j-32rg-45r2,2021-08-04T19:54:08Z,2019-06-06T15:29:25Z,,['CVE-2019-10077'],Cross-site Scripting in JSPWiki,"A carefully crafted InterWiki link could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.jspwiki:jspwiki-war'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.11.0.M4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.11.0.M3'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.jspwiki:jspwiki-main'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.11.0.M4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.11.0.M3'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10077'}, {'type': 'WEB', 'url': 'https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10077'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-05-29T19:05:35Z', 'nvd_published_at': '2019-05-20T21:29:00Z'}"331.4.0,GHSA-mmf6-6597-3v6m,2021-04-12T21:32:14Z,2019-06-13T20:18:28Z,,['CVE-2019-11269'],Open Redirect in Spring Security OAuth,"Spring Security OAuth versions 2.3 prior to 2.3.6, 2.2 prior to 2.2.5, 2.1 prior to 2.1.5, and 2.0 prior to 2.0.18, as well as older unsupported versions could be susceptible to an open redirector attack that can leak an authorization code. A malicious user or attacker can craft a request to the authorization endpoint using the authorization code grant type, and specify a manipulated redirection URI via the redirect_uri parameter. This can cause the authorization server to redirect the resource owner user-agent to a URI under the control of the attacker with the leaked authorization code.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security.oauth:spring-security-oauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.18'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security.oauth:spring-security-oauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security.oauth:spring-security-oauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.2.5'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security.oauth:spring-security-oauth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3.0'}, {'fixed': '2.3.6'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-11269'}, {'type': 'WEB', 'url': 'https://pivotal.io/security/cve-2019-11269'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpujan2021.html'}, {'type': 'WEB', 'url': 'http://packetstormsecurity.com/files/153299/Spring-Security-OAuth-2.3-Open-Redirection.html'}]","{'cwe_ids': ['CWE-601'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T20:17:53Z', 'nvd_published_at': '2019-06-12T15:29:00Z'}"341.4.0,GHSA-68hw-vfh7-xvg8,2021-08-16T15:25:07Z,2019-06-13T20:38:09Z,,['CVE-2019-10157'],Forced Logout in keycloak-connect,"Versions of `keycloak-connect` prior to 4.4.0 are vulnerable to Forced Logout. The package fails to validate JWT signatures on the `/k_logout` route, allowing attackers to logout users and craft malicious JWTs with NBF values that prevent user access indefinitely.35 36 37## Recommendation38 39Upgrade to version 4.4.0 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'keycloak-connect'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.8.3'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10157'}, {'type': 'WEB', 'url': 'https://github.com/keycloak/keycloak-nodejs-connect/commit/55e54b55d05ba636bc125a8f3d39f0052d13f8f6'}, {'type': 'WEB', 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-10157'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-KEYCLOAKNODEJSCONNECT-449920'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/978'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/108734'}]","{'cwe_ids': ['CWE-287', 'CWE-345'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T20:28:41Z', 'nvd_published_at': '2019-06-12T14:29:00Z'}"401.4.0,GHSA-mxjr-xmcg-fg7w,2021-08-17T15:41:58Z,2019-06-27T17:25:21Z,,[],Arbitrary Code Injection in mobile-icon-resizer,"mobile-icon-resizer resizes large images for use as icons for iOS and Android.41 42mobile-icon-resizer has a code execution vulnerability in versions before 0.4.3.43 44mobile-icon-resizer takes an options object as an argument to define the resulting icons as such:45```46var options = {47  config: './config.js'48}49resize(options, function(err){});50```51config.js would need to be a file on the filesystem and look something like:52```53var config = {54  iOS: {55    ""images"": [56     /* iOS image definitions are not vulnerable */57    ]58  },59  android: {60    ""images"" : [61      {62        ""baseRatio"" : ""console.log('Executing script as baseRatio property')"",63        ""folder"" : ""drawable-ldpi""64      },65      {66        ""ratio"" : ""console.log('Executing script as ratio property')"",67        ""folder"" : ""drawable-mdpi""68      },69    /* other android image defintiions ... */70    ]71  }72};73 74exports = module.exports = config;75```76The parameters `ratio` and `baseRatio` are passed directly to `eval()`, thus allowing dynamic javascript payloads to be executed.77 78 79## Recommendation80 81Update to version 0.4.3 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'mobile-icon-resizer'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.0'}, {'fixed': '0.4.3'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/muzzley/mobile-icon-resizer/issues/8'}, {'type': 'WEB', 'url': 'https://github.com/muzzley/mobile-icon-resizer/commit/a6c50f884bd282d74ab77e1fce6317d5d0dd2f0f'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/npm:mobile-icon-resizer:20160408'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/317'}]","{'cwe_ids': ['CWE-94'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-27T15:58:50Z', 'nvd_published_at': None}"821.4.0,GHSA-3xc7-xg67-pw99,2021-08-04T20:54:45Z,2019-06-05T20:43:10Z,,[],Sensitive Data Exposure in sequelize-cli,"Versions of `sequelize-cli` prior to 5.5.0 are vulnerable to Sensitive Data Exposure. The function `filteredURL()` does not properly sanitize the `config.password` value which may cause passwords with special characters to be logged in plain text.83 84 85## Recommendation86 87Upgrade to version 5.5.0 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'sequelize-cli'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.4.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/sequelize/cli/issues/172'}, {'type': 'WEB', 'url': 'https://github.com/sequelize/cli/pull/722'}, {'type': 'WEB', 'url': 'https://github.com/FelixLC/cli/commit/da59652c061a798282e18efad0b6d0afefa15465'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-SEQUELIZECLI-174320'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/825'}]","{'cwe_ids': ['CWE-532'], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2019-06-05T20:42:54Z', 'nvd_published_at': None}"881.4.0,GHSA-h9x2-5rm7-x4gm,2020-08-31T18:09:18Z,2019-06-03T17:28:23Z,,['CVE-2015-9238'],Insecure Comparison in secure-compare,"Versions of `secure-compare` prior to 3.0.1 are affected by a vulnerability that results in the package always returning true when comparing two strings of the same length, despite differences in the contents of those strings.89 90 91## Recommendation92 93Upgrade to version 3.0.1 or later.",[],"[{'package': {'ecosystem': 'npm', 'name': 'secure-compare'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.1'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2015-9238'}, {'type': 'WEB', 'url': 'https://github.com/vdemedes/secure-compare/pull/1'}, {'type': 'WEB', 'url': 'https://github.com/vadimdemedes/secure-compare/commit/dd1ff1ac0122de7e0af4f00c61ed73261062394a'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/50'}]","{'cwe_ids': ['CWE-697'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-03T17:22:37Z', 'nvd_published_at': None}"941.4.0,GHSA-68gr-cmcp-g3mj,2021-08-16T23:34:10Z,2019-06-14T16:39:31Z,,[],Directory Traversal in lactate,"A crafted `GET` request can be leveraged to traverse the directory structure of a host using the lactate web server package, and request arbitrary files outside of the specified web root. This allows for a remote attacker to gain access to arbitrary files on the filesystem that the process has access to read.95 96Mitigating factors:97Only files that the user running `lactate` has permission to read will be accessible via this vulnerability.98 99 100[Proof of concept](https://hackerone.com/reports/296645):101Please globally install the `lactate` package and `cd` to a directory you wish to serve assets from. Next, run `lactate -p 8081` to start serving files from this location.102 103The following cURL request can be used to demonstrate this vulnerability by requesting the target `/etc/passwd` file:104 105```106curl ""http://127.0.0.1:8081/%2e%2e/%2e%2e/%2e%2e/%2e%2e/%2e%2e/etc/passwd""107```108```109root:x:0:0:root:/root:/bin/bash110daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin111bin:x:2:2:bin:/bin:/usr/sbin/nologin112sys:x:3:3:sys:/dev:/usr/sbin/nologin113[...]114```115 116 117## Recommendation118 119As there is currently no fix for this issue selecting an alternative static web server would be the best choice.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'lactate'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.13.12'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/RetireJS/retire.js/commit/800c8140884eaa5753a49308f560c925fe97b9a5'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/296645'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/npm:lactate:20180123'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/560'}]","{'cwe_ids': ['CWE-22'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-14T16:39:14Z', 'nvd_published_at': None}"1201.4.0,GHSA-52mh-p2m2-w625,2021-08-04T21:01:39Z,2019-06-07T20:56:59Z,,['CVE-2019-12741'],Cross-site Scripting in HAPI FHIR,"XSS exists in the HAPI FHIR testpage overlay module of the HAPI FHIR library before 3.8.0. The attack involves unsanitized HTTP parameters being output in a form page, allowing attackers to leak cookies and other sensitive information from ca/uhn/fhir/to/BaseController.java via a specially crafted URL. (This module is not generally used in production systems so the attack surface is expected to be low, but affected systems are recommended to upgrade immediately.)","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'ca.uhn.hapi.fhir:hapi-fhir-base'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.8.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-12741'}, {'type': 'WEB', 'url': 'https://github.com/jamesagnew/hapi-fhir/issues/1335'}, {'type': 'WEB', 'url': 'https://github.com/jamesagnew/hapi-fhir/commit/8f41159eb147eeb964cad68b28eff97acac6ea9a'}, {'type': 'WEB', 'url': 'https://github.com/jamesagnew/hapi-fhir/releases/tag/v3.8.0'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-07T14:35:54Z', 'nvd_published_at': '2019-06-05T15:29:00Z'}"1211.4.0,GHSA-74cr-77xc-8g6r,2021-08-16T15:28:22Z,2019-06-13T20:37:39Z,,[],Prototype Pollution in @apollo/gateway,"Versions of `@apollo/gateway` prior to 0.6.2 are vulnerable to Prototype Pollution. The package uses deepMerge() to merge objects, which may allow attackers to alter the Object prototype through queries with GraphQL aliases. Carefully constructed payloads can override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.122 123 124## Recommendation125 126Upgrade to version 0.6.2 or later.127","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}]","[{'package': {'ecosystem': 'npm', 'name': '@apollo/gateway'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.6.2'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/apollographql/apollo-server/pull/2779'}, {'type': 'WEB', 'url': 'https://github.com/apollographql/apollo-server/commit/cea7397582a293af6a5f60947da34b95e669c6c1'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-APOLLOGATEWAY-174915'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/917'}]","{'cwe_ids': ['CWE-1321', 'CWE-400'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T20:37:08Z', 'nvd_published_at': None}"1281.4.0,GHSA-984p-xq9m-4rjw,2021-08-04T21:03:16Z,2019-06-07T21:01:53Z,,[],Rate Limiting Bypass in express-brute,"All versions of `express-brute` are vulnerable to Rate Limiting Bypass. Concurrent requests may lead to race conditions that cause the package to incorrectly count requests. This may allow an attacker to bypass the rate limiting provided by the package and execute requests without limiting.129 130 131## Recommendation132 133No fix is currently available. Consider using an alternative module until a fix is made available.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L'}]","[{'package': {'ecosystem': 'npm', 'name': 'express-brute'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/AdamPflug/express-brute/issues/46'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-EXPRESSBRUTE-174457'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/823'}]","{'cwe_ids': ['CWE-77'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-07T21:01:37Z', 'nvd_published_at': None}"1341.4.0,GHSA-gc94-6w89-hpqr,2021-09-16T20:59:56Z,2019-06-12T16:37:07Z,,[],Command Injection in fs-path,"All versions of `fs-path` are vulnerable to command injection is unsanitized user input is passed in.135 136 137## Recommendation138 139No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.",[],"[{'package': {'ecosystem': 'npm', 'name': 'fs-path'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.25'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/pillys/fs-path/pull/5'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/324491'}, {'type': 'PACKAGE', 'url': 'https://github.com/pillys/fs-path'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/661'}]","{'cwe_ids': ['CWE-77'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-12T16:34:26Z', 'nvd_published_at': None}"1401.4.0,GHSA-3fc5-9x9m-vqc4,2021-08-04T21:25:59Z,2019-06-03T17:31:32Z,,[],Privilege Escalation in express-cart,"Versions of `express-cart` before 1.1.6 are vulnerable to privilege escalation. This vulnerability can be exploited so that normal users can escalate their privilege and add new administrator users.141 142 143## Recommendation144 145Update to version 1.1.6 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'express-cart'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.6'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/mrvautin/expressCart/commit/baccaae9b0b72f00b10c5453ca00231340ad3e3b'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/343626'}, {'type': 'WEB', 'url': 'https://github.com/nodejs/security-wg/blob/master/vuln/npm/469.json'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/npm:express-cart:20180712'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/730'}]","{'cwe_ids': [], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-06-03T17:30:55Z', 'nvd_published_at': None}"1461.4.0,GHSA-28xh-wpgr-7fm8,2020-08-31T18:31:51Z,2019-06-20T15:35:49Z,,[],Command Injection in open,"Versions of `open` before 6.0.0 are vulnerable to command injection when unsanitized user input is passed in.147 148The package does come with the following warning in the readme:149 150```151The same care should be taken when calling open as if you were calling child_process.exec directly. If it is an executable it will run in a new shell.152```153 154 155## Recommendation156 157`open` is now the deprecated `opn` package. Upgrading to the latest version is likely have unwanted effects since it now has a very different API but will prevent this vulnerability.",[],"[{'package': {'ecosystem': 'npm', 'name': 'open'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.0.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/pwnall/node-open/issues/68'}, {'type': 'WEB', 'url': 'https://github.com/pwnall/node-open/issues/69'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/319473'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/663'}]","{'cwe_ids': ['CWE-77'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-06-20T15:35:06Z', 'nvd_published_at': None}"1581.4.0,GHSA-f698-m2v9-5fh3,2020-08-31T18:35:50Z,2019-06-04T20:11:44Z,,[],Command Injection in opencv,"Versions of `opencv`prior to 6.1.0 are vulnerable to Command Injection. The utils/ script find-opencv.js does not validate user input allowing attackers to execute arbitrary commands.159 160 161## Recommendation162 163Upgrade to version 6.1.0.164",[],"[{'package': {'ecosystem': 'npm', 'name': 'opencv'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.1.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/peterbraden/node-opencv/commit/81a4b8620188e89f7e4fc985f3c89b58d4bcc86b#diff-dab2f6d17b2fd005a9425e97172dc8cb'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/789'}]","{'cwe_ids': ['CWE-77'], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2019-06-04T20:11:26Z', 'nvd_published_at': None}"1651.4.0,GHSA-f7qw-5pvg-mmwp,2021-08-16T14:36:47Z,2019-06-13T18:58:44Z,,[],Prototype Pollution in lutils-merge,"All versions of `lutils-merge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.166 167 168## Recommendation169 170The package is deprecated and no fixes are available. Consider using an alternative package.171","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}]","[{'package': {'ecosystem': 'npm', 'name': 'lutils-merge'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.2.6'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/nfour/lutils-merge/issues/1'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/439107'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-LUTILSMERGE-174783'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/893'}]","{'cwe_ids': ['CWE-400'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T18:58:27Z', 'nvd_published_at': None}"1721.4.0,GHSA-q42p-pg8m-cqh6,2021-08-04T20:54:05Z,2019-06-05T14:07:48Z,,[],Prototype Pollution in handlebars,"Versions of `handlebars` prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.173 174 175## Recommendation176 177For handlebars 4.1.x upgrade to 4.1.2 or later.178For handlebars 4.0.x upgrade to 4.0.14 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}]","[{'package': {'ecosystem': 'npm', 'name': 'handlebars'}, 'ecosystem_specific': {'affected_functions': ['handlebars.helpers.lookup']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'handlebars'}, 'ecosystem_specific': {'affected_functions': ['handlebars.helpers.lookup']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.14'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'handlebars'}, 'ecosystem_specific': {'affected_functions': ['handlebars.helpers.lookup']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.7'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/handlebars-lang/handlebars.js/issues/1495'}, {'type': 'WEB', 'url': 'https://github.com/handlebars-lang/handlebars.js/commit/0d6d8c335ad81bad1b672fc56b6a44f6aa472dac'}, {'type': 'WEB', 'url': 'https://github.com/handlebars-lang/handlebars.js/commit/7372d4e9dffc9d70c09671aa28b9392a1577fd86'}, {'type': 'WEB', 'url': 'https://github.com/handlebars-lang/handlebars.js/commit/85c8783b34fc6d36145d8b53885ad0b9e3c3f9c4'}, {'type': 'WEB', 'url': 'https://github.com/handlebars-lang/handlebars.js/commit/cd38583216dce3252831916323202749431c773e'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-HANDLEBARS-173692'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/755'}]","{'cwe_ids': ['CWE-471'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-05T13:55:39Z', 'nvd_published_at': None}"1791.4.0,GHSA-8w57-jfpm-945m,2023-04-11T00:26:58Z,2019-06-11T16:16:07Z,,[],Denial of Service in http-proxy-agent,"Versions of `http-proxy-agent` before 2.1.0 are vulnerable to denial of service and uninitialized memory leak when unsanitized options are passed to `Buffer`. An attacker may leverage these unsanitized options to consume system resources.180 181 182## Recommendation183 184Update to version 2.1.0 or later.",[],"[{'package': {'ecosystem': 'npm', 'name': 'http-proxy-agent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.0'}]}]}]","[{'type': 'WEB', 'url': 'https://hackerone.com/reports/321631'}, {'type': 'WEB', 'url': 'https://github.com/TooTallNate/node-http-proxy-agent/blob/2.0.0/index.js#L80'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/607'}]","{'cwe_ids': ['CWE-400'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-11T16:11:38Z', 'nvd_published_at': None}"1851.4.0,GHSA-28hp-fgcr-2r4h,2021-02-24T18:32:36Z,2019-06-27T17:25:42Z,,[],Cross-Site Scripting via JSONP,"JSONP allows untrusted resource URLs, which provides a vector for attack by malicious actors.",[],"[{'package': {'ecosystem': 'npm', 'name': 'angular'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/angular/angular.js/commit/6476af83cd0418c84e034a955b12a842794385c4'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1630'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-27T15:51:47Z', 'nvd_published_at': None}"1861.4.0,GHSA-74cp-qw7f-7hpw,2020-08-31T18:36:24Z,2019-06-05T14:10:23Z,,[],Path Traversal in statics-server,"All versions of `statics-server` are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 187 188 189## Recommendation190 191No fix is currently available. Consider using an alternative module until a fix is made available.192",[],"[{'package': {'ecosystem': 'npm', 'name': 'statics-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.0.9'}]}]}]","[{'type': 'WEB', 'url': 'https://hackerone.com/reports/355456'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/805'}]","{'cwe_ids': ['CWE-22'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-05T13:49:00Z', 'nvd_published_at': None}"1931.4.0,GHSA-wfp9-vr4j-f49j,2023-04-21T19:34:39Z,2019-06-04T20:04:27Z,,[],NoSQL Injection in sequelize,"Versions of `sequelize` prior to 4.12.0 are vulnerable to NoSQL Injection. Query operators such as `$gt` are not properly sanitized and may allow an attacker to alter data queries, leading to NoSQL Injection.194 195 196## Recommendation197 198Upgrade to version 4.12.0 or later",[],"[{'package': {'ecosystem': 'npm', 'name': 'sequelize'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.12.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/sequelize/sequelize/issues/7310'}, {'type': 'WEB', 'url': 'https://github.com/sequelize/sequelize/pull/8240'}, {'type': 'WEB', 'url': 'https://github.com/sequelize/sequelize/commit/ccb99daedb69e8750a241436415ccac8abef358d'}, {'type': 'PACKAGE', 'url': 'https://github.com/sequelize/sequelize'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-SEQUELIZE-174147'}]","{'cwe_ids': ['CWE-89'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-04T20:04:00Z', 'nvd_published_at': None}"1991.4.0,GHSA-jwgx-9mmh-684w,2022-02-11T21:13:16Z,2019-06-13T20:02:56Z,,['CVE-2019-3888'],Credential exposure through log files in Undertow,"A vulnerability was found in Undertow web server before 2.0.21. An information exposure of plain text credentials through log files because Connectors.executeRootHandler:402 logs the HttpServerExchange object at ERROR level using UndertowLogger.REQUEST_LOGGER.undertowRequestFailed(t, exchange)","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'io.undertow:undertow-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.21'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-3888'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2439'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2998'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0727'}, {'type': 'WEB', 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3888'}, {'type': 'WEB', 'url': 'https://security.netapp.com/advisory/ntap-20220210-0019/'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/108739'}]","{'cwe_ids': ['CWE-532'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T20:02:23Z', 'nvd_published_at': '2019-06-12T14:29:00Z'}"2001.4.0,GHSA-76wm-422q-92mq,2021-08-17T13:42:04Z,2019-06-20T16:06:11Z,,['CVE-2019-8324'],Code injection in RubyGems,"An issue was discovered in RubyGems 2.6 and later through 3.0.2. A crafted gem with a multi-line name is not handled correctly. Therefore, an attacker could inject arbitrary code to the stub line of gemspec, which is eval-ed by code in ensure_loadable_spec during the preinstall check.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.7.9'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-8324'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1972'}, {'type': 'WEB', 'url': 'https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8324.yml'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html'}]","{'cwe_ids': ['CWE-94'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-20T16:01:22Z', 'nvd_published_at': None}"2011.4.0,GHSA-8948-ffc6-jg52,2021-08-04T20:58:53Z,2019-06-06T15:32:21Z,,[],Insecure Default Configuration in redbird,"Versions of `redbird` prior to 0.9.1 have a vulnerable default configuration of allowing TLS 1.0 connections on `lib/proxy.js`. The package does not provide an option to disable TLS 1.0 which is deprecated and vulnerable.202 203 204## Recommendation205 206Upgrade to version 0.9.1 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'redbird'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/OptimalBits/redbird/pull/207'}, {'type': 'WEB', 'url': 'https://github.com/OptimalBits/redbird/commit/39c7a2da84a2ddddfe046ea80e98800518920516'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-REDBIRD-174455'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/828'}]","{'cwe_ids': ['CWE-20'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-06T13:06:37Z', 'nvd_published_at': None}"2071.4.0,GHSA-wxhq-pm8v-cw75,2020-08-31T18:35:40Z,2019-06-05T20:50:16Z,,[],Regular Expression Denial of Service in clean-css,"Version of `clean-css` prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.208 209 210## Recommendation211 212Upgrade to version 4.1.11 or higher.",[],"[{'package': {'ecosystem': 'npm', 'name': 'clean-css'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.1.11'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/jakubpawlowicz/clean-css/commit/2929bafbf8cdf7dccb24e0949c70833764fa87e3'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/785'}]","{'cwe_ids': ['CWE-1333'], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2019-06-05T20:49:47Z', 'nvd_published_at': None}"2131.4.0,GHSA-57cf-349j-352g,2020-08-31T18:31:27Z,2019-06-12T16:37:00Z,,[],Out-of-bounds Read in npmconf,"Versions of `npmconf` before 2.1.3 allocate and write to disk uninitialized memory contents when a typed number is passed as input on Node.js 4.x.214 215 216## Recommendation217 218Update to version 2.1.3 or later. Consider switching to another config storage mechanism, as npmconf is deprecated and should not be used.",[],"[{'package': {'ecosystem': 'npm', 'name': 'npmconf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.3'}]}]}]","[{'type': 'WEB', 'url': 'https://hackerone.com/reports/320269'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/653'}]","{'cwe_ids': ['CWE-125'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-12T16:35:03Z', 'nvd_published_at': None}"2191.4.0,GHSA-4vmm-mhcq-4x9j,2021-08-16T16:06:38Z,2019-06-14T16:15:14Z,,[],Sandbox Bypass Leading to Arbitrary Code Execution in constantinople,"Versions of `constantinople` prior to 3.1.1 are vulnerable to a sandbox bypass which can lead to arbitrary code execution.220 221 222## Recommendation223 224Update to version 3.1.1 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'constantinople'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/pugjs/constantinople/commit/01d409c0d081dfd65223e6b7767c244156d35f7f'}, {'type': 'WEB', 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1577703'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/npm:constantinople:20180421'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/568'}]","{'cwe_ids': [], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-06-14T16:14:40Z', 'nvd_published_at': None}"2251.4.0,GHSA-5v72-xg48-5rpm,2021-08-04T21:29:05Z,2019-06-04T19:37:52Z,,[],Denial of Service in ws,"Affected versions of `ws` can crash when a specially crafted `Sec-WebSocket-Extensions` header containing `Object.prototype` property names as extension or parameter names is sent.226 227## Proof of concept228 229```230const WebSocket = require('ws');231const net = require('net');232 233const wss = new WebSocket.Server({ port: 3000 }, function () {234  const payload = 'constructor';  // or ',;constructor'235 236  const request = [237    'GET / HTTP/1.1',238    'Connection: Upgrade',239    'Sec-WebSocket-Key: test',240    'Sec-WebSocket-Version: 8',241    `Sec-WebSocket-Extensions: ${payload}`,242    'Upgrade: websocket',243    '\r\n'244  ].join('\r\n');245 246  const socket = net.connect(3000, function () {247    socket.resume();248    socket.write(request);249  });250});251```252 253 254## Recommendation255 256Update to version 3.3.1 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'ws'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.2.6'}, {'fixed': '1.1.5'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'ws'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '3.3.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/websockets/ws/commit/c4fe46608acd61fbf7397eadc47378903f95b78a'}, {'type': 'WEB', 'url': 'https://github.com/websockets/ws/commit/f8fdcd40ac8be7318a6ee41f5ceb7e77c995b407'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/npm:ws:20171108'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/550'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/550/versions'}]","{'cwe_ids': ['CWE-400'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-04T19:37:42Z', 'nvd_published_at': None}"2571.4.0,GHSA-cxx2-fp39-rf3r,2021-08-04T19:53:10Z,2019-06-06T15:29:22Z,,['CVE-2019-10076'],Cross-Site Scripting in JSPWiki,"A carefully crafted malicious attachment could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.jspwiki:jspwiki-war'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.11.0.M4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.11.0.M3'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.jspwiki:jspwiki-main'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.11.0.M4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.11.0.M3'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10076'}, {'type': 'WEB', 'url': 'https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10076'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/aac253cfc33c0429b528e2fcbe82d3a42d742083c528f58d192dfd16@%3Ccommits.jspwiki.apache.org%3E'}, {'type': 'WEB', 'url': 'http://www.openwall.com/lists/oss-security/2019/05/19/4'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/108437'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-05-29T19:05:23Z', 'nvd_published_at': None}"2581.4.0,GHSA-g45g-g52h-39rg,2023-01-23T20:02:18Z,2019-06-07T20:56:42Z,,['CVE-2019-12732'],Cross-site Scripting in Chartkick,The Chartkick gem through 3.1.0 for Ruby allows XSS.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'chartkick'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.2.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-12732'}, {'type': 'WEB', 'url': 'https://github.com/ankane/chartkick/issues/488'}, {'type': 'PACKAGE', 'url': 'https://github.com/ankane/chartkick'}, {'type': 'WEB', 'url': 'https://github.com/ankane/chartkick/blob/master/CHANGELOG.md'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-07T10:49:06Z', 'nvd_published_at': '2019-06-06T15:29:00Z'}"2591.4.0,GHSA-hpfq-8wx8-cgqw,2020-08-31T18:41:56Z,2019-06-13T18:59:18Z,,[],Cross-Site Scripting in ids-enterprise,"Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `modal` component fails to sanitize input to the `title` attribute, which may allow attackers to execute arbitrary JavaScript.260 261 262## Recommendation263 264Upgrade to version 4.18.2 or later",[],"[{'package': {'ecosystem': 'npm', 'name': 'ids-enterprise'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.18.2'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/infor-design/enterprise-ng/issues/511'}, {'type': 'WEB', 'url': 'https://github.com/infor-design/enterprise/commit/9b57aaa0321bf2e5baa6c4c5c1eb3b8312e215c4'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/957'}]","{'cwe_ids': ['CWE-79'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T18:49:52Z', 'nvd_published_at': None}"2651.4.0,GHSA-q4hg-rmq2-52q9,2021-04-12T18:23:31Z,2019-06-26T01:09:40Z,,['CVE-2019-10072'],Improper Locking in Apache Tomcat,The fix for CVE-2019-0199 was incomplete and did not address HTTP/2 connection window exhaustion on write in Apache Tomcat versions 9.0.0.M1 to 9.0.19 and 8.5.0 to 8.5.40 . By not sending WINDOW_UPDATE messages for the connection window (stream 0) clients were able to cause server-side threads to block eventually leading to thread exhaustion and a DoS.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0.M1'}, {'fixed': '9.0.20'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.5.0'}, {'fixed': '8.5.40'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10072'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3929'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3931'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/df1a2c1b87c8a6c500ecdbbaf134c7f1491c8d79d98b48c6b9f0fa6a@%3Cannounce.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://security.netapp.com/advisory/ntap-20190625-0002/'}, {'type': 'WEB', 'url': 'https://support.f5.com/csp/article/K17321505'}, {'type': 'WEB', 'url': 'https://usn.ubuntu.com/4128-1/'}, {'type': 'WEB', 'url': 'https://usn.ubuntu.com/4128-2/'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2020/dsa-4680'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuApr2021.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpujan2020.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuoct2020.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html'}, {'type': 'WEB', 'url': 'https://www.synology.com/security/advisory/Synology_SA_19_29'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/108874'}]","{'cwe_ids': ['CWE-667'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-26T00:56:45Z', 'nvd_published_at': '2019-06-21T18:15:00Z'}"2661.4.0,GHSA-m734-r4g6-34f9,2021-08-04T20:47:58Z,2019-06-04T19:36:17Z,,[],NoSQL Injection in loopback-connector-mongodb,"Versions of `loopback-connector-mongodb` before 3.6.0 are vulnerable to NoSQL injection.267 268MongoDB Connector for LoopBack fails to properly sanitize a filter passed to query the database by allowing the dangerous `$where` property to be passed to the MongoDB Driver. The Driver allows the special `$where` property in a filter to execute JavaScript (client can pass in a malicious script) on the database Driver. This is an [intended feature of MongoDB](https://docs.mongodb.com/manual/core/server-side-javascript/) unless disabled ([instructions here](https://docs.mongodb.com/manual/core/server-side-javascript/#disable-server-side-js)).269 270A proof of concept malicious query:271 272```273GET /POST filter={""where"": {""$where"": ""function(){sleep(5000); return this.title.contains('Hello');}""}}274```275 276The above makes the database sleep for 5 seconds and then returns all “Posts” with the title containing the word `Hello`.277 278 279 280 281## Recommendation282 283Update to version 3.6.0 or later.",[],"[{'package': {'ecosystem': 'npm', 'name': 'loopback-connector-mongodb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.6.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/strongloop/loopback-connector-mongodb/issues/403'}, {'type': 'WEB', 'url': 'https://github.com/strongloop/loopback-connector-mongodb/pull/452'}, {'type': 'WEB', 'url': 'https://github.com/strongloop/loopback-connector-mongodb/commit/ee24cd08b8ccc32711264831c71b1da628df357b'}, {'type': 'WEB', 'url': 'https://loopback.io/doc/en/lb3/Security-advisory-08-15-2018.html'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/696'}]","{'cwe_ids': ['CWE-89'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-04T19:35:47Z', 'nvd_published_at': None}"2841.4.0,GHSA-2479-qvv7-47qq,2022-09-13T22:16:02Z,2019-06-13T16:22:13Z,,['CVE-2019-1020012'],Parse Server before v3.4.1 vulnerable to Denial of Service,"### Impact285 286If a POST request is made to /parse/classes/_Audience (or other volatile class), any subsuquent POST requests result in an internal server error (500).287 288 289### Patches290Afflicted installations will also have to remove the offending collection from their database.291 292Yes, patched in 3.4.1293 294### Workarounds295 296Yes, user can apply: https://github.com/parse-community/parse-server/commit/8709daf698ea69b59268cb66f0f7cee75b52daa5297 298### References299Nothing other than this advisory at this time300 301### For more information302If you have any questions or comments about this advisory:303* Open an issue in [parse-server](https://github.com/parse-community/parse-server)304* Email us at [security@parseplatform.org](mailto:security@parseplatform.org)305","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'parse-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.4.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/parse-community/parse-server/security/advisories/GHSA-2479-qvv7-47qq'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-1020012'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-2479-qvv7-47qq'}, {'type': 'PACKAGE', 'url': 'https://github.com/parse-community/parse-server'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-PARSESERVER-455635'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1113'}]","{'cwe_ids': ['CWE-444'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:51:19Z', 'nvd_published_at': None}"3061.4.0,GHSA-r6v3-hpxj-r8rv,2021-07-27T20:55:27Z,2019-06-07T20:56:27Z,,['CVE-2019-12761'],Code Injection in PyXDG,A code injection issue was discovered in PyXDG before 0.26 via crafted Python code in a Category element of a Menu XML document in a .menu file. XDG_CONFIG_DIRS must be set up to trigger xdg.Menu.parse parsing within the directory containing this file. This is due to a lack of sanitization in xdg/Menu.py before an eval call.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'pyxdg'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.26'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-12761'}, {'type': 'WEB', 'url': 'https://gist.github.com/dhondta/b45cd41f4186110a354dc7272916feba'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2019/06/msg00006.html'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2021/08/msg00003.html'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-PYTHON-PYXDG-174562'}]","{'cwe_ids': ['CWE-94'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-07T10:24:55Z', 'nvd_published_at': '2019-06-06T19:29:00Z'}"3071.4.0,GHSA-3p92-886g-qxpq,2021-08-04T21:27:04Z,2019-06-04T15:42:32Z,,[],Remote Memory Exposure in floody,"Versions of `floody` before 0.1.1 are vulnerable to remote memory exposure.308 309.write(number)` in the affected `floody` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory.310 311Proof of Concept: 312 313```314var f = require('floody')(process.stdout); 315f.write(USERSUPPLIEDINPUT); 316'f.stop();317 318 319## Recommendation320 321Update to version 0.1.1 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'floody'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.1.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/soldair/node-floody/commit/6c44722312131f4ac8a1af40f0f861c85efe01b0'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/npm:floody:20160115'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/601'}]","{'cwe_ids': ['CWE-201'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-04T15:40:44Z', 'nvd_published_at': None}"3221.4.0,GHSA-hxcm-v35h-mg2x,2021-02-25T17:25:43Z,2019-06-07T21:12:50Z,,[],Prototype Pollution,A vulnerability was found in querystringify before 2.0.0. It's possible to override built-in properties of the resulting query string object if a malicious string is inserted in the query string.,[],"[{'package': {'ecosystem': 'npm', 'name': 'querystringify'}, 'ecosystem_specific': {'affected_functions': ['querystringify.parse']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/unshiftio/querystringify/pull/19'}, {'type': 'WEB', 'url': 'https://github.com/unshiftio/querystringify/commit/422eb4f6c7c28ee5f100dcc64177d3b68bb2b080'}]","{'cwe_ids': ['CWE-1321'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-07T21:11:35Z', 'nvd_published_at': None}"3231.4.0,GHSA-49r3-3h96-rwj6,2020-08-31T18:41:54Z,2019-06-13T19:09:31Z,,[],Cross-Site Scripting in ids-enterprise,"Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). The `soho-dropdown` component does not properly encode its output and may allow attackers to execute arbitrary JavaScript.324 325 326## Recommendation327 328Upgrade to version 4.18.2 or later",[],"[{'package': {'ecosystem': 'npm', 'name': 'ids-enterprise'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.18.2'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/infor-design/enterprise-ng/issues/503'}, {'type': 'WEB', 'url': 'https://github.com/infor-design/enterprise/commit/6bd74d8f38c268b22f31e8169316e065e0093362'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/956'}]","{'cwe_ids': ['CWE-79'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T19:09:01Z', 'nvd_published_at': None}"3291.4.0,GHSA-fr32-gr5c-xq5c,2023-08-28T13:19:04Z,2019-06-20T16:06:04Z,,['CVE-2019-8321'],RubyGems Escape sequence injection vulnerability in verbose,"An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::UserInteraction#verbose calls say without escaping, escape sequence injection is possible.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.7.9'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-8321'}, {'type': 'WEB', 'url': 'https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8321.yml'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html'}]","{'cwe_ids': ['CWE-88'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-20T16:00:39Z', 'nvd_published_at': None}"3301.4.0,GHSA-vc6r-4x6g-mmqc,2020-08-31T18:33:45Z,2019-06-11T16:16:23Z,,[],Path Traversal in m-server,"Versions of `m-server` before 1.4.2 are vulnerable to path traversal allowing a remote attacker to display content of arbitrary files from the server.331 332 333## Recommendation334 335Update to version 1.4.2 or later.",[],"[{'package': {'ecosystem': 'npm', 'name': 'm-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.2'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/nunnly/m-server/commit/01f13f040d1961ca3146dce7e2db990156e65e9a'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/319795'}, {'type': 'WEB', 'url': 'https://github.com/nodejs/security-wg/blob/master/vuln/npm/468.json'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/731'}]","{'cwe_ids': ['CWE-22'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-11T16:09:28Z', 'nvd_published_at': None}"3361.4.0,GHSA-g74r-ffvr-5q9f,2020-08-31T18:29:17Z,2019-06-03T17:26:44Z,,[],Memory Exposure in concat-stream,"Versions of `concat-stream` before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into `write()`337 338Versions <1.3.0 are not affected due to not using unguarded Buffer constructor.339 340 341 342## Recommendation343 344Update to version 1.5.2, 1.4.11, 1.3.2 or later.345 346If you are unable to update make sure user provided input into the `write()` function is not a number.",[],"[{'package': {'ecosystem': 'npm', 'name': 'concat-stream'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.5.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'concat-stream'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.4.11'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'concat-stream'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.3.2'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/maxogden/concat-stream/pull/47'}, {'type': 'WEB', 'url': 'https://github.com/maxogden/concat-stream/pull/47/commits/3e285ba5e5b10b7c98552217f5c1023829efe69e'}, {'type': 'WEB', 'url': 'https://gist.github.com/ChALkeR/c2d2fd3f1d72d51ad883df195be03a85'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/597'}]","{'cwe_ids': ['CWE-200'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-03T17:26:24Z', 'nvd_published_at': None}"3471.4.0,GHSA-crfx-5phg-hmw9,2020-08-31T18:41:52Z,2019-06-13T18:59:12Z,,[],Cross-Site Scripting in ids-enterprise,"Versions of `ids-enterprise` prior to 4.18.2 are vulnerable to Cross-Site Scripting (XSS). Script tags in the `soho-autocomplete` component are not properly encoded and may allow attackers to execute arbitrary JavaScript.348 349 350## Recommendation351 352Upgrade to version 4.18.2 or later",[],"[{'package': {'ecosystem': 'npm', 'name': 'ids-enterprise'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.18.2'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/infor-design/enterprise-ng/issues/502'}, {'type': 'WEB', 'url': 'https://github.com/infor-design/enterprise/commit/ce7b335bb614a6720867abf5b8eb351deb13aed1'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/955'}]","{'cwe_ids': ['CWE-79'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T18:47:35Z', 'nvd_published_at': None}"3531.4.0,GHSA-qx4v-6gc5-f2vv,2021-02-25T17:20:28Z,2019-06-20T14:32:56Z,,[],Regular Expression Denial of Service,"A Regular Expression Denial of Service vulnerability was discovered in esm before 3.1.0. The issue is that esm's find-indexes is using the unescaped identifiers in a regex, which, in this case, causes an infinite loop.",[],"[{'package': {'ecosystem': 'npm', 'name': 'esm'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/standard-things/esm/issues/694'}, {'type': 'WEB', 'url': 'https://github.com/standard-things/esm/commit/c41e001d81a5a52b0d2d1722b1c2af04d997c05b'}]","{'cwe_ids': ['CWE-400'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-20T14:17:20Z', 'nvd_published_at': None}"3541.4.0,GHSA-v2p6-4mp7-3r9v,2020-08-31T18:34:16Z,2019-06-14T16:26:22Z,,[],Regular Expression Denial of Service in underscore.string,"Versions of `underscore.string` prior to *3.3.5* are vulnerable to Regular Expression Denial of Service (ReDoS).355 356The function `unescapeHTML` is vulnerable to ReDoS due to an overly-broad regex. The slowdown is approximately 2s for 50,000 characters but grows exponentially with larger inputs.357 358 359## Recommendation360 361Upgrade to version 3.3.5 or higher.",[],"[{'package': {'ecosystem': 'npm', 'name': 'underscore.string'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.5'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/epeli/underscore.string/issues/510'}, {'type': 'WEB', 'url': 'https://github.com/epeli/underscore.string/pull/517'}, {'type': 'WEB', 'url': 'https://github.com/epeli/underscore.string/commit/f486cd684c94c12db48b45d52b1472a1b9661029'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/745'}]","{'cwe_ids': ['CWE-400'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-14T16:24:01Z', 'nvd_published_at': None}"3621.4.0,GHSA-886v-mm6p-4m66,2021-09-07T15:24:35Z,2019-06-05T09:48:02Z,,[],High severity vulnerability that affects gun,"## Urgent Upgrade363 364The static file server module included with GUN had a **serious vulnerability**:365 366 - Using `curl --path-as-is` allowed reads on any parent directory or files.367 368This did not work via the browser or via curl without as-is option.369 370 ### Fixed371 372This has been fixed since version `0.2019.416` and higher.373 374 ### Who Was Effected?375 376Most NodeJS users who use the default setup, such as:377 378 - `npm start`379 - `node examples/http.js`380 - `Heroku` 1-click-deploy381 - `Docker`382 - `Now`383 384If you have a custom NodeJS code then you are probably safe *unless* you have something like `require('http').createServer(Gun.serve(__dirname))` in it.385 386If you have not upgraded, it is **mandatory** or else it is highly likely your environment variables and AWS (or other) keys could be leaked.387 388 ### Credit389 390It was reported and fixed by [JK0N](https://github.com/amark/gun/pull/527), but I did not understand the `--path-as-is` condition.391 392Joonas Loppi from [function61](http://function61.com) rediscovered it and explained the urgency to me to fix it.393",[],"[{'package': {'ecosystem': 'npm', 'name': 'gun'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.2019.416'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/amark/gun/security/advisories/GHSA-886v-mm6p-4m66'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-886v-mm6p-4m66'}, {'type': 'PACKAGE', 'url': 'https://github.com/amark/gun'}]","{'cwe_ids': ['CWE-22'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:24:52Z', 'nvd_published_at': None}"3941.4.0,GHSA-4wm8-fjv7-j774,2023-08-28T13:17:43Z,2019-06-20T16:08:21Z,,['CVE-2019-8325'],RubyGems Escape sequence injection in errors,"An issue was discovered in RubyGems 2.6 and later through 3.0.2. Since Gem::CommandManager#run calls alert_error without escaping, escape sequence injection is possible. (There are many ways to cause an error.)","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.7.9'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-8325'}, {'type': 'WEB', 'url': 'https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8325.yml'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html'}]","{'cwe_ids': ['CWE-74'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-20T16:04:35Z', 'nvd_published_at': None}"3951.4.0,GHSA-4859-gpc7-4j66,2021-08-04T20:55:57Z,2019-06-05T21:24:29Z,,[],Command Injection in dot,All versions of dot are vulnerable to Command Injection. The template compilation may execute arbitrary commands if an attacker can inject code in the template or if a Prototype Pollution-like vulnerability can be exploited to alter an Object's prototype.,[],"[{'package': {'ecosystem': 'npm', 'name': 'dot'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.1.2'}]}]}]","[{'type': 'WEB', 'url': 'https://hackerone.com/reports/390929'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/798'}]","{'cwe_ids': ['CWE-77'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-05T21:24:18Z', 'nvd_published_at': None}"3961.4.0,GHSA-6394-6h9h-cfjg,2021-02-25T17:23:12Z,2019-06-07T21:12:35Z,,[],Regular Expression Denial of Service,"A Regular Expression vulnerability was found in nwmatcher before 1.4.4. The fix replacing multiple repeated instances of the ""\s*"" pattern.",[],"[{'package': {'ecosystem': 'npm', 'name': 'nwmatcher'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.4'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/dperini/nwmatcher/commit/9dcc2b039beeabd18327a5ebaa537625872e16f0'}]","{'cwe_ids': ['CWE-400'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-07T21:11:09Z', 'nvd_published_at': None}"3971.4.0,GHSA-vpq5-4rc8-c222,2020-08-31T18:36:22Z,2019-06-05T14:10:45Z,,[],Denial of Service in canvas,"Versions of `canvas` prior to 1.6.10 are vulnerable to Denial of Service. Processing malicious JPEGs or GIFs could crash the node process.398 399 400## Recommendation401 402Upgrade to version 1.6.10",[],"[{'package': {'ecosystem': 'npm', 'name': 'canvas'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.10'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/Automattic/node-canvas/commit/c3e4ccb1c404da01e83fe5eb3626bf55f7f55957'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/315037'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/804'}]","{'cwe_ids': [], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-05T12:48:28Z', 'nvd_published_at': None}"4031.4.0,GHSA-x9p2-fxq6-2m5f,2021-08-16T23:44:47Z,2019-06-20T14:33:07Z,,[],Reverse Tabnapping in swagger-ui,"Versions of `swagger-ui` prior to 3.18.0 are vulnerable to [Reverse Tabnapping](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page. This is commonly used for phishing attacks.404 405 406## Recommendation407 408Upgrade to version 3.18.0 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'swagger-ui'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.18.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/swagger-api/swagger-ui/pull/4789'}, {'type': 'WEB', 'url': 'https://github.com/swagger-api/swagger-ui/commit/3f4cae3334fdd492a373f4453bd03a9ebd87becf'}, {'type': 'WEB', 'url': 'https://github.com/swagger-api/swagger-ui/releases/tag/v3.18.0'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-SWAGGERUI-449808'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/975'}]","{'cwe_ids': ['CWE-1022'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-20T14:13:56Z', 'nvd_published_at': None}"4091.4.0,GHSA-m8fw-534v-xm85,2020-08-31T18:31:00Z,2019-06-04T15:43:29Z,,[],Cross-Site Scripting (XSS) in cloudcmd,"Versions of `cloudcmd` before 9.1.6 are vulnerable to cross-site scripting (XSS) when listing files in a directory. The attacker must control the name of a file for this vulnerability to be exploitable.410 411 412## Recommendation413 414Update to version 9.1.6 or later.",[],"[{'package': {'ecosystem': 'npm', 'name': 'cloudcmd'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '9.1.6'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/coderaiser/cloudcmd/commit/23f4d4702cd3d473977285f26ea2ae7206b45f38'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/341044'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/341044)'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/642'}]","{'cwe_ids': ['CWE-79'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-04T15:43:12Z', 'nvd_published_at': None}"4151.4.0,GHSA-mf6x-7mm4-x2g7,2021-03-19T20:59:51Z,2019-06-20T18:22:32Z,,['CVE-2018-21270'],Out-of-bounds Read in stringstream,"All versions of `stringstream` are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.416 417 418## Recommendation419 420No fix is currently available for this vulnerability. It is our recommendation to not install or use this module if user input is being passed in to `stringstream`.",[],"[{'package': {'ecosystem': 'npm', 'name': 'stringstream'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.0.6'}]}]}]","[{'type': 'WEB', 'url': 'https://hackerone.com/reports/321670'}, {'type': 'WEB', 'url': 'https://github.com/mhart/StringStream/blob/v0.0.5/stringstream.js#L32'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/664'}]","{'cwe_ids': ['CWE-125'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-20T18:22:00Z', 'nvd_published_at': '2020-12-03T21:15:00Z'}"4211.4.0,GHSA-xf5p-87ch-gxw2,2022-08-02T17:43:57Z,2019-06-05T14:10:03Z,,[],Marked ReDoS due to email addresses being evaluated in quadratic time,"Versions of `marked` from 0.3.14 until 0.6.2 are vulnerable to Regular Expression Denial of Service. Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.422 423 424## Recommendation425 426Upgrade to version 0.6.2 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}]","[{'package': {'ecosystem': 'npm', 'name': 'marked'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.3.14'}, {'fixed': '0.6.2'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/markedjs/marked/pull/1460'}, {'type': 'WEB', 'url': 'https://github.com/markedjs/marked/commit/b15e42b67cec9ded8505e9d68bb8741ad7a9590d'}, {'type': 'PACKAGE', 'url': 'https://github.com/markedjs/marked'}, {'type': 'WEB', 'url': 'https://github.com/markedjs/marked/releases/tag/v0.6.2'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-MARKED-174116'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/812'}]","{'cwe_ids': ['CWE-400'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-05T13:50:35Z', 'nvd_published_at': None}"4271.4.0,GHSA-6cc5-2vg4-cc7m,2023-08-31T09:10:55Z,2019-06-10T18:05:06Z,,['CVE-2019-12387'],Twisted CRLF Injection,"In Twisted before 19.2.1, twisted.web did not validate or sanitize URIs or HTTP methods, allowing an attacker to inject invalid characters such as CRLF.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'twisted'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '19.2.1'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-12387'}, {'type': 'WEB', 'url': 'https://github.com/twisted/twisted/commit/6c61fc4503ae39ab8ecee52d10f10ee2c371d7e2'}, {'type': 'PACKAGE', 'url': 'https://github.com/twisted/twisted'}, {'type': 'WEB', 'url': 'https://labs.twistedmatrix.com/2019/06/twisted-1921-released.html'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/2G5RPDQ4BNB336HL6WW5ZJ344MAWNN7N/'}, {'type': 'WEB', 'url': 'https://twistedmatrix.com/pipermail/twisted-python/2019-June/032352.html'}, {'type': 'WEB', 'url': 'https://usn.ubuntu.com/4308-1/'}, {'type': 'WEB', 'url': 'https://usn.ubuntu.com/4308-2/'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00030.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00042.html'}]","{'cwe_ids': ['CWE-74', 'CWE-93'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-10T18:04:12Z', 'nvd_published_at': '2019-06-10T12:29:00Z'}"4281.4.0,GHSA-73cw-jxmm-qpgh,2020-08-31T18:31:31Z,2019-06-11T16:40:48Z,,[],Path Traversal in localhost-now,"All versions of `localhost-now` are vulnerable to path traversal. This vulnerability is a bypass to the path traversal fix introduced in version 1.0.2429 430Proof of concept:431 432```433$ curl -v --path-as-is ""http://IP:5432/..././..././..././..././..././..././..././..././..././..././etc/passwd"" 434```435 436 437## Recommendation438 439No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.440 ",[],"[{'package': {'ecosystem': 'npm', 'name': 'localhost-now'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.2'}]}]}]","[{'type': 'WEB', 'url': 'https://hackerone.com/reports/329837'}, {'type': 'WEB', 'url': 'https://github.com/DCKT/localhost-now/blob/master/lib/app.js#L17'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/655'}]","{'cwe_ids': ['CWE-22'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-11T16:40:34Z', 'nvd_published_at': None}"4411.4.0,GHSA-8j8c-7jfh-h6hx,2020-08-31T18:36:43Z,2019-06-04T20:14:07Z,,[],Code Injection in js-yaml,"Versions of `js-yaml` prior to 3.13.1 are vulnerable to Code Injection. The `load()` function may execute arbitrary code injected through a malicious YAML file. Objects that have `toString` as key, JavaScript code as value and are used as explicit mapping keys allow attackers to execute the supplied code through the `load()` function. The `safeLoad()` function is unaffected.442 443An example payload is 444`{ toString: !<tag:yaml.org,2002:js/function> 'function (){return Date.now()}' } : 1` 445which returns the object 446{447  ""1553107949161"": 1448}449 450 451## Recommendation452 453Upgrade to version 3.13.1.",[],"[{'package': {'ecosystem': 'npm', 'name': 'js-yaml'}, 'ecosystem_specific': {'affected_functions': ['js-yaml.load']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.13.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/nodeca/js-yaml/pull/480'}, {'type': 'WEB', 'url': 'https://github.com/nodeca/js-yaml/pull/480/commits/e18afbf1edcafb7add2c4c7b22abc8d6ebc2fa61'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/813'}]","{'cwe_ids': ['CWE-94'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-04T20:13:53Z', 'nvd_published_at': None}"4541.4.0,GHSA-wrw9-m778-g6mc,2020-08-31T18:29:15Z,2019-06-03T17:27:57Z,,[],Memory Exposure in bl,"Versions of `bl` before 0.9.5 and 1.0.1 are vulnerable to memory exposure.455 456`bl.append(number)` in the affected `bl` versions passes a number to Buffer constructor, appending a chunk of uninitialized memory457 458 459## Recommendation460 461Update to version 0.9.5, 1.0.1 or later.",[],"[{'package': {'ecosystem': 'npm', 'name': 'bl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.9.5'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'bl'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.0.1'}]}], 'versions': ['1.0.0']}]","[{'type': 'WEB', 'url': 'https://github.com/rvagg/bl/pull/22'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/596'}]","{'cwe_ids': ['CWE-200'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-03T17:23:00Z', 'nvd_published_at': None}"4621.4.0,GHSA-5x32-c9mf-49cc,2023-08-28T13:16:23Z,2019-06-20T16:06:15Z,,['CVE-2019-8320'],RubyGems Delete directory using symlink when decompressing tar,"A Directory Traversal issue was discovered in RubyGems 2.7.6 and later through 3.0.2. Before making new directories or touching files (which now include path-checking code for symlinks), it would delete the target destination. If that destination was hidden behind a symlink, a malicious gem could delete arbitrary files on the user's machine, presuming the attacker could guess at paths. Given how frequently gem is run as sudo, and how predictable paths are on modern systems (/tmp, /usr, etc.), this could likely lead to data loss or an unusable system.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.6'}, {'fixed': '2.7.9'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.3'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-8320'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/317321'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1429'}, {'type': 'WEB', 'url': 'https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html'}, {'type': 'PACKAGE', 'url': 'https://github.com/rubygems/rubygems'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8320.yml'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html'}]","{'cwe_ids': ['CWE-22'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-20T16:02:48Z', 'nvd_published_at': None}"4631.4.0,GHSA-fqfj-cmh6-hj49,2023-07-05T19:06:46Z,2019-06-13T16:15:56Z,,['CVE-2019-11027'],ruby-openid SSRF via claimed_id request,"Ruby OpenID (aka ruby-openid) through 2.8.0 is vulnerable to SSRF. Ruby-openid performs discovery first, and then verification. This allows an attacker to change the URL used for discovery and trick the server into connecting to the URL, which might be a private server not publicly accessible. Severity can range from medium to critical, depending on how a web application developer chose to employ the ruby-openid library. Developers who based their OpenID integration heavily on the ""example app"" provided by the project are at highest risk.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'ruby-openid'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.9.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-11027'}, {'type': 'WEB', 'url': 'https://github.com/openid/ruby-openid/issues/122'}, {'type': 'WEB', 'url': 'https://github.com/openid/ruby-openid/commit/d181a8a2099c64365a1d24b29f6b6b646673a131'}, {'type': 'PACKAGE', 'url': 'https://github.com/openid/ruby-openid'}, {'type': 'WEB', 'url': 'https://github.com/openid/ruby-openid/releases/tag/v2.9.0'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/ruby-openid/CVE-2019-11027.yml'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2019/10/msg00014.html'}, {'type': 'WEB', 'url': 'https://marc.info/?l=openid-security&m=155154717027534&w=2'}, {'type': 'WEB', 'url': 'https://security.gentoo.org/glsa/202003-09'}]","{'cwe_ids': ['CWE-918'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T15:45:16Z', 'nvd_published_at': None}"4641.4.0,GHSA-q22g-8fr4-qpj4,2021-08-04T21:36:58Z,2019-06-06T15:32:15Z,,['CVE-2019-12041'],Regular Expression Denial of Service in remarkable,lib/common/html_re.js in remarkable 1.7.1 allows Regular Expression Denial of Service (ReDoS) via a CDATA section.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'remarkable'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.7.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-12041'}, {'type': 'WEB', 'url': 'https://github.com/jonschlinkert/remarkable/issues/331'}, {'type': 'WEB', 'url': 'https://github.com/jonschlinkert/remarkable/pull/335#issuecomment-515958379'}, {'type': 'WEB', 'url': 'https://github.com/jonschlinkert/remarkable/commit/287dfbf22e70790c8b709ae37a5be0523597673c'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-REMARKABLE-174639'}]","{'cwe_ids': ['CWE-400'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-06T15:21:06Z', 'nvd_published_at': '2019-05-13T13:29:00Z'}"4651.4.0,GHSA-4qhx-g9wp-g9m6,2021-09-16T21:00:23Z,2019-06-14T16:09:01Z,,[],Failure to sanitize quotes which can lead to sql injection in squel,"All versions of `squel` are vulnerable to sql injection.466 467The `squel` package does not properly escape user provided input when provided using the `setFields` method. This could lead to sql injection if the query was then executed.468 469Proof of concept demonstrating the injection of a single quote into a generated sql statement from user provided input.470```471> console.log(squel.insert().into('buh').setFields({foo: ""bar'baz""}).toString());472INSERT INTO buh (foo) VALUES ('bar'baz')473```474 475 476## Recommendation477 478There is no fix at this time and the issue has been reported publicly. Consider using another query builder that provides strong guarantees for input sanitization to prevent sql injection attacks.",[],"[{'package': {'ecosystem': 'npm', 'name': 'squel'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '5.13.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/hiddentao/squel/issues/350'}, {'type': 'PACKAGE', 'url': 'https://github.com/hiddentao/squel'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/575'}]","{'cwe_ids': ['CWE-74', 'CWE-89'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-06-14T16:08:38Z', 'nvd_published_at': None}"4791.4.0,GHSA-gm9g-2g8v-fvxj,2021-09-16T20:59:20Z,2019-06-06T15:32:28Z,,[],Prototype Pollution in upmerge,"All versions of `upmerge` are vulnerable to Prototype Pollution. The merge() function fails to prevent user input to alter an Object's prototype, allowing attackers to modify override properties of all objects in the application. This may lead to Denial of Service or may be chained with other vulnerabilities leading to Remote Code Execution.480 481 482## Recommendation483 484No fix is currently available. Consider using an alternative module until a fix is made available.485","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'upmerge'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.1.8'}]}]}]","[{'type': 'WEB', 'url': 'https://hackerone.com/reports/439120'}, {'type': 'PACKAGE', 'url': 'https://github.com/jazzfog/UpMerge'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-UPMERGE-174133'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/809'}]","{'cwe_ids': ['CWE-345', 'CWE-400'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-06T10:04:57Z', 'nvd_published_at': None}"4861.4.0,GHSA-mh37-8c3g-3fgc,2023-08-28T13:22:21Z,2019-06-20T16:06:00Z,,['CVE-2019-8322'],RubyGems Escape sequence injection vulnerability in gem owner,"An issue was discovered in RubyGems 2.6 and later through 3.0.2. The gem owner command outputs the contents of the API response directly to stdout. Therefore, if the response is crafted, escape sequence injection may occur.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.7.9'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-8322'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/315087'}, {'type': 'WEB', 'url': 'https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8322.yml'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html'}]","{'cwe_ids': ['CWE-74'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-20T16:00:00Z', 'nvd_published_at': None}"4871.4.0,GHSA-xc7v-wxcw-j472,2020-08-31T18:29:19Z,2019-06-03T17:08:26Z,,[],Memory Exposure in tunnel-agent,"Versions of `tunnel-agent` before 0.6.0 are vulnerable to memory exposure.488 489This is exploitable if user supplied input is provided to the auth value and is a number.490 491Proof-of-concept:492```js493require('request')({494  method: 'GET',495  uri: 'http://www.example.com',496  tunnel: true,497  proxy:{498    protocol: 'http:',499    host:'127.0.0.1',500    port:8080,501    auth:USERSUPPLIEDINPUT // number502  }503});504```505 506 507## Recommendation508 509Update to version 0.6.0 or later.",[],"[{'package': {'ecosystem': 'npm', 'name': 'tunnel-agent'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.6.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/request/tunnel-agent/commit/9ca95ec7219daface8a6fc2674000653de0922c0'}, {'type': 'WEB', 'url': 'https://gist.github.com/ChALkeR/fd6b2c445834244e7d440a043f9d2ff4'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/598'}]","{'cwe_ids': ['CWE-200'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-03T17:08:06Z', 'nvd_published_at': None}"5101.4.0,GHSA-8v5f-hp78-jgxq,2020-08-31T18:37:26Z,2019-06-06T15:30:33Z,,[],Signature Verification Bypass in jwt-simple,"Versions of `jwt-simple` prior to 0.5.3 are vulnerable to Signature Verification Bypass. If no algorithm is specified in the `decode()` function, the packages uses the algorithm in the JWT to decode tokens. This allows an attacker to create a HS256 (symmetric algorithm) JWT with the server's public key as secret, and the package will verify it as HS256 instead of RS256 (asymmetric algorithm).511 512 513## Recommendation514 515Upgrade to version 0.5.3 or later.",[],"[{'package': {'ecosystem': 'npm', 'name': 'jwt-simple'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.5.3'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/hokaccha/node-jwt-simple/commit/ead36e1d687645da9c3be8befdaaef622ea33106'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/831'}]","{'cwe_ids': ['CWE-347'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-06T09:42:36Z', 'nvd_published_at': None}"5161.4.0,GHSA-xggx-fx6w-v7ch,2021-08-04T20:41:46Z,2019-06-04T15:42:15Z,,['CVE-2019-3802'],Improper Neutralization of Wildcards or Matching Symbols,"This affects Spring Data JPA in versions up to and including 2.1.6, 2.0.14 and 1.11.20. ExampleMatcher using ExampleMatcher.StringMatcher.STARTING, ExampleMatcher.StringMatcher.ENDING or ExampleMatcher.StringMatcher.CONTAINING could return more results than anticipated when a maliciously crafted example value is supplied.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.data:spring-data-jpa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.data:spring-data-jpa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.1.8'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.0.14'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.data:spring-data-jpa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.11.22'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-3802'}, {'type': 'WEB', 'url': 'https://pivotal.io/security/cve-2019-3802'}]","{'cwe_ids': ['CWE-155', 'CWE-200'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-04T15:38:52Z', 'nvd_published_at': '2019-06-03T14:29:00Z'}"5171.4.0,GHSA-38cg-gg9j-q9j9,2021-08-17T15:33:33Z,2019-06-27T17:25:57Z,,['CVE-2019-3875'],Improper Certificate Validation and Insufficient Verification of Data Authenticity in Keycloak,"A vulnerability was found in keycloak before 6.0.2. The X.509 authenticator supports the verification of client certificates through the CRL, where the CRL list can be obtained from the URL provided in the certificate itself (CDP) or through the separately configured path. The CRL are often available over the network through unsecured protocols ('http' or 'ldap') and hence the caller should verify the signature and possibly the certification path. Keycloak currently doesn't validate signatures on CRL, which can result in a possibility of various attacks like man-in-the-middle.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.keycloak:keycloak-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '6.0.1'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-3875'}, {'type': 'WEB', 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-3875'}]","{'cwe_ids': ['CWE-295', 'CWE-345'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-27T15:43:10Z', 'nvd_published_at': '2019-06-12T14:29:00Z'}"5181.4.0,GHSA-cff4-rrq6-h78w,2020-08-31T18:31:41Z,2019-06-03T17:31:26Z,,[],Command Injection in command-exists,"Versions of `command-exists` before 1.2.4 are vulnerable to command injection. This is exploitable if user input is provided to this module.519 520 521## Recommendation522 523Update to version 1.2.4 or later.",[],"[{'package': {'ecosystem': 'npm', 'name': 'command-exists'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.2.4'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/mathisonian/command-exists/commit/7ca91ba71604df6817a28c93d7776af9c49c431a'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/324453'}, {'type': 'WEB', 'url': 'https://github.com/mathisonian/command-exists/blob/v1.2.2/lib/command-exists.js#L49-L94'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/659'}]","{'cwe_ids': ['CWE-77'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-06-03T17:28:56Z', 'nvd_published_at': None}"5241.4.0,GHSA-pgcr-7wm4-mcv6,2021-08-04T21:28:00Z,2019-06-04T15:42:45Z,,[],Sensitive Data Exposure in pem,"Versions of `pem` before 1.13.2 expose sensitive data when the `readPkcs12` is used. 525 526The `readPkcs12` function reads the certificate and key data from a pkcs12 file using the encryption password. As part of this process it creates a globally readable file with a filename of 20 random 0-f characters in the temporary directory containing the password which is then read by OpenSSL. The file containing the password is never cleaned up after it is used giving access to the pkcs12 password to any other users with access to read files from the system.527 528 529 530## Recommendation531 532Update to version 1.13.2 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'pem'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.13.2'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/Dexus/pem/pull/217'}, {'type': 'WEB', 'url': 'https://github.com/Dexus/pem/commit/bed1190e4a08692ac903ae6043489f1f76bc67eb'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-PEM-173687'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/723'}]","{'cwe_ids': ['CWE-200'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-06-04T15:41:30Z', 'nvd_published_at': None}"5331.4.0,GHSA-hwcx-9p4j-7hwj,2021-08-16T15:20:04Z,2019-06-13T20:22:30Z,,['CVE-2019-5442'],XML Entity Expansion in Pippo,"XML Entity Expansion (Billion Laughs Attack) on Pippo 1.12.0 results in Denial of Service.Entities are created recursively and large amounts of heap memory is taken. Eventually, the JVM process will run out of memory. Otherwise, if the OS does not bound the memory on that process, memory will continue to be exhausted and will affect other processes on the system.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'ro.pippo:pippo-jaxb'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.12.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-5442'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/506791'}]","{'cwe_ids': ['CWE-776'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T20:22:17Z', 'nvd_published_at': '2019-06-12T16:29:00Z'}"5341.4.0,GHSA-w7q7-vjp8-7jv4,2020-08-31T18:36:13Z,2019-06-06T15:30:16Z,,[],SQL Injection in typeorm,"Versions of `typeorm` before 0.1.15 are vulnerable to SQL Injection. Field names are not properly validated allowing attackers to inject SQL statements and execute arbitrary SQL queries.535 536 537## Recommendation538 539Upgrade to version 0.1.15",[],"[{'package': {'ecosystem': 'npm', 'name': 'typeorm'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.1.15'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/typeorm/typeorm/commit/d46c8b0e6c0db56bb5976a4917e9f67a43715111'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/319458'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/800'}]","{'cwe_ids': ['CWE-89'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-05T21:25:43Z', 'nvd_published_at': None}"5401.4.0,GHSA-j9f8-8h89-j69x,2021-08-04T21:06:49Z,2019-06-11T16:16:34Z,,[],Remote Code Execution in node-os-utils,"Versions of `node-os-utils` prior to 1.1.0 are vulnerable to Remote Code Execution. Due to insufficient input validation an attacker could run arbitrary commands on the server thus rendering the package vulnerable to Remote Code Execution.541 542 543## Recommendation544 545Upgrade to version 1.1.0 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}]","[{'package': {'ecosystem': 'npm', 'name': 'node-os-utils'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/SunilWang/node-os-utils/issues/2'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-NODEOSUTILS-173696'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/784'}]","{'cwe_ids': ['CWE-94'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-11T16:08:05Z', 'nvd_published_at': None}"5461.4.0,GHSA-3h4r-pjv6-cph9,2023-08-28T13:23:44Z,2019-06-20T16:05:57Z,,['CVE-2019-8323'],RubyGems Escape sequence injection vulnerability in api response handling,"An issue was discovered in RubyGems 2.6 and later through 3.0.2. Gem::GemcutterUtilities#with_response may output the API response to stdout as it is. Therefore, if the API side modifies the response, escape sequence injection may occur.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.7.9'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rubygems-update'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-8323'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/315081'}, {'type': 'WEB', 'url': 'https://blog.rubygems.org/2019/03/05/security-advisories-2019-03.html'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rubygems-update/CVE-2019-8323.yml'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/08/msg00027.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2019-07/msg00036.html'}]","{'cwe_ids': ['CWE-74'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-20T15:59:33Z', 'nvd_published_at': None}"5471.4.0,GHSA-p426-qw2p-v95v,2021-08-17T14:51:31Z,2019-06-26T01:09:35Z,,['CVE-2017-15694'],Argument Injection in Apache Geode server,"When an Apache Geode server versions 1.0.0 to 1.8.0 is operating in secure mode, a user with write permissions for specific data regions can modify internal cluster metadata. A malicious user could modify this data in a way that affects the operation of the cluster.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.geode:geode-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-15694'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/311505e7b7a045aaa246f0a1935703acacf41b954621b1363c40bf6f@%3Cuser.geode.apache.org%3E'}]","{'cwe_ids': ['CWE-88'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-26T00:48:24Z', 'nvd_published_at': '2019-06-21T16:15:00Z'}"5481.4.0,GHSA-c35v-qwqg-87jc,2022-08-03T16:27:53Z,2019-06-06T15:32:32Z,,[],express-basic-auth Timing Attack due to native string comparison instead of constant time string comparison,"Versions of `express-basic-auth` prior to 1.1.7 are vulnerable to Timing Attacks. The package uses native string comparison instead of a constant time string comparison, which may lead to Timing Attacks. Timing Attacks can be used to increase the efficiency of brute-force attacks by removing the exponential increase in entropy gained from longer secrets.549 550 551## Recommendation552 553Upgrade to version 1.1.7 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'express-basic-auth'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.7'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/webpack-contrib/webpack-bundle-analyzer/issues/263'}, {'type': 'WEB', 'url': 'https://github.com/LionC/express-basic-auth/pull/20'}, {'type': 'WEB', 'url': 'https://github.com/LionC/express-basic-auth/pull/21'}, {'type': 'WEB', 'url': 'https://github.com/LionC/express-basic-auth/commit/00bb29fdd638f5cda8025d4398be97d528ce3f6f'}, {'type': 'PACKAGE', 'url': 'https://github.com/LionC/express-basic-auth'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-EXPRESSBASICAUTH-174345'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/827'}]","{'cwe_ids': ['CWE-208'], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2019-06-06T09:51:04Z', 'nvd_published_at': None}"5541.4.0,GHSA-2pr6-76vf-7546,2021-08-04T21:32:56Z,2019-06-05T14:35:29Z,,[],Denial of Service in js-yaml,"Versions of `js-yaml` prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.555 556 557## Recommendation558 559Upgrade to version 3.13.0.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'js-yaml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.13.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/nodeca/js-yaml/issues/475'}, {'type': 'WEB', 'url': 'https://github.com/nodeca/js-yaml/commit/a567ef3c6e61eb319f0bfc2671d91061afb01235'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-JSYAML-173999'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/788'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/788/versions'}]","{'cwe_ids': ['CWE-400'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-05T13:52:07Z', 'nvd_published_at': None}"5601.4.0,GHSA-v33x-prhc-gph5,2021-06-09T20:12:57Z,2019-06-27T17:24:58Z,,['CVE-2019-11272'],Insufficiently Protected Credentials and Improper Authentication in Spring Security,"Spring Security, versions 4.2.x up to 4.2.12, and older unsupported versions support plain text passwords using PlaintextPasswordEncoder. If an application using an affected version of Spring Security is leveraging PlaintextPasswordEncoder and a user has a null encoded password, a malicious user (or attacker) can authenticate using a password of ?null?.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.13'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.2.12'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.security:spring-security-cas'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.2.13.RELEASE'}]}], 'database_specific': {'last_known_affected_version_range': '<= 4.2.12.RELEASE'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-11272'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2019/07/msg00008.html'}, {'type': 'WEB', 'url': 'https://pivotal.io/security/cve-2019-11272'}]","{'cwe_ids': ['CWE-287', 'CWE-522'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-27T17:23:36Z', 'nvd_published_at': '2019-06-26T14:15:00Z'}"5611.4.0,GHSA-22mf-97vh-x8rw,2021-12-03T14:35:56Z,2019-06-13T16:12:57Z,2019-07-03T16:48:55Z,['CVE-2019-12760'],TODO,"** DISPUTED ** A deserialization vulnerability exists in the way parso through 0.4.0 handles grammar parsing from the cache. Cache loading relies on pickle and, provided that an evil pickle can be written to a cache grammar file and that its parsing can be triggered, this flaw leads to Arbitrary Code Execution.  NOTE: This is disputed because ""the cache directory is not under control of the attacker in any common configuration.""",[],"[{'package': {'ecosystem': 'PyPI', 'name': 'parso'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.4.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-12760'}, {'type': 'WEB', 'url': 'https://gist.github.com/dhondta/f71ae7e5c4234f8edfd2f12503a5dcc7'}]","{'cwe_ids': [], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T15:48:35Z', 'nvd_published_at': '2019-06-06T19:29:00Z'}"5621.4.0,GHSA-46hv-7769-j7rx,2023-09-07T21:43:42Z,2019-06-13T16:12:22Z,,['CVE-2019-5437'],Unauthorized File Access in harp,"Affected versions of `harp` are vulnerable to Unauthorized File Access. The package states that it ignores files and directories with names that start with an underscore, such as `_secret-folder`. If the underscore character is URL encoded the server delivers the file.563 564## Recommendation565 566Upgrade to version `0.40.2` or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'harp'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.40.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-5437'}, {'type': 'WEB', 'url': 'https://github.com/sintaxi/harp/commit/1ec790baeeb2bfdb4584f1998af3d10a8fa31210'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/453820'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/807'}]","{'cwe_ids': ['CWE-548'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T16:10:40Z', 'nvd_published_at': None}"5671.4.0,GHSA-h6ch-v84p-w6p9,2021-02-24T19:27:02Z,2019-06-13T18:58:54Z,,[],Regular Expression Denial of Service (ReDoS),"A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.",[],"[{'package': {'ecosystem': 'npm', 'name': 'diff'}, 'ecosystem_specific': {'affected_functions': ['diff.parsePatch']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.5.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/kpdecker/jsdiff/commit/2aec4298639bf30fb88a00b356bf404d3551b8c0'}, {'type': 'WEB', 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1552148'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/npm:diff:20180305'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1631'}, {'type': 'WEB', 'url': 'https://www.whitesourcesoftware.com/vulnerability-database/WS-2018-0590'}]","{'cwe_ids': ['CWE-400'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-06-13T18:54:38Z', 'nvd_published_at': None}"5681.4.0,GHSA-g95f-p29q-9xw4,2021-08-04T21:35:07Z,2019-06-06T15:30:30Z,,[],Regular Expression Denial of Service in braces,"Versions of `braces` prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.569 570 571## Recommendation572 573Upgrade to version 2.3.1 or higher.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}]","[{'package': {'ecosystem': 'npm', 'name': 'braces'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.3.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/micromatch/braces/commit/abdafb0cae1e0c00f184abbadc692f4eaa98f451'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/npm:braces:20180219'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/786'}]","{'cwe_ids': ['CWE-185', 'CWE-400'], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2019-06-06T09:40:51Z', 'nvd_published_at': None}"5741.4.0,GHSA-86p3-4gfq-38f2,2021-08-04T21:31:03Z,2019-06-05T14:10:34Z,,[],Denial of Service in url-relative,"All versions of `url-relative` are vulnerable to Denial of Service. If the values `to` and `from` are equal, the function hangs and never returns. This may cause a Denial of Service.575 576 577## Recommendation578 579No fix is currently available. Consider using an alternative module until a fix is made available.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'url-relative'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.0.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/junosuarez/url-relative/issues/3'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-URLRELATIVE-173691'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/783'}]","{'cwe_ids': ['CWE-400'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-05T13:46:47Z', 'nvd_published_at': None}"5801.4.0,GHSA-8f93-rv4p-x4jw,2020-08-31T18:31:48Z,2019-06-12T16:36:52Z,,[],SQL Injection in sql,"All versions of `sql` are vulnerable to sql injection as it does not properly escape parameters when building SQL queries.581 582 583## Recommendation584 585No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.",[],"[{'package': {'ecosystem': 'npm', 'name': 'sql'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.78.0'}]}]}]","[{'type': 'WEB', 'url': 'https://hackerone.com/reports/319465'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/662'}]","{'cwe_ids': ['CWE-89'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-12T16:36:34Z', 'nvd_published_at': None}"5861.4.0,GHSA-hp5r-mhgp-56c9,2021-08-04T20:00:07Z,2019-06-06T15:29:29Z,,['CVE-2019-10078'],Cross-site Scriptin in JSPWiki,"A carefully crafted plugin link invocation could trigger an XSS vulnerability on Apache JSPWiki 2.9.0 to 2.11.0.M3, which could lead to session hijacking. Initial reporting indicated ReferredPagesPlugin, but further analysis showed that multiple plugins were vulnerable.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.jspwiki:jspwiki-war'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.11.0.M4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.11.0.M3'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.jspwiki:jspwiki-main'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.11.0.M4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.11.0.M3'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10078'}, {'type': 'WEB', 'url': 'https://jspwiki-wiki.apache.org/Wiki.jsp?page=CVE-2019-10078'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-05-29T19:05:49Z', 'nvd_published_at': '2019-05-20T21:29:00Z'}"5871.4.0,GHSA-rv49-54qp-fw42,2020-08-31T18:36:18Z,2019-06-06T15:30:20Z,,[],Path Traversal in servey,"Versions of `servey` prior to 3.x are vulnerable to Path Traversal.  Due to insufficient input sanitization, attackers can access server files by using relative paths. 588 589 590## Recommendation591 592Upgrade to the latest version",[],"[{'package': {'ecosystem': 'npm', 'name': 'servey'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.1.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/typeorm/typeorm/commit/d46c8b0e6c0db56bb5976a4917e9f67a43715111'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/355501'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/802'}]","{'cwe_ids': ['CWE-22'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-06T08:47:21Z', 'nvd_published_at': None}"5931.4.0,GHSA-f7r3-p866-q9qr,2022-08-03T16:34:42Z,2019-06-03T17:27:49Z,,[],ircdkit vulnerable to Denial of Service due to unhandled connection end event,"Versions of `ircdkit` 1.0.3 and prior are vulnerable to a remote denial of service.594 595 596## Recommendation597 598Upgrade to version 1.0.4.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L'}]","[{'package': {'ecosystem': 'npm', 'name': 'ircdkit'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.4'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.0.3'}}]","[{'type': 'WEB', 'url': 'https://github.com/Twipped/ircdkit/issues/1'}, {'type': 'WEB', 'url': 'https://github.com/Twipped/ircdkit/pull/2/commits/595ed02cde517fad57854d2ac2855a09a626e665'}, {'type': 'WEB', 'url': 'https://github.com/Twipped/ircdkit/commit/f0cc6dc913ec17b499fa33a676bb72c624456f2c'}, {'type': 'PACKAGE', 'url': 'https://github.com/Twipped/ircdkit'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-IRCDKIT-173688'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/735'}]","{'cwe_ids': ['CWE-400'], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2019-06-03T17:27:33Z', 'nvd_published_at': None}"5991.4.0,GHSA-xm7f-x4wx-wmgv,2020-08-31T18:31:36Z,2019-06-04T15:47:43Z,,[],Out-of-bounds Read in byte,"Versions of `byte` before 1.4.1 allocate uninitialized buffers and read data from them past the initialized length600 601 602 603## Recommendation604 605Update to version 1.4.1 or later.",[],"[{'package': {'ecosystem': 'npm', 'name': 'byte'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/node-modules/byte/pull/3'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/330351'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/657'}]","{'cwe_ids': ['CWE-125'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-04T15:47:01Z', 'nvd_published_at': None}"6061.4.0,GHSA-7rp2-fm2h-wchj,2023-09-05T13:11:53Z,2019-06-10T18:43:25Z,,['CVE-2019-12308'],Django Cross-site Scripting in AdminURLFieldWidget,"An issue was discovered in Django 1.11 before 1.11.21, 2.1 before 2.1.9, and 2.2 before 2.2.2. The clickable Current URL value displayed by the AdminURLFieldWidget displays the provided value without validating it as a safe URL. Thus, an unvalidated value stored in the database, or a value provided as a URL query parameter payload, could result in an clickable JavaScript link.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.11.0'}, {'fixed': '1.11.21'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.9'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.2.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-12308'}, {'type': 'WEB', 'url': 'https://docs.djangoproject.com/en/dev/releases/1.11.21/'}, {'type': 'WEB', 'url': 'https://docs.djangoproject.com/en/dev/releases/2.1.9/'}, {'type': 'WEB', 'url': 'https://docs.djangoproject.com/en/dev/releases/2.2.2/'}, {'type': 'WEB', 'url': 'https://docs.djangoproject.com/en/dev/releases/security/'}, {'type': 'PACKAGE', 'url': 'https://github.com/django/django'}, {'type': 'WEB', 'url': 'https://groups.google.com/forum/#!topic/django-announce/GEbHU7YoVz8'}, {'type': 'WEB', 'url': 'https://www.djangoproject.com/weblog/2019/jun/03/security-releases/'}, {'type': 'WEB', 'url': 'http://www.openwall.com/lists/oss-security/2019/06/03/2'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-10T18:41:42Z', 'nvd_published_at': '2019-06-03T17:29:00Z'}"6071.4.0,GHSA-83rx-c8cr-6j8q,2021-08-04T21:33:58Z,2019-06-05T20:48:55Z,,[],Insecure Default Configuration in tesseract.js,"Versions of `tesseract.js` prior to 1.0.19 default to using a third-party proxy.  Requests may be proxied through `crossorigin.me` which clearly states is not suitable for production use. This may lead to instability and privacy violations.608 609 610## Recommendation611 612Upgrade to version 1.0.19 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'tesseract.js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.0.19'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/naptha/tesseract.js/pull/267'}, {'type': 'WEB', 'url': 'https://github.com/naptha/tesseract.js/commit/679eba055f2a4271558e86beec3d1b70cae3fb28'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-TESSERACTJS-174085'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/792'}]","{'cwe_ids': ['CWE-829'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-06-05T20:48:43Z', 'nvd_published_at': None}"6131.4.0,GHSA-w457-6q6x-cgp9,2022-06-06T17:16:15Z,2019-12-26T17:58:13Z,,['CVE-2019-19919'],Prototype Pollution in handlebars,"Versions of `handlebars` prior to 3.0.8 or 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' `__proto__` and `__defineGetter__` properties, which may allow an attacker to execute arbitrary code through crafted payloads.614 615 616## Recommendation617 618Upgrade to version 3.0.8, 4.3.0 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'handlebars'}, 'ecosystem_specific': {'affected_functions': ['handlebars.compile']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.3.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-19919'}, {'type': 'WEB', 'url': 'https://github.com/wycats/handlebars.js/issues/1558'}, {'type': 'WEB', 'url': 'https://github.com/wycats/handlebars.js/commit/2078c727c627f25d4a149962f05c1e069beb18bc'}, {'type': 'WEB', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-19919'}, {'type': 'PACKAGE', 'url': 'https://github.com/wycats/handlebars.js'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1164'}, {'type': 'WEB', 'url': 'https://www.tenable.com/security/tns-2021-14'}]","{'cwe_ids': ['CWE-1321', 'CWE-74'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-12-26T17:55:40Z', 'nvd_published_at': '2019-12-20T23:15:00Z'}"6191.4.0,GHSA-24r8-fm9r-cpj2,2021-01-08T20:10:19Z,2019-12-05T18:40:51Z,,['CVE-2019-16771'],Low severity vulnerability that affects com.linecorp.armeria:armeria,"## Multiple timing attack vulnerabilities leading to the recovery of secrets based on the use of non-constant time compare function620 621### Impact622 623String comparison method in multiple authentication validation in Armeria were known to be vulnerable to timing attacks. This vulnerability is caused by the insecure implementation of `equals` method from `java.lang.String`. While this attack is not practically possible, an attacker still has a potential to attack if the victim's server validates user by using `equals` method.624 625We would like to thank @chrsow for pointing out the issue.626 627## Potentially vulnerable codes628 629https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/OAuth2Token.java#L54630https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/server/auth/BasicToken.java#L64631 632### Patches633 634There are two options to patch this issue.635 6361. Remove `equals` method; it has been exclusively used for test cases and was never used in any OSS projects that are using Armeria. (But it is worth noting that there are possibilities of closed projects authenticating users by utilizing `equals` method)637 6382. Use `MessageDigest.isEqual` to compare the credential instead.639 640### Workarounds641 6421. Update to the latest version (TBD)643 6442-1. Users can prevent these vulnerabilities by modifying and implementing timing attack preventions by themselves.645 6462-2. Precisely speaking, it is possible to compare credentials by securely comparing them after calling methods to directly return the input (namely `Object. accessToken()`, `Object.username()` and `Object.password()`).647 648### References649- https://cwe.mitre.org/data/definitions/208.html650- https://security.stackexchange.com/questions/111040/should-i-worry-about-remote-timing-attacks-on-string-comparison651 652### Side Note653 654Since it is a theoretical attack, there is no PoC available from neither the vendor nor the security team.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'com.linecorp.armeria:armeria'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.97.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/line/armeria/security/advisories/GHSA-24r8-fm9r-cpj2'}, {'type': 'WEB', 'url': 'https://github.com/line/armeria/security/advisories/GHSA-35fr-h7jr-hh86'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16771'}, {'type': 'WEB', 'url': 'https://github.com/line/armeria/commit/b597f7a865a527a84ee3d6937075cfbb4470ed20'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-24r8-fm9r-cpj2'}]","{'cwe_ids': ['CWE-113'], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:51:26Z', 'nvd_published_at': None}"6551.4.0,GHSA-wjx8-cgrm-hh8p,2023-04-25T16:32:33Z,2019-12-17T22:53:10Z,,['CVE-2019-19745'],Unrestricted file uploads in Contao,"### Impact656 657A back end user with access to the form generator can upload arbitrary files and execute them on the server.658 659### Patches660 661Update to Contao 4.4.46 or 4.8.6.662 663### Workarounds664 665Configure your web server so it does not execute PHP files and other scripts in the Contao file upload directory.666 667### References668 669https://contao.org/en/security-advisories/unrestricted-file-uploads670 671### For more information672 673If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).674","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'contao/core-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.4.46'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'contao/core-bundle'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.5.0'}, {'fixed': '4.8.6'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/contao/contao/security/advisories/GHSA-wjx8-cgrm-hh8p'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-19745'}, {'type': 'WEB', 'url': 'https://contao.org/en/news.html'}, {'type': 'WEB', 'url': 'https://contao.org/en/security-advisories/unrestricted-file-uploads.html'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19745.yaml'}, {'type': 'PACKAGE', 'url': 'https://github.com/contao/contao'}]","{'cwe_ids': ['CWE-434'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-17T19:42:31Z', 'nvd_published_at': None}"6751.4.0,GHSA-3fjq-93xj-3f3f,2021-01-08T20:02:20Z,2019-12-06T23:20:26Z,,['CVE-2019-16772'],Cross-Site Scripting in serialize-to-js,"Versions of `serialize-to-js` prior to 3.0.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.676 677 678## Recommendation679 680Upgrade to version 3.0.1 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L'}]","[{'package': {'ecosystem': 'npm', 'name': 'serialize-to-js'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/commenthol/serialize-to-js/security/advisories/GHSA-3fjq-93xj-3f3f'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16772'}, {'type': 'WEB', 'url': 'https://github.com/commenthol/serialize-to-js/commit/181d7d583ae5293cd47cc99b14ad13352875f3e3'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-3fjq-93xj-3f3f'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1429'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:55:02Z', 'nvd_published_at': None}"6811.4.0,GHSA-pg36-wpm5-g57p,2022-04-25T23:10:28Z,2019-12-20T23:03:57Z,,['CVE-2019-16785'],HTTP Request Smuggling: LF vs CRLF handling in Waitress,"### Impact682 683Waitress implemented a &amp;quot;MAY&amp;quot; part of the RFC7230 (https://tools.ietf.org/html/rfc7230#section-3.5) which states:684 685      Although the line terminator for the start-line and header fields is686      the sequence CRLF, a recipient MAY recognize a single LF as a line687      terminator and ignore any preceding CR.688 689Unfortunately if a front-end server does not parse header fields with an LF the same way as it does those with a CRLF it can lead to the front-end and the back-end server parsing the same HTTP message in two different ways. This can lead to a potential for HTTP request smuggling/splitting whereby Waitress may see two requests while the front-end server only sees a single HTTP message.690 691Example:692 693```694Content-Length: 100[CRLF]695X-Header: x[LF]Content-Length: 0[CRLF]696```697 698Would get treated by Waitress as if it were:699 700```701Content-Length: 100702X-Header: x703Content-Length: 0704```705 706This could potentially get used by attackers to split the HTTP request and smuggle a second request in the body of the first.707 708 709### Patches710 711This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. 712 713Waitress no longer implements the MAY part of the specification and instead requires that all lines are terminated correctly with CRLF. If any lines are found with a bare CR or LF a 400 Bad Request is sent back to the requesting entity.714 715The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don&amp;#39;t cause any changes in behavior.716 717### Workarounds718 719Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn&amp;#39;t use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method)720 721### Issues/more security issues:722 723* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)724* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'waitress'}, 'ecosystem_specific': {'affected_functions': ['waitress.parser.HTTPRequestParser.parse_header', 'waitress.parser.get_header_lines', 'waitress.receiver.ChunkedReceiver', 'waitress.receiver.ChunkedReceiver.received']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/Pylons/waitress/security/advisories/GHSA-pg36-wpm5-g57p'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16785'}, {'type': 'WEB', 'url': 'https://github.com/Pylons/waitress/commit/8eba394ad75deaf9e5cd15b78a3d16b12e6b0eba'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0720'}, {'type': 'WEB', 'url': 'https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes'}, {'type': 'PACKAGE', 'url': 'https://github.com/Pylons/waitress'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7/'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5/'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuapr2022.html'}]","{'cwe_ids': ['CWE-444'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-20T23:01:44Z', 'nvd_published_at': '2019-12-20T23:15:00Z'}"7251.4.0,GHSA-xhh6-956q-4q69,2021-07-28T16:28:00Z,2019-12-02T18:08:19Z,,['CVE-2019-18888'],Argument injection in a MimeTypeGuesser in Symfony,"An issue was discovered in Symfony 2.8.0 through 2.8.50, 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. If an application passes unvalidated user input as the file for which MIME type validation should occur, then arbitrary arguments are passed to the underlying file command. This is related to symfony/http-foundation (and symfony/mime in 4.3.x).","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-foundation'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.8.52'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-foundation'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.4.35'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-foundation'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.2.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-foundation'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.3.8'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/mime'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.3.8'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.8.52'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.4.35'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.2.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.3.8'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-18888'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-18888.yaml'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/mime/CVE-2019-18888.yaml'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18888.yaml'}, {'type': 'WEB', 'url': 'https://github.com/symfony/symfony/releases/tag/v4.3.8'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/DZNXRVHDQBNZQUCNRVZICPPBFRAUWUJX/'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/VXEAOEANNIVYANTMOJ42NKSU6BGNBULZ/'}, {'type': 'WEB', 'url': 'https://symfony.com/blog/cve-2019-18888-prevent-argument-injection-in-a-mimetypeguesser'}, {'type': 'WEB', 'url': 'https://symfony.com/blog/symfony-4-3-8-released'}, {'type': 'WEB', 'url': 'https://symfony.com/cve-2019-18888'}]","{'cwe_ids': ['CWE-20', 'CWE-88'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-01T19:46:13Z', 'nvd_published_at': '2019-11-21T23:15:00Z'}"7261.4.0,GHSA-3r8j-pmch-5j2h,2021-01-08T21:20:32Z,2019-12-05T19:57:04Z,,['CVE-2019-16768'],Internal exception message exposure for login action in Sylius,"## Internal exception message exposure for login action727 728### Impact729Exception messages from internal exceptions (like database exception) are wrapped by `\Symfony\Component\Security\Core\Exception\AuthenticationServiceException` and propagated through the system to UI. Therefore, some internal system information may leak and be visible to the customer. 730 731A validation message with the exception details will be presented to the user when one will try to log into the shop. 732 733### Patches734_Has the problem been patched? What versions should users upgrade to?_735 736### Workarounds737The `src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig` file should be overridden and lines https://github.com/Sylius/Sylius/blob/1.4/src/Sylius/Bundle/UiBundle/Resources/views/Security/_login.html.twig#L13-L17 should be replaced with738```twig739        {% if last_error %}740            <div class=""ui left aligned basic segment"">741                {{ messages.error(last_error.messageKey) }}742            </div>743        {% endif %}744``` 745 746The `messageKey` field should be used instead of the `message`.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'sylius/sylius'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.3.14'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'sylius/sylius'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.4.0'}, {'fixed': '1.4.10'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'sylius/sylius'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.5.0'}, {'fixed': '1.5.7'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'sylius/sylius'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.6.0'}, {'fixed': '1.6.3'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/Sylius/Sylius/security/advisories/GHSA-3r8j-pmch-5j2h'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16768'}, {'type': 'WEB', 'url': 'https://github.com/Sylius/Sylius/commit/be245302dfc594d8690fe50dd47631d186aa945f'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-3r8j-pmch-5j2h'}]","{'cwe_ids': ['CWE-209'], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:56:06Z', 'nvd_published_at': None}"7471.4.0,GHSA-5pm8-492c-92p5,2023-01-26T20:23:44Z,2019-12-02T18:04:11Z,,['CVE-2019-18841'],Prototype Pollution in chartkick,"Affected versions of `@polymer/polymer` are vulnerable to prototype pollution. The package fails to prevent modification of object prototypes through chart options containing a payload such as `{""__proto__"": {""polluted"": true}}`. It is possible to achieve the same results if a chart loads data from a malicious server.748 749 750## Recommendation751 752Upgrade to version 3.2.0 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'chartkick'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.3.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'chartkick'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.0'}, {'fixed': '3.2.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.1.3'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-18841'}, {'type': 'WEB', 'url': 'https://github.com/ankane/chartkick.js/issues/117'}, {'type': 'WEB', 'url': 'https://github.com/ankane/chartkick/commit/b810936bbf687bc74c5b6dba72d2397a399885fa'}, {'type': 'WEB', 'url': 'https://chartkick.com'}, {'type': 'WEB', 'url': 'https://github.com/ankane/chartkick/blob/master/CHANGELOG.md'}, {'type': 'WEB', 'url': 'https://github.com/ankane/chartkick/commits/master'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/chartkick/CVE-2019-18841.yml'}, {'type': 'WEB', 'url': 'https://rubygems.org/gems/chartkick/'}]","{'cwe_ids': [], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-11-27T02:43:23Z', 'nvd_published_at': '2019-11-11T01:15:00Z'}"7531.4.0,GHSA-3c45-wgjp-7v9r,2023-08-31T09:50:49Z,2019-12-17T22:52:34Z,,['CVE-2014-7143'],Python Twisted trustRoot is not respected in HTTP client,Python Twisted 14.0.0 `trustRoot` is not respected in HTTP client,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'twisted'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '14.0.0'}, {'fixed': '14.0.1'}]}], 'versions': ['14.0.0']}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2014-7143'}, {'type': 'WEB', 'url': 'https://github.com/twisted/twisted/commit/3b5942252f5f3e45862a0e12b266ab29e243cc33'}, {'type': 'WEB', 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2014-7143'}, {'type': 'WEB', 'url': 'https://exchange.xforce.ibmcloud.com/vulnerabilities/96135'}, {'type': 'PACKAGE', 'url': 'https://github.com/twisted/twisted'}, {'type': 'WEB', 'url': 'https://security-tracker.debian.org/tracker/CVE-2014-7143'}, {'type': 'WEB', 'url': 'http://www.openwall.com/lists/oss-security/2014/09/22/2'}]","{'cwe_ids': ['CWE-295'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-17T01:47:21Z', 'nvd_published_at': None}"7541.4.0,GHSA-hvmf-r92r-27hr,2021-08-19T16:04:59Z,2019-12-04T21:26:28Z,,['CVE-2019-19118'],Django allows unintended model editing,"Django 2.1 before 2.1.15 and 2.2 before 2.2.8 allows unintended model editing. A Django model admin displaying inline related models, where the user has view-only permissions to a parent model but edit permissions to the inline model, would be presented with an editing UI, allowing POST requests, for updating the inline model. Directly editing the view-only parent model was not possible, but the parent model's save() method was called, triggering potential side effects, and causing pre and post-save signal handlers to be invoked. (To resolve this, the Django admin is adjusted to require edit permissions on the parent model in order for inline models to be editable.)","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.15'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.2.8'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-19118'}, {'type': 'WEB', 'url': 'https://github.com/django/django/commit/103ebe2b5ff1b2614b85a52c239f471904d26244'}, {'type': 'WEB', 'url': 'https://github.com/django/django/commit/36f580a17f0b3cb087deadf3b65eea024f479c21'}, {'type': 'WEB', 'url': 'https://docs.djangoproject.com/en/dev/releases/security/'}, {'type': 'WEB', 'url': 'https://groups.google.com/forum/#!topic/django-announce/GjGqDvtNmWQ'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6R4HD22PVEVQ45H2JA2NXH443AYJOPL5/'}, {'type': 'WEB', 'url': 'https://security.gentoo.org/glsa/202004-17'}, {'type': 'WEB', 'url': 'https://security.netapp.com/advisory/ntap-20191217-0003/'}, {'type': 'WEB', 'url': 'https://www.djangoproject.com/weblog/2019/dec/02/security-releases/'}, {'type': 'WEB', 'url': 'http://www.openwall.com/lists/oss-security/2019/12/02/1'}]","{'cwe_ids': ['CWE-276'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-04T19:44:26Z', 'nvd_published_at': None}"7551.4.0,GHSA-v63x-xc9j-hhvq,2021-07-28T16:43:29Z,2019-12-11T02:01:44Z,,['CVE-2019-10769'],Sandbox Breakout / Arbitrary Code Execution in safer-eval,"All versions of `safer-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. The package fails to restrict access to the main context and is not suited to process arbitrary user input. This may allow attackers to execute arbitrary code in the system.756 757 758## Recommendation759 760The package is not meant to receive user input. Consider using an alternative package until a fix is made available.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'safer-eval'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '1.3.6'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/commenthol/safer-eval/security/advisories/GHSA-v63x-xc9j-hhvq'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10769'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-v63x-xc9j-hhvq'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-SAFEREVAL-534901'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1428'}]","{'cwe_ids': ['CWE-20', 'CWE-94'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:56:57Z', 'nvd_published_at': '2019-12-06T23:15:00Z'}"7611.4.0,GHSA-x92h-wmg2-6hp7,2021-08-19T15:18:27Z,2019-12-02T18:10:24Z,,['CVE-2019-10913'],Invalid HTTP method overrides allow possible XSS or other attacks in Symfony,"In Symfony before 2.7.51, 2.8.x before 2.8.50, 3.x before 3.4.26, 4.x before 4.1.12, and 4.2.x before 4.2.7, HTTP Methods provided as verbs or using the override header may be treated as trusted input, but they are not validated, possibly causing SQL injection or XSS. This is related to symfony/http-foundation.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-foundation'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.51'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-foundation'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'fixed': '2.8.50'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-foundation'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.4.26'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-foundation'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.1.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/http-foundation'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.0'}, {'fixed': '4.2.7'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.51'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'fixed': '2.8.50'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.4.26'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.1.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.2.0'}, {'fixed': '4.2.7'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10913'}, {'type': 'WEB', 'url': 'https://github.com/symfony/symfony/commit/944e60f083c3bffbc6a0b5112db127a10a66a8ec'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/http-foundation/CVE-2019-10913.yaml'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-10913.yaml'}, {'type': 'WEB', 'url': 'https://symfony.com/blog/cve-2019-10913-reject-invalid-http-method-overrides'}, {'type': 'WEB', 'url': 'https://symfony.com/cve-2019-10913'}]","{'cwe_ids': ['CWE-79', 'CWE-89'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-12-01T19:49:35Z', 'nvd_published_at': None}"7621.4.0,GHSA-2mrj-435v-c2cr,2020-06-16T20:41:51Z,2019-12-02T18:15:31Z,2020-06-16T20:15:24Z,[],possible DoS caused by malformed signature decoding in Pure-Python ECDSA,**Withdrawn:** Duplicate of GHSA-pwfw-mgfj-7g3g.,[],"[{'package': {'ecosystem': 'PyPI', 'name': 'ecdsa'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.13.3'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-14853'}, {'type': 'WEB', 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2019-14853'}, {'type': 'WEB', 'url': 'https://github.com/warner/python-ecdsa/releases/tag/python-ecdsa-0.13.3'}, {'type': 'WEB', 'url': 'https://seclists.org/bugtraq/2019/Dec/33'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2019/dsa-4588'}]","{'cwe_ids': [], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-02T01:15:50Z', 'nvd_published_at': None}"7631.4.0,GHSA-4328-8hgf-7wjr,2022-08-11T00:00:45Z,2019-12-13T15:39:32Z,,['CVE-2019-16777'],npm Vulnerable to Global node_modules Binary Overwrite,"Versions of  the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. 764 765For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This will not overwrite system binaries but only binaries put into the global node_modules directory.766 767This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.768 769 770## Recommendation771 772Upgrade to version 6.13.4 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'npm'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.13.4'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/npm/cli/security/advisories/GHSA-4328-8hgf-7wjr'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16777'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHEA-2020:0330'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0573'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0579'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0597'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0602'}, {'type': 'WEB', 'url': 'https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-4328-8hgf-7wjr'}, {'type': 'PACKAGE', 'url': 'https://github.com/npm/cli'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/'}, {'type': 'WEB', 'url': 'https://security.gentoo.org/glsa/202003-48'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1437'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpujan2020.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html'}]","{'cwe_ids': ['CWE-22', 'CWE-269'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:57:02Z', 'nvd_published_at': '2019-12-13T01:15:00Z'}"7731.4.0,GHSA-4mvc-qc5w-v5qr,2023-09-20T19:22:55Z,2019-12-17T22:53:34Z,,['CVE-2019-19712'],Information disclosure in the Contao backend,"### Impact774 775Backend users can manipulate the details view URL to show pages and articles that have not been enabled for them.776 777### Patches778 779Update to Contao 4.4.46 or 4.8.6.780 781### Workarounds782 783None.784 785### References786 787https://contao.org/en/security-advisories/information-disclosure-in-the-back-end788 789### For more information790 791If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).792","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'contao/core-bundle'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.4.46'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'contao/core-bundle'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.5.0'}, {'fixed': '4.8.6'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/contao/contao/security/advisories/GHSA-4mvc-qc5w-v5qr'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-19712'}, {'type': 'WEB', 'url': 'https://contao.org/en/security-advisories/information-disclosure-in-the-back-end.html'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19712.yaml'}, {'type': 'PACKAGE', 'url': 'https://github.com/contao/contao'}]","{'cwe_ids': ['CWE-276'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-17T19:35:52Z', 'nvd_published_at': None}"7931.4.0,GHSA-q58g-455p-8vw9,2021-10-29T14:10:27Z,2019-12-16T19:30:17Z,,['CVE-2019-16779'],"In RubyGem excon, interrupted Persistent Connections May Leak Response Data","### Impact794There was a race condition around persistent connections, where a connection which is interrupted (such as by a timeout) would leave data on the socket. Subsequent requests would then read this data, returning content from the previous response. The race condition window appears to be short, and it would be difficult to purposefully exploit this.795 796### Patches797The problem has been patched in 0.71.0, users should upgrade to this or a newer version (if one exists).798 799### Workarounds800Users can workaround the problem by disabling persistent connections, though this may cause performance implications.801 802### References803See the [patch](https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29) for further details.804 805### For more information806If you have any questions or comments about this advisory:807* Open an issue in [excon/issues](https://github.com/excon/excon/issues)808* Email us at [geemus+github@gmail.com](mailto:geemus+github@gmail.com)","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:N/A:N'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'excon'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.71.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/excon/excon/security/advisories/GHSA-q58g-455p-8vw9'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16779'}, {'type': 'WEB', 'url': 'https://github.com/excon/excon/commit/ccb57d7a422f020dc74f1de4e8fb505ab46d8a29'}, {'type': 'PACKAGE', 'url': 'https://github.com/excon/excon'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/excon/CVE-2019-16779.yml'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/01/msg00015.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00021.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00062.html'}]","{'cwe_ids': ['CWE-362', 'CWE-664'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-16T19:28:10Z', 'nvd_published_at': '2019-12-16T20:15:00Z'}"8091.4.0,GHSA-m6cx-g6qm-p2cx,2021-10-21T21:16:09Z,2019-12-13T15:39:19Z,,['CVE-2019-16775'],Arbitrary File Write in npm,"Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to create files on a user's system when the package is installed. It is only possible to affect files that the user running `npm install` has access to and it is not possible to over write files that already exist on disk.810 811This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.812 813 814## Recommendation815 816Upgrade to version 6.13.3 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'npm'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.13.3'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/npm/cli/security/advisories/GHSA-m6cx-g6qm-p2cx'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16775'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHEA-2020:0330'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0573'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0579'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0597'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0602'}, {'type': 'WEB', 'url': 'https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-m6cx-g6qm-p2cx'}, {'type': 'PACKAGE', 'url': 'https://github.com/npm/cli'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1434'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpujan2020.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuoct2021.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html'}]","{'cwe_ids': ['CWE-59', 'CWE-61'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-17T16:30:50Z', 'nvd_published_at': '2019-12-13T01:15:00Z'}"8171.4.0,GHSA-rh46-3fgc-mvrf,2021-08-19T16:05:30Z,2019-12-04T21:25:28Z,,['CVE-2019-19507'],Validation bypass is possible in Json Pattern Validator,"In jpv (aka Json Pattern Validator) before 2.1.1, compareCommon() can be bypassed because certain internal attributes can be overwritten via a conflicting name, as demonstrated by 'constructor': {'name':'Array'}. This affects validate(). Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'jpv'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.1'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-19507'}, {'type': 'WEB', 'url': 'https://github.com/manvel-khnkoyan/jpv/issues/6'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/package/jpv'}]","{'cwe_ids': ['CWE-287'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-04T19:47:26Z', 'nvd_published_at': None}"8181.4.0,GHSA-qhrx-hcm6-pmrw,2023-01-17T13:55:02Z,2019-12-02T18:12:26Z,,['CVE-2019-11458'],Unsafe deserialization in SmtpTransport in CakePHP,An issue was discovered in SmtpTransport in CakePHP 3.7.6. An unserialized object with modified internal properties can trigger arbitrary file overwriting upon destruction.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.5.18'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.6.0'}, {'fixed': '3.6.15'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'cakephp/cakephp'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.7.0'}, {'fixed': '3.7.7'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-11458'}, {'type': 'WEB', 'url': 'https://github.com/cakephp/cakephp/commit/1a74e798309192a9895c9cedabd714ceee345f4e'}, {'type': 'WEB', 'url': 'https://bakery.cakephp.org/2019/04/23/cakephp_377_3615_3518_released.html'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/cakephp/cakephp/CVE-2019-11458.yaml'}, {'type': 'PACKAGE', 'url': 'https://github.com/cakephp/cakephp'}, {'type': 'WEB', 'url': 'https://github.com/cakephp/cakephp/commits/master'}, {'type': 'WEB', 'url': 'https://github.com/cakephp/cakephp/compare/3.7.6...3.7.7'}, {'type': 'WEB', 'url': 'https://github.com/cakephp/cakephp/releases'}]","{'cwe_ids': ['CWE-502'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-02T00:51:02Z', 'nvd_published_at': None}"8191.4.0,GHSA-484f-743f-6jx2,2022-07-05T18:07:34Z,2019-12-12T22:50:20Z,,['CVE-2019-16774'],Object injection in cookie driver in phpfastcache,"### Impact820An possible object injection has been discovered in cookie driver prior 5.0.13 versions (of 5.x releases).821 822### Patches823The issue has been addressed by enforcing JSON conversion when deserializing824 825### Workarounds826If you can't fix it, use another driver such as ""Files"" (Filesystem)827 828### References829Fixing release: https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13830 831### For more information832If you have any questions or comments about this advisory:833* Open an issue in [the issue tracker](https://github.com/PHPSocialNetwork/phpfastcache/issues)834* Email us at [security@geolim4.com](mailto:security@geolim4.com)835","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'phpfastcache/phpfastcache'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.0.13'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/PHPSocialNetwork/phpfastcache/security/advisories/GHSA-484f-743f-6jx2'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16774'}, {'type': 'WEB', 'url': 'https://github.com/PHPSocialNetwork/phpfastcache/commit/c4527205cb7a402b595790c74310791f5b04a1a4'}, {'type': 'PACKAGE', 'url': 'https://github.com/PHPSocialNetwork/phpfastcache'}, {'type': 'WEB', 'url': 'https://github.com/PHPSocialNetwork/phpfastcache/releases/tag/5.0.13'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-484f-743f-6jx2'}]","{'cwe_ids': ['CWE-94'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:57:47Z', 'nvd_published_at': None}"8361.4.0,GHSA-6xc2-mj39-q599,2022-08-02T15:09:07Z,2019-12-02T18:20:41Z,,['CVE-2019-18818'],Strapi allows unauthenticated attacker to reset admin password without valid reset token,"Versions of `strapi` prior to 3.0.0-beta.17.5 are vulnerable to Privilege Escalation. The password reset routes allows an unauthenticated attacker to reset an admin's password without providing a valid password reset token.837 838 839## Recommendation840 841Upgrade to version 3.0.0-beta.17.5 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'strapi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.0-beta.17.5'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.0.0-beta.17.4'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-18818'}, {'type': 'WEB', 'url': 'https://github.com/strapi/strapi/pull/4443'}, {'type': 'WEB', 'url': 'https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18818'}, {'type': 'PACKAGE', 'url': 'https://github.com/strapi/strapi'}, {'type': 'WEB', 'url': 'https://github.com/strapi/strapi/releases/tag/v3.0.0-beta.17.5'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1311'}, {'type': 'WEB', 'url': 'http://packetstormsecurity.com/files/163939/Strapi-3.0.0-beta-Authentication-Bypass.html'}, {'type': 'WEB', 'url': 'http://packetstormsecurity.com/files/163950/Strapi-CMS-3.0.0-beta.17.4-Remote-Code-Execution.html'}, {'type': 'WEB', 'url': 'http://packetstormsecurity.com/files/165896/Strapi-CMS-3.0.0-beta.17.4-Privilege-Escalation.html'}]","{'cwe_ids': ['CWE-640'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-12-02T17:36:24Z', 'nvd_published_at': '2019-11-07T22:15:00Z'}"8421.4.0,GHSA-x8qc-rrcw-4r46,2022-08-10T23:58:46Z,2019-12-13T15:39:26Z,,['CVE-2019-16776'],npm symlink reference outside of node_modules,"Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of the`node_modules` folder through the `bin` field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the `npm install` are affected.  843 844This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.845 846 847## Recommendation848 849Upgrade to version 6.13.3 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'npm'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.13.3'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/npm/cli/security/advisories/GHSA-x8qc-rrcw-4r46'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16776'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHEA-2020:0330'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0573'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0579'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0597'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0602'}, {'type': 'WEB', 'url': 'https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-x8qc-rrcw-4r46'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Z36UKPO5F3PQ3Q2POMF5LEKXWAH5RUFP/'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1436'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpujan2020.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00027.html'}]","{'cwe_ids': ['CWE-22'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T22:02:49Z', 'nvd_published_at': '2019-12-13T01:15:00Z'}"8501.4.0,GHSA-79gr-58r3-pwm3,2023-09-21T19:46:51Z,2019-12-02T18:07:16Z,,['CVE-2019-18889'],Symfony Unsafe Cache Serialization Could Enable RCE,"An issue was discovered in Symfony 3.4.0 through 3.4.34, 4.2.0 through 4.2.11, and 4.3.0 through 4.3.7. Serializing certain cache adapter interfaces could result in remote code injection. This is related to symfony/cache.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'symfony/cache'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.0'}, {'fixed': '3.4.35'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/cache'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.2.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/cache'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.3.8'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.1.0'}, {'fixed': '3.4.35'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.2.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.3.8'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-18889'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/cache/CVE-2019-18889.yaml'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18889.yaml'}, {'type': 'WEB', 'url': 'https://github.com/symfony/symfony/releases/tag/v4.3.8'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/UED22BOXTL2SSFMGYKA64ZFHGLLJG3EA/'}, {'type': 'WEB', 'url': 'https://symfony.com/blog/cve-2019-18889-forbid-serializing-abstractadapter-and-tagawareadapter-instances'}, {'type': 'WEB', 'url': 'https://symfony.com/blog/symfony-4-3-8-released'}, {'type': 'WEB', 'url': 'https://symfony.com/cve-2019-18889'}]","{'cwe_ids': ['CWE-94'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-12-01T19:45:07Z', 'nvd_published_at': None}"8511.4.0,GHSA-844w-j86r-4x2j,2021-11-01T14:12:42Z,2019-12-16T20:17:10Z,,['CVE-2019-16778'],Heap buffer overflow in `UnsortedSegmentSum` in TensorFlow,"### Impact852 853A heap buffer overflow in `UnsortedSegmentSum` can be produced when the `Index` template argument is `int32`. In this case `data_size` and `num_segments` fields are truncated from `int64` to `int32` and can produce negative numbers, resulting in accessing out of bounds heap memory.854 855This is unlikely to be exploitable and was detected and fixed internally. We are making the security advisory only to notify users that it is better to update to TensorFlow 1.15 or 2.0 or later as these versions already have this fixed.856 857### Patches858 859Patched by db4f9717c41bccc3ce10099ab61996b246099892 and released in all official releases after 1.15 and 2.0.860 861### For more information862Please consult [`SECURITY.md`](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'tensorflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.15'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-cpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.15'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'tensorflow-gpu'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.15'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/tensorflow/tensorflow/security/advisories/GHSA-844w-j86r-4x2j'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16778'}, {'type': 'WEB', 'url': 'https://github.com/tensorflow/tensorflow/commit/db4f9717c41bccc3ce10099ab61996b246099892'}, {'type': 'PACKAGE', 'url': 'https://github.com/tensorflow/tensorflow'}, {'type': 'WEB', 'url': 'https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2019-002.md'}]","{'cwe_ids': ['CWE-122', 'CWE-681'], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2019-12-16T20:16:12Z', 'nvd_published_at': '2019-12-16T21:15:00Z'}"8631.4.0,GHSA-hrqr-hxpp-chr3,2021-11-03T14:59:03Z,2019-12-18T19:01:31Z,,['CVE-2019-16782'],Possible Information Leak / Session Hijack Vulnerability in Rack,"There's a possible information leak / session hijack vulnerability in Rack. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually stored and indexed in a database that uses some kind of scheme for speeding up lookups of that session id. By carefully measuring the amount of time it takes to look up a session, an attacker may be able to find a valid session id and hijack the session.864 865The session id itself may be generated randomly, but the way the session is indexed by the backing store does not use a secure comparison.866 867### Impact868 869The session id stored in a cookie is the same id that is used when querying the backing session storage engine.  Most storage mechanisms (for example a database) use some sort of indexing in order to speed up the lookup of that id.  By carefully timing requests and session lookup failures, an attacker may be able to perform a timing attack to determine an existing session id and hijack that session.870 871## Releases872 873The 1.6.12 and 2.0.8 releases are available at the normal locations.874 875### Workarounds876 877There are no known workarounds.878 879### Patches880 881To aid users who aren't able to upgrade immediately we have provided patches for882the two supported release series. They are in git-am format and consist of a883single changeset.884 885* 1-6-session-timing-attack.patch - Patch for 1.6 series886* 2-0-session-timing-attack.patch - Patch for 2.6 series887 888### Credits889 890Thanks Will Leinweber for reporting this!","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.6.12'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'rack'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.8'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/rack/rack/security/advisories/GHSA-hrqr-hxpp-chr3'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16782'}, {'type': 'WEB', 'url': 'https://github.com/rack/rack/commit/7fecaee81f59926b6e1913511c90650e76673b38'}, {'type': 'PACKAGE', 'url': 'https://github.com/rack/rack'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rack/CVE-2019-16782.yml'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/HZXMWILCICQLA2BYSP6I2CRMUG53YBLX/'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-02/msg00016.html'}, {'type': 'WEB', 'url': 'http://www.openwall.com/lists/oss-security/2019/12/18/2'}, {'type': 'WEB', 'url': 'http://www.openwall.com/lists/oss-security/2019/12/18/3'}, {'type': 'WEB', 'url': 'http://www.openwall.com/lists/oss-security/2019/12/19/3'}, {'type': 'WEB', 'url': 'http://www.openwall.com/lists/oss-security/2020/04/08/1'}, {'type': 'WEB', 'url': 'http://www.openwall.com/lists/oss-security/2020/04/09/2'}]","{'cwe_ids': ['CWE-203', 'CWE-208'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-18T19:01:07Z', 'nvd_published_at': '2019-12-18T20:15:00Z'}"8911.4.0,GHSA-m5ff-3wj3-8ph4,2019-12-26T16:34:06Z,2019-12-26T16:34:38Z,,[],HTTP Request Smuggling: Invalid whitespace characters in headers in Waitress,"### Impact892 893If a proxy server is used in front of waitress, an invalid request may be sent by an attacker that bypasses the front-end and is parsed differently by waitress leading to a potential for HTTP request smuggling.894 895```896Content-Length: 10897Transfer-Encoding: [\x0b]chunked898```899 900For clarity:901 902```9030x0b == vertical tab904```905 906Would get parsed by Waitress as being a `chunked` request, but a front-end server would use the `Content-Length` instead as the `Transfer-Encoding` header is considered invalid due to containing invalid characters.907 908If a front-end server does HTTP pipelining to a backend Waitress server this could lead to HTTP request splitting which may lead to potential cache poisoning or unexpected information disclosure.909 910### Patches911 912Please upgrade to Waitress 1.4.1 which fixes this issue with stricter HTTP field validation.913 914Waitress 1.4.1 due to this change has become much more strict in what is allowed in header values, while the maintainers don't believe that these changes will cause any issues, it may cause failures with non-conformist reverse proxies or clients, and it is highly recommend that users validate the changes in their environment and make sure it won't cause any unacceptable failures.915 916### Workarounds917 918You may enable additional protections on front-end servers, those that follow RFC7230 correctly would drop the request with a 400 Bad Request.919 920Waitress will now correctly responds to the request with a 400 Bad Request, and will drop the connection to avoid any potential HTTP pipelining issues.921 922### References923 924This was mentioned in https://portswigger.net/research/http-desync-attacks-what-happened-next and was specifically mentioned as being an issue in HAProxy which did not properly filter it in this article: https://nathandavison.com/blog/haproxy-http-request-smuggling925 926### Thanks927 928The Pylons Project would like to thank ZeddYu Lu for doing extended testing against Waitress 1.4.0 and bringing this to our attention!929 930### For more information931 932If you have any questions or comments about this advisory:933 934* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)935* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)",[],"[{'package': {'ecosystem': 'PyPI', 'name': 'waitress'}, 'ecosystem_specific': {'affected_functions': ['waitress.parser.HTTPRequestParser.parse_header']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/Pylons/waitress/security/advisories/GHSA-m5ff-3wj3-8ph4'}, {'type': 'WEB', 'url': 'https://github.com/Pylons/waitress/commit/11d9e138125ad46e951027184b13242a3c1de017'}]","{'cwe_ids': ['CWE-444'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-26T16:34:06Z', 'nvd_published_at': None}"9361.4.0,GHSA-fpff-384j-vxq7,2021-08-19T15:10:08Z,2019-12-02T18:05:13Z,,['CVE-2019-10763'],Data leakage via SQL Injection in Pimcore,"pimcore/pimcore before 6.3.0 is vulnerable to SQL Injection. An attacker with limited privileges (classes permission) can achieve a SQL injection that can lead in data leakage. The vulnerability can be exploited via 'id', 'storeId', 'pageSize' and 'tables' parameters, using a payload for trigger a time based or error based sql injection.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'pimcore/pimcore'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '6.3.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10763'}, {'type': 'WEB', 'url': 'https://blog.certimetergroup.com/it/articolo/security/sql_injection_in_pimcore_6.2.3'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-PHP-PIMCOREPIMCORE-480391'}]","{'cwe_ids': ['CWE-89'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-11-27T02:55:07Z', 'nvd_published_at': None}"9371.4.0,GHSA-6rmq-x2hv-vxpp,2023-09-08T14:19:06Z,2019-12-02T18:11:25Z,,['CVE-2019-6338'],Drupal core third-party PEAR Archive_Tar library is vulnerable to Deserialization of Untrusted Data,"In Drupal Core versions 7.x prior to 7.62, 8.6.x prior to 8.6.6 and 8.5.x prior to 8.5.9; Drupal core uses the third-party PEAR Archive_Tar library. This library has released a security update which impacts some Drupal configurations. Refer to CVE-2018-1000888 for details","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'drupal/drupal'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '7.0.0'}, {'fixed': '7.62.0'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'drupal/drupal'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.5.9'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'drupal/drupal'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.6.0'}, {'fixed': '8.6.6'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-6338'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/drupal/drupal/CVE-2019-6338.yaml'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2019/02/msg00032.html'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2019/dsa-4370'}, {'type': 'WEB', 'url': 'https://www.drupal.org/sa-core-2019-001'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/106706'}]","{'cwe_ids': ['CWE-502'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-02T00:34:49Z', 'nvd_published_at': None}"9381.4.0,GHSA-4vpc-5jx4-cfqg,2021-07-28T15:49:16Z,2019-12-02T18:09:21Z,,['CVE-2019-18886'],User enumeration leak using switch user functionality in Symfony,An issue was discovered in Symfony 4.2.0 to 4.2.11 and 4.3.0 to 4.3.7. The ability to enumerate users was possible due to different handling depending on whether the user existed when making unauthorized attempts to use the switch users functionality. This is related to symfony/security.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'symfony/security-http'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.2.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/security-http'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.3.8'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.2.12'}]}]}, {'package': {'ecosystem': 'Packagist', 'name': 'symfony/symfony'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.3.0'}, {'fixed': '4.3.8'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-18886'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/security-http/CVE-2019-18886.yaml'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/symfony/symfony/CVE-2019-18886.yaml'}, {'type': 'WEB', 'url': 'https://github.com/symfony/symfony/releases/tag/v4.3.8'}, {'type': 'WEB', 'url': 'https://symfony.com/blog/cve-2019-18886-prevent-user-enumeration-using-switch-user-functionality'}, {'type': 'WEB', 'url': 'https://symfony.com/blog/symfony-4-3-8-released'}, {'type': 'WEB', 'url': 'https://symfony.com/cve-2019-18886'}]","{'cwe_ids': ['CWE-200', 'CWE-203'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-01T19:47:26Z', 'nvd_published_at': '2019-11-21T18:15:00Z'}"9391.4.0,GHSA-g2xc-35jw-c63p,2022-04-25T23:07:24Z,2019-12-20T23:04:18Z,,['CVE-2019-16786'],HTTP Request Smuggling: Invalid Transfer-Encoding in Waitress,"### Impact940 941Waitress would parse the `Transfer-Encoding` header and only look for a single string value, if that value was not `chunked` it would fall through and use the `Content-Length` header instead.942 943According to the HTTP standard `Transfer-Encoding` should be a comma separated list, with the inner-most encoding first, followed by any further transfer codings, ending with `chunked`.944 945Requests sent with:946 947```948Transfer-Encoding: gzip, chunked949```950 951Would incorrectly get ignored, and the request would use a `Content-Length` header instead to determine the body size of the HTTP message.952 953This could allow for Waitress to treat a single request as multiple requests in the case of HTTP pipelining.954 955### Patches956 957This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. 958 959Waitress will now return a 501 Not Implemented error if the `Transfer-Encoding` is not `chunked` or contains multiple elements. Waitress does not support any transfer codings such as `gzip` or `deflate`.960 961The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don&#39;t cause any changes in behavior.962 963### Workarounds964 965Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn&#39;t use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).966 967### Issues/more security issues:968 969* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)970* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'waitress'}, 'ecosystem_specific': {'affected_functions': ['waitress.parser.HTTPRequestParser.received', 'waitress.parser.HTTPRequestParser.parse_header', 'waitress.parser.get_header_lines', 'waitress.receiver.ChunkedReceiver', 'waitress.receiver.ChunkedReceiver.received', 'waitress.utilities.find_double_newline', 'waitress.utilities.Error']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/Pylons/waitress/security/advisories/GHSA-g2xc-35jw-c63p'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16786'}, {'type': 'WEB', 'url': 'https://github.com/Pylons/waitress/commit/f11093a6b3240fc26830b6111e826128af7771c3'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0720'}, {'type': 'WEB', 'url': 'https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes'}, {'type': 'PACKAGE', 'url': 'https://github.com/Pylons/waitress'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2022/05/msg00011.html'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/GVDHR2DNKCNQ7YQXISJ45NT4IQDX3LJ7/'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LYEOTGWJZVKPRXX2HBNVIYWCX73QYPM5/'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuapr2022.html'}]","{'cwe_ids': ['CWE-444'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-20T23:01:53Z', 'nvd_published_at': '2019-12-20T23:15:00Z'}"9711.4.0,GHSA-h9rv-jmmf-4pgx,2021-01-08T18:42:22Z,2019-12-05T18:44:37Z,,['CVE-2019-16769'],Cross-Site Scripting in serialize-javascript,"Versions of `serialize-javascript` prior to 2.1.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize serialized regular expressions. This vulnerability does not affect Node.js applications.972 973 974## Recommendation975 976Upgrade to version 2.1.1 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:L/A:L'}]","[{'package': {'ecosystem': 'npm', 'name': 'serialize-javascript'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.1.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/yahoo/serialize-javascript/security/advisories/GHSA-h9rv-jmmf-4pgx'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16769'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-h9rv-jmmf-4pgx'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1426'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:39:51Z', 'nvd_published_at': None}"9771.4.0,GHSA-6rjc-4pwr-3vp7,2021-08-19T15:34:42Z,2019-12-02T18:14:30Z,,['CVE-2019-10771'],Cross-Site Scripting in iobroker.web,"Versions of `iobroker.web` prior to 2.4.10 are vulnerable to Cross-Site Scripting. The package fails to escape URL parameters that may be reflected in the server response. This can be used by attackers to execute arbitrary JavaScript in the victim's browser.978 979 980## Recommendation981 982Upgrade to version 2.4.10 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'iobroker.web'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.10'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10771'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-IOBROKERWEB-534971'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1345'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-02T01:13:05Z', 'nvd_published_at': None}"9831.4.0,GHSA-9xcj-c8cr-8c3c,2022-10-07T20:34:53Z,2019-12-26T18:22:26Z,,['CVE-2019-17563'],"In Apache Tomcat, when using FORM authentication there was a narrow window where an attacker could perform a session fixation attack","When using FORM authentication with Apache Tomcat 9.0.0.M1 to 9.0.29, 8.5.0 to 8.5.49 and 7.0.0 to 7.0.98 there was a narrow window where an attacker could perform a session fixation attack. The window was considered too narrow for an exploit to be practical but, erring on the side of caution, this issue has been treated as a security vulnerability.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.0.99'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.5.50'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '9.0.30'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-17563'}, {'type': 'PACKAGE', 'url': 'https://github.com/apache/tomcat'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/8b4c1db8300117b28a0f3f743c0b9e3f964687a690cdf9662a884bbd%40%3Cannounce.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/reb9a66f176df29b9a832caa95ebd9ffa3284e8f4922ec4fa3ad8eb2e@%3Cissues.cxf.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/05/msg00026.html'}, {'type': 'WEB', 'url': 'https://seclists.org/bugtraq/2019/Dec/43'}, {'type': 'WEB', 'url': 'https://security.gentoo.org/glsa/202003-43'}, {'type': 'WEB', 'url': 'https://security.netapp.com/advisory/ntap-20200107-0001/'}, {'type': 'WEB', 'url': 'https://usn.ubuntu.com/4251-1/'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2019/dsa-4596'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2020/dsa-4680'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpujan2021.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpujul2020.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html'}]","{'cwe_ids': ['CWE-384'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-26T18:22:01Z', 'nvd_published_at': '2019-12-23T17:15:00Z'}"9841.4.0,GHSA-4ppp-gpcr-7qf6,2022-03-24T17:52:19Z,2019-12-20T23:04:35Z,,[],HTTP Request Smuggling: Content-Length Sent Twice in Waitress,"### Impact985 986Waitress would header fold a double `Content-Length` header and due to being unable to cast the now comma separated value to an integer would set the `Content-Length` to 0 internally.987 988So a request with:989 990```991Content-Length: 10992Content-Length: 10993```994 995would get transformed to:996 997```998Content-Length: 10, 10999```1000 1001Which would Waitress would then internally set to `Content-Lenght: 0`.1002 1003Waitress would then treat the request as having no body, thereby treating the body of the request as a new request in HTTP pipelining.1004 1005### Patches1006 1007This issue is fixed in Waitress 1.4.0. This brings a range of changes to harden Waitress against potential HTTP request confusions, and may change the behaviour of Waitress behind non-conformist proxies. 1008 1009The Pylons Project recommends upgrading as soon as possible, while validating that the changes in Waitress don't cause any changes in behavior.1010 1011### Workarounds1012 1013Various reverse proxies may have protections against sending potentially bad HTTP requests to the backend, and or hardening against potential issues like this. If the reverse proxy doesn't use HTTP/1.1 for connecting to the backend issues are also somewhat mitigated, as HTTP pipelining does not exist in HTTP/1.0 and Waitress will close the connection after every single request (unless the Keep Alive header is explicitly sent... so this is not a fool proof security method).1014 1015### Issues/more security issues:1016 1017* open an issue at https://github.com/Pylons/waitress/issues (if not sensitive or security related)1018* email the Pylons Security mailing list: pylons-project-security@googlegroups.com (if security related)",[],"[{'package': {'ecosystem': 'PyPI', 'name': 'waitress'}, 'ecosystem_specific': {'affected_functions': ['waitress.parser.HTTPRequestParser.parse_header']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.4.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/Pylons/waitress/security/advisories/GHSA-4ppp-gpcr-7qf6'}, {'type': 'WEB', 'url': 'https://github.com/Pylons/waitress/commit/575994cd42e83fd772a5f7ec98b2c56751bd3f65'}, {'type': 'WEB', 'url': 'https://docs.pylonsproject.org/projects/waitress/en/latest/#security-fixes'}, {'type': 'PACKAGE', 'url': 'https://github.com/Pylons/waitress'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-j7j6-7hfx-5522'}, {'type': 'WEB', 'url': 'https://github.com/pypa/advisory-database/tree/main/vulns/waitress/PYSEC-2020-178.yaml'}]","{'cwe_ids': ['CWE-444'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-12-20T23:02:03Z', 'nvd_published_at': None}"10191.4.0,GHSA-cmch-296j-wfvw,2021-08-19T15:11:15Z,2019-12-02T18:06:14Z,,['CVE-2019-10767'],Arbitrary File Write in iobroker.js-controller,"Versions of `iobroker.controller` prior to 2.0.25 are vulnerable to Path Traversal. The package fails to restrict access to folders outside of the intended `/adapter/<adapter-name>` folder, which may allow attackers to include arbitrary files in the system. An attacker would need to be authenticated to perform the attack but the package has authentication disabled by default.1020 1021 1022## Recommendation1023 1024Upgrade to version 2.0.25 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'iobroker.js-controller'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.25'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10767'}, {'type': 'WEB', 'url': 'https://github.com/ioBroker/ioBroker.js-controller/commit/f6e292c6750a491a5000d0f851b2fede4f9e2fda'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-IOBROKERJSCONTROLLER-534881'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1419'}]","{'cwe_ids': ['CWE-22'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-11-27T03:26:55Z', 'nvd_published_at': None}"10251.4.0,GHSA-26p8-xrj2-mv53,2021-08-19T16:02:34Z,2019-12-02T18:18:37Z,,['CVE-2019-10083'],Apache NiFi process group information disclosure,"When updating a Process Group via the API in NiFi versions 1.3.0 to 1.9.2, the response to the request includes all of its contents (at the top most level, not recursively). The response included details about processors and controller services which the user may not have had read access to.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-web-api'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.10.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.10.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10083'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E'}, {'type': 'WEB', 'url': 'https://nifi.apache.org/security.html#CVE-2019-10083'}]","{'cwe_ids': ['CWE-200'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-02T17:30:21Z', 'nvd_published_at': None}"10261.4.0,GHSA-h47j-hc6x-h3qq,2023-09-12T18:35:46Z,2019-12-30T19:30:31Z,,['CVE-2019-10758'],Remote Code Execution Vulnerability in NPM mongo-express,"### Impact1027 1028Remote code execution on the host machine by any authenticated user.1029 1030### Proof Of Concept1031 1032Launching mongo-express on a Mac, pasting the following into the ""create index"" field will pop open the Mac calculator:1033 1034```javascript1035this.constructor.constructor(""return process"")().mainModule.require('child_process').execSync('/Applications/Calculator.app/Contents/MacOS/Calculator')1036```1037 1038### Patches1039Users should upgrade to version `0.54.0`1040 1041### Workarounds1042_Is there a way for users to fix or remediate the vulnerability without upgrading?_1043 1044### References1045[Snyk Security Advisory](https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215)1046[CVE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10758)1047 1048### For more information1049If you have any questions or comments about this advisory:1050* Open an issue in [example link to repo](http://example.com)1051* Email us at [example email address](mailto:example@example.com)1052 1053#### Thanks1054 1055@JLLeitschuh for finding and reporting this vulnerability","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'mongo-express'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.54.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/mongo-express/mongo-express/security/advisories/GHSA-h47j-hc6x-h3qq'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10758'}, {'type': 'WEB', 'url': 'https://github.com/mongo-express/mongo-express/pull/522'}, {'type': 'WEB', 'url': 'https://github.com/mongo-express/mongo-express/commit/7d365141deadbd38fa961cd835ce68eab5731494'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/SNYK-JS-MONGOEXPRESS-473215'}]","{'cwe_ids': ['CWE-78'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2019-12-30T19:29:02Z', 'nvd_published_at': None}"10561.4.0,GHSA-7xxv-wpxj-mx5v,2023-09-05T14:45:56Z,2019-12-02T18:03:09Z,,['CVE-2019-19275'],typed-ast Out-of-bounds Read,"typed_ast 1.3.0 and 1.3.1 has an ast_for_arguments out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'typed-ast'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.4.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.3.1'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-19275'}, {'type': 'WEB', 'url': 'https://github.com/python/cpython/commit/a4d78362397fc3bced6ea80fbc7b5f4827aec55e'}, {'type': 'WEB', 'url': 'https://github.com/python/cpython/commit/dcfcd146f8e6fc5c2fc16a4c192a0c5f5ca8c53c'}, {'type': 'WEB', 'url': 'https://github.com/python/typed_ast/commit/156afcb26c198e162504a57caddfe0acd9ed7dce'}, {'type': 'WEB', 'url': 'https://github.com/python/typed_ast/commit/dc317ac9cff859aa84eeabe03fb5004982545b3b'}, {'type': 'WEB', 'url': 'https://bugs.python.org/issue36495'}, {'type': 'PACKAGE', 'url': 'https://github.com/python/typed_ast'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LG5H4Q6LFVRX7SFXLBEJMNQFI4T5SCEA/'}]","{'cwe_ids': ['CWE-125'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-11-27T02:25:57Z', 'nvd_published_at': None}"10571.4.0,GHSA-4x6v-rwh4-55jw,2023-09-08T19:57:36Z,2019-12-02T18:16:34Z,,['CVE-2019-18954'],Pomelo allows external control of critical state data,"Pomelo v2.2.5 allows external control of critical state data. A malicious user input can corrupt arbitrary methods and attributes in `template/game-server/app/servers/connector/handler/entryHandler.js` because certain internal attributes can be overwritten via a conflicting name. Hence, a malicious attacker can manipulate internal attributes by adding additional attributes to user input.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}]","[{'package': {'ecosystem': 'npm', 'name': 'pomelo'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.2.7'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-18954'}, {'type': 'WEB', 'url': 'https://github.com/NetEase/pomelo/issues/1149'}, {'type': 'WEB', 'url': 'https://github.com/cl0udz/vulnerabilities/tree/master/pomelo-critical-state-manipulation'}]","{'cwe_ids': ['CWE-668'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-02T01:20:21Z', 'nvd_published_at': None}"10581.4.0,GHSA-hh3j-x4mc-g48r,2022-04-19T18:42:25Z,2019-12-26T18:22:36Z,,['CVE-2019-12418'],Insufficiently Protected Credentials in Apache Tomcat,"When Apache Tomcat 9.0.0.M1 to 9.0.28, 8.5.0 to 8.5.47, 7.0.0 and 7.0.97 is configured with the JMX Remote Lifecycle Listener, a local attacker without access to the Tomcat process or configuration files is able to manipulate the RMI registry to perform a man-in-the-middle attack to capture user names and passwords used to access the JMX interface. The attacker can then use these credentials to access the JMX interface and gain complete control over the Tomcat instance.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '7.0.99'}]}], 'database_specific': {'last_known_affected_version_range': '< 7.0.98'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '8.0.0'}, {'fixed': '8.5.49'}]}], 'database_specific': {'last_known_affected_version_range': '< 8.5.48'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.tomcat.embed:tomcat-embed-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.0.0'}, {'fixed': '9.0.29'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-12418'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/43530b91506e2e0c11cfbe691173f5df8c48f51b98262426d7493b67%40%3Cannounce.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r3bbb800a816d0a51eccc5a228c58736960a9fffafa581a225834d97d@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r48c1444845fe15a823e1374674bfc297d5008a5453788099ea14caf0@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r6ccee4e849bc77df0840c7f853f6bd09d426f6741247da2b7429d5d9@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r9136ff5b13e4f1941360b5a309efee2c114a14855578c3a2cbe5d19c@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/raba0fabaf4d56d4325ab2aca8814f0b30a237ab83d8106b115ee279a@%3Cdev.tomcat.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/01/msg00024.html'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/03/msg00029.html'}, {'type': 'WEB', 'url': 'https://seclists.org/bugtraq/2019/Dec/43'}, {'type': 'WEB', 'url': 'https://security.gentoo.org/glsa/202003-43'}, {'type': 'WEB', 'url': 'https://security.netapp.com/advisory/ntap-20200107-0001/'}, {'type': 'WEB', 'url': 'https://support.f5.com/csp/article/K10107360?utm_source=f5support&amp;utm_medium=RSS'}, {'type': 'WEB', 'url': 'https://usn.ubuntu.com/4251-1/'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2019/dsa-4596'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2020/dsa-4680'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2020-01/msg00013.html'}]","{'cwe_ids': ['CWE-522'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-26T18:22:10Z', 'nvd_published_at': '2019-12-23T18:15:00Z'}"10591.4.0,GHSA-35fr-h7jr-hh86,2021-04-27T18:03:07Z,2019-12-06T18:55:47Z,,[],Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') in Armeria,"Versions of Armeria 0.85.0 through and including 0.96.0 are vulnerable to HTTP response splitting, which allows remote attackers to inject arbitrary HTTP headers via CRLF sequences when unsanitized data is used to populate the headers of an HTTP response.1060 1061### Impact1062 10631. Cross-User Defacement10642. Cache Poisoning10653. Cross-Site Scripting (XSS)10664. Page Hijacking1067 1068 1069### Root Cause1070 1071The root cause is due to the usage of Netty without the HTTP header validation.1072 1073https://github.com/line/armeria/blob/f0d870fde1088114070be31b67f7df0a21e835c6/core/src/main/java/com/linecorp/armeria/common/DefaultHttpHeaders.java#L231074 1075### Patches1076 1077This vulnerability has been patched in 0.97.0.1078 1079### References1080 1081[CWE-113: Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')](https://cwe.mitre.org/data/definitions/113.html)1082https://github.com/ratpack/ratpack/security/advisories/GHSA-mvqp-q37c-wf9j1083 1084### For more information1085If you have any questions or comments about this advisory:1086* Open an issue in [GitHub](https://github.com/line/armeria/issues)","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'com.linecorp.armeria:armeria'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.85.0'}, {'fixed': '0.97.0'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/line/armeria/security/advisories/GHSA-35fr-h7jr-hh86'}]","{'cwe_ids': ['CWE-113', 'CWE-74'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2021-04-27T18:03:07Z', 'nvd_published_at': None}"10871.4.0,GHSA-5h9j-q6j2-253f,2021-06-15T17:23:03Z,2019-12-02T18:13:28Z,,['CVE-2019-17632'],Unescaped exception messages in error responses in Jetty,"In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.4.21.v20190926'}, {'fixed': '9.4.24.v20191120'}]}], 'versions': ['9.4.21.v20190926']}, {'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.4.22.v20191022'}, {'fixed': '9.4.24.v20191120'}]}], 'versions': ['9.4.22.v20191022']}, {'package': {'ecosystem': 'Maven', 'name': 'org.eclipse.jetty:jetty-server'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '9.4.23.v20191118'}, {'fixed': '9.4.24.v20191120'}]}], 'versions': ['9.4.23.v20191118']}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-17632'}, {'type': 'WEB', 'url': 'https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuApr2021.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuoct2020.html'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-02T01:09:14Z', 'nvd_published_at': '2019-11-25T22:15:00Z'}"10881.4.0,GHSA-hm6q-r2jc-cpqh,2023-09-06T20:10:25Z,2019-12-16T19:29:33Z,,['CVE-2019-19771'],lodahs is malware,"All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets.1089 1090 1091## Recommendation1092 1093Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.1094 1095The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'lodahs'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.0.1'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-19771'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1417'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/package/lodahs'}]","{'cwe_ids': ['CWE-506'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-15T14:26:04Z', 'nvd_published_at': '2019-12-12T20:15:00Z'}"10961.4.0,GHSA-m3jw-62m7-jjcm,2023-09-05T14:46:42Z,2019-12-02T18:02:02Z,,['CVE-2019-19274'],typed-ast Out-of-bounds Read,"typed_ast 1.3.0 and 1.3.1 has a handle_keywordonly_args out-of-bounds read. An attacker with the ability to cause a Python interpreter to parse Python source (but not necessarily execute it) may be able to crash the interpreter process. This could be a concern, for example, in a web-based service that parses (but does not execute) Python code. (This issue also affected certain Python 3.8.0-alpha prereleases.)","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'typed-ast'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.4.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.3.1'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-19274'}, {'type': 'WEB', 'url': 'https://github.com/python/cpython/commit/a4d78362397fc3bced6ea80fbc7b5f4827aec55e'}, {'type': 'WEB', 'url': 'https://github.com/python/cpython/commit/dcfcd146f8e6fc5c2fc16a4c192a0c5f5ca8c53c'}, {'type': 'WEB', 'url': 'https://github.com/python/typed_ast/commit/156afcb26c198e162504a57caddfe0acd9ed7dce'}, {'type': 'WEB', 'url': 'https://github.com/python/typed_ast/commit/dc317ac9cff859aa84eeabe03fb5004982545b3b'}, {'type': 'WEB', 'url': 'https://bugs.python.org/issue36495'}, {'type': 'PACKAGE', 'url': 'https://github.com/python/typed_ast'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/LG5H4Q6LFVRX7SFXLBEJMNQFI4T5SCEA/'}]","{'cwe_ids': ['CWE-125'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-11-27T02:13:07Z', 'nvd_published_at': None}"10971.4.0,GHSA-744r-vv2g-2x6g,2021-06-15T17:22:36Z,2019-12-02T18:17:36Z,,['CVE-2019-10080'],Apache NiFi information disclosure by XXE,"The XMLFileLookupService in NiFi versions 1.3.0 to 1.9.2 allowed trusted users to inadvertently configure a potentially malicious XML file. The XML file has the ability to make external calls to services (via XXE) and reveal information such as the versions of Java, Jersey, and Apache that the NiFI instance uses.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-security'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.10.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.10.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-10080'}, {'type': 'WEB', 'url': 'https://github.com/apache/nifi/pull/3507'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E'}, {'type': 'WEB', 'url': 'https://nifi.apache.org/security.html#CVE-2019-10080'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuApr2021.html'}]","{'cwe_ids': ['CWE-611'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-02T17:27:21Z', 'nvd_published_at': '2019-11-19T22:15:00Z'}"10981.4.0,GHSA-fmqw-vqh5-cwq9,2021-08-19T16:03:16Z,2019-12-02T18:19:39Z,,['CVE-2019-12421'],Apache NiFi user log out issue,"When using an authentication mechanism other than PKI, when the user clicks Log Out in NiFi versions 1.0.0 to 1.9.2, NiFi invalidates the authentication token on the client side but not on the server side. This permits the user's client-side token to be used for up to 12 hours after logging out to make API requests to NiFi.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-web-security'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.10.0'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.nifi:nifi-web-api'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.3.0'}, {'fixed': '1.10.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-12421'}, {'type': 'WEB', 'url': 'https://github.com/apache/nifi/pull/3362'}, {'type': 'WEB', 'url': 'https://github.com/apache/nifi/commit/cf6f5172503ce438c6c22c334c9367f774db7b24'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E'}, {'type': 'WEB', 'url': 'https://nifi.apache.org/security.html#CVE-2019-12421'}]","{'cwe_ids': ['CWE-613'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2019-12-02T17:32:47Z', 'nvd_published_at': None}"10991.4.0,GHSA-7xx3-m584-x994,2021-01-08T19:12:47Z,2019-12-05T19:26:37Z,,['CVE-2019-16770'],A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack,"## Keepalive thread overload/DoS1100 1101### Impact1102 1103A poorly-behaved client could use keepalive requests to monopolize Puma's reactor and create a denial of service attack.1104 1105If more keepalive connections to Puma are opened than there are threads available, additional connections will wait permanently if the attacker sends requests frequently enough.1106 1107### Patches1108 1109This vulnerability is patched in Puma 4.3.1 and 3.12.2.1110 1111### Workarounds1112 1113Reverse proxies in front of Puma could be configured to always allow less than X keepalive connections to a Puma cluster or process, where X is the number of threads configured in Puma's thread pool.1114 1115### For more information1116 1117If you have any questions or comments about this advisory:1118 1119* Open an issue at [puma](github.com/puma/puma).","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'puma'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.12.2'}]}]}, {'package': {'ecosystem': 'RubyGems', 'name': 'puma'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.3.1'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/puma/puma/security/advisories/GHSA-7xx3-m584-x994'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-16770'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-7xx3-m584-x994'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/puma/CVE-2019-16770.yml'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2022/05/msg00034.html'}]","{'cwe_ids': ['CWE-770'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:23:51Z', 'nvd_published_at': '2019-12-05T20:15:00Z'}"11201.4.0,GHSA-jc43-qrrp-98f5,2023-04-25T16:31:36Z,2019-12-17T22:53:40Z,,['CVE-2019-19714'],Insert tag injection in the Contao login module,"### Impact1121 1122It is possible to inject insert tags into the login module which will be replaced when the page is rendered.1123 1124### Patches1125 1126Update to Contao 4.8.6.1127 1128### Workarounds1129 1130None.1131 1132### References1133 1134https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module1135 1136### For more information1137 1138If you have any questions or comments about this advisory, open an issue in [contao/contao](https://github.com/contao/contao/issues/new/choose).1139","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N'}]","[{'package': {'ecosystem': 'Packagist', 'name': 'contao/core-bundle'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.8.4'}, {'fixed': '4.8.6'}]}]}]","[{'type': 'WEB', 'url': 'https://github.com/contao/contao/security/advisories/GHSA-jc43-qrrp-98f5'}, {'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-19714'}, {'type': 'WEB', 'url': 'https://contao.org/en/security-advisories/insert-tag-injection-in-the-login-module.html'}, {'type': 'WEB', 'url': 'https://github.com/FriendsOfPHP/security-advisories/blob/master/contao/core-bundle/CVE-2019-19714.yaml'}, {'type': 'PACKAGE', 'url': 'https://github.com/contao/contao'}]","{'cwe_ids': ['CWE-116'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2019-12-17T19:35:29Z', 'nvd_published_at': None}"11401.4.0,GHSA-42fp-4hm3-j8r7,2021-08-31T21:37:18Z,2019-01-04T17:46:08Z,,['CVE-2017-5934'],Moderate severity vulnerability that affects moin,Cross-site scripting (XSS) vulnerability in the link dialogue in GUI editor in MoinMoin before 1.9.10 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'moin'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.10'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-5934'}, {'type': 'WEB', 'url': 'https://github.com/moinwiki/moin-1.9/commit/70955a8eae091cc88fd9a6e510177e70289ec024'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-42fp-4hm3-j8r7'}, {'type': 'PACKAGE', 'url': 'https://github.com/moinwiki/moin-1.9'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2018/10/msg00007.html'}, {'type': 'WEB', 'url': 'https://usn.ubuntu.com/3794-1/'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2018/dsa-4318'}, {'type': 'WEB', 'url': 'http://lists.opensuse.org/opensuse-security-announce/2018-10/msg00024.html'}, {'type': 'WEB', 'url': 'http://moinmo.in/SecurityFixes'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:56:59Z', 'nvd_published_at': None}"11411.4.0,GHSA-45r8-3495-x6rm,2022-09-17T00:06:13Z,2019-01-04T17:43:36Z,,['CVE-2018-18893'],Jinjava calls getClass,"Jinjava before 2.4.6 does not block the getClass method, related to com/hubspot/jinjava/el/ext/JinjavaBeanELResolver.java.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'com.hubspot.jinjava:jinjava'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.6'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-18893'}, {'type': 'WEB', 'url': 'https://github.com/HubSpot/jinjava/pull/230'}, {'type': 'PACKAGE', 'url': 'https://github.com/HubSpot/jinjava'}, {'type': 'WEB', 'url': 'https://github.com/HubSpot/jinjava/blob/master/CHANGES.md'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-45r8-3495-x6rm'}]","{'cwe_ids': [], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:57:27Z', 'nvd_published_at': None}"11421.4.0,GHSA-4rm3-4mq4-mfwr,2022-09-14T22:29:42Z,2019-01-04T17:43:22Z,,['CVE-2018-20595'],Cross-Site Request Forgery (CSRF) in hswebframework.web:hsweb-commons,A CSRF issue was discovered in web/authorization/oauth2/controller/OAuth2ClientController.java in hsweb 3.0.4 because the state parameter in the request is not compared with the state parameter in the session after user authentication is successful.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.hswebframework.web:hsweb-commons'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '3.0.4'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-20595'}, {'type': 'WEB', 'url': 'https://github.com/hs-web/hsweb-framework/issues/107'}, {'type': 'WEB', 'url': 'https://github.com/hs-web/hsweb-framework/commit/40929e9b0d336a26281a5ed2e0e721d54dd8d2f2'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-4rm3-4mq4-mfwr'}, {'type': 'PACKAGE', 'url': 'https://github.com/hs-web/hsweb-framework'}]","{'cwe_ids': ['CWE-352'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:59:04Z', 'nvd_published_at': None}"11431.4.0,GHSA-wr5r-m8pc-85j9,2020-06-16T22:01:07Z,2019-01-25T16:18:49Z,,['CVE-2019-3772'],Low severity vulnerability that affects org.springframework.integration:spring-integration-ws and org.springframework.integration:spring-integration-xml,"Spring Integration (spring-integration-xml and spring-integration-ws modules), versions 4.3.18, 5.0.10, 5.1.1, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.",[],"[{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.integration:spring-integration-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.3.19'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.integration:spring-integration-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.0.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.integration:spring-integration-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.0'}, {'fixed': '5.1.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.integration:spring-integration-ws'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.3.19'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.integration:spring-integration-ws'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.0.11'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.integration:spring-integration-ws'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.1.0'}, {'fixed': '5.1.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-3772'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-wr5r-m8pc-85j9'}, {'type': 'WEB', 'url': 'https://pivotal.io/security/cve-2019-3772'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/106749'}]","{'cwe_ids': ['CWE-611'], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T22:01:07Z', 'nvd_published_at': None}"11441.4.0,GHSA-m9mq-p2f9-cfqv,2023-08-08T10:24:53Z,2019-01-04T17:46:30Z,,['CVE-2018-7753'],Bleach URI Scheme Restriction Bypass,"An issue was discovered in Bleach 2.1.x before 2.1.3. Attributes that have URI values weren't properly sanitized if the values contained character entities. Using character entities, it was possible to construct a URI value with a scheme that was not allowed that would slide through unsanitized.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'bleach'}, 'ecosystem_specific': {'affected_functions': ['bleach.sanitizer.BleachSanitizerFilter.allow_token']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.3'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-7753'}, {'type': 'WEB', 'url': 'https://github.com/mozilla/bleach/commit/c5df5789ec3471a31311f42c2d19fc2cf21b35ef'}, {'type': 'WEB', 'url': 'https://bugs.debian.org/892252'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-m9mq-p2f9-cfqv'}, {'type': 'PACKAGE', 'url': 'https://github.com/mozilla/bleach'}, {'type': 'WEB', 'url': 'https://github.com/mozilla/bleach/releases/tag/v2.1.3'}]","{'cwe_ids': ['CWE-20'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:45:43Z', 'nvd_published_at': None}"11451.4.0,GHSA-2x54-j4m3-r6wx,2023-08-07T15:57:08Z,2019-01-04T17:44:48Z,,['CVE-2019-3575'],sqla-yaml-fixtures is vulnerable to Code Injection,Sqla_yaml_fixtures versions up to 0.9.1 allows local users to execute arbitrary python code via the fixture_text argument in `sqla_yaml_fixtures.load`.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'sqla-yaml-fixtures'}, 'ecosystem_specific': {'affected_functions': ['sqla_yaml_fixtures.load']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'last_affected': '0.9.1'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-3575'}, {'type': 'WEB', 'url': 'https://github.com/schettino72/sqla_yaml_fixtures/issues/20'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-2x54-j4m3-r6wx'}, {'type': 'PACKAGE', 'url': 'https://github.com/schettino72/sqla_yaml_fixtures'}]","{'cwe_ids': ['CWE-94'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:53:16Z', 'nvd_published_at': None}"11461.4.0,GHSA-6qvp-r6r3-9p7h,2023-08-26T00:01:34Z,2019-01-17T14:05:03Z,,['CVE-2018-14404'],Nokogiri NULL Pointer Dereference,A NULL pointer dereference vulnerability exists in the `xpath.c:xmlXPathCompOpEval()` function of libxml2 through 2.9.8 when parsing an invalid XPath expression in the `XPATH_OP_AND` or `XPATH_OP_OR` case. Applications processing untrusted XSL format inputs with the use of the libxml2 library may be vulnerable to a denial of service attack due to a crash of the application.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'RubyGems', 'name': 'nokogiri'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.8.5'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-14404'}, {'type': 'WEB', 'url': 'https://github.com/sparklemotion/nokogiri/issues/1785'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1543'}, {'type': 'WEB', 'url': 'https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=901817'}, {'type': 'WEB', 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1595985'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nokogiri/CVE-2018-14404.yml'}, {'type': 'WEB', 'url': 'https://gitlab.gnome.org/GNOME/libxml2/issues/10'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2018/09/msg00035.html'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2020/09/msg00009.html'}, {'type': 'WEB', 'url': 'https://security.netapp.com/advisory/ntap-20190719-0002/'}, {'type': 'WEB', 'url': 'https://usn.ubuntu.com/3739-1/'}, {'type': 'WEB', 'url': 'https://usn.ubuntu.com/3739-2/'}]","{'cwe_ids': ['CWE-476'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:20:04Z', 'nvd_published_at': None}"11471.4.0,GHSA-4p24-vmcr-4gqj,2023-08-25T23:47:33Z,2019-01-17T13:57:27Z,,['CVE-2016-10735'],Bootstrap XSS vulnerability,"In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute. Note that this is a different vulnerability than CVE-2018-14041.1148 1149See https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/ for more info.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'bootstrap'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.4.0'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'bootstrap'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0-beta'}, {'fixed': '4.0.0-beta.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2016-10735'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/issues/20184'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/pull/23679'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/pull/23687'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/pull/26460'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHBA-2019:1076'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHBA-2019:1570'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1456'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3023'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0132'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0133'}, {'type': 'WEB', 'url': 'https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/'}, {'type': 'WEB', 'url': 'https://github.com/rubysec/ruby-advisory-db/blob/master/gems/bootstrap-sass/CVE-2016-10735.yml'}, {'type': 'PACKAGE', 'url': 'https://github.com/twbs/bootstrap'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:58:39Z', 'nvd_published_at': '2019-01-09T05:29:00Z'}"11501.4.0,GHSA-8222-6fc8-mhvf,2021-06-15T16:59:20Z,2019-01-25T16:18:52Z,,['CVE-2019-3773'],Vulnerability that affects org.springframework.ws:spring-ws and org.springframework.ws:spring-xml,"Spring Web Services, versions 2.4.3, 3.0.4, and older unsupported versions of all three projects, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.ws:spring-ws'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.ws:spring-ws'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.0.4'}}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.ws:spring-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.4.4'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.ws:spring-xml'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.0.6'}]}], 'database_specific': {'last_known_affected_version_range': '<= 3.0.4'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-3773'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-8222-6fc8-mhvf'}, {'type': 'WEB', 'url': 'https://pivotal.io/security/cve-2019-3773'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuApr2021.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpujan2021.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpujul2021.html'}]","{'cwe_ids': ['CWE-611'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:23:54Z', 'nvd_published_at': '2019-01-18T22:29:00Z'}"11511.4.0,GHSA-r28v-mw67-m5p9,2023-09-05T12:37:34Z,2019-01-04T17:50:07Z,,['CVE-2018-7536'],Django Denial-of-service possibility in urlize and urlizetrunc template filters,"An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. The `django.utils.html.urlize()` function was extremely slow to evaluate certain inputs due to catastrophic backtracking vulnerabilities in two regular expressions (only one regular expression for Django 1.8.x). The `urlize()` function is used to implement the urlize and urlizetrunc template filters, which were thus vulnerable.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0'}, {'fixed': '2.0.3'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.11'}, {'fixed': '1.11.11'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8'}, {'fixed': '1.8.19'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-7536'}, {'type': 'WEB', 'url': 'https://github.com/django/django/commit/1ca63a66ef3163149ad822701273e8a1844192c2'}, {'type': 'WEB', 'url': 'https://github.com/django/django/commit/abf89d729f210c692a50e0ad3f75fb6bec6fae16'}, {'type': 'WEB', 'url': 'https://github.com/django/django/commit/e157315da3ae7005fa0683ffc9751dbeca7306c8'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2018:2927'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0051'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0082'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0265'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-r28v-mw67-m5p9'}, {'type': 'PACKAGE', 'url': 'https://github.com/django/django'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2018/03/msg00006.html'}, {'type': 'WEB', 'url': 'https://usn.ubuntu.com/3591-1/'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2018/dsa-4161'}, {'type': 'WEB', 'url': 'https://www.djangoproject.com/weblog/2018/mar/06/security-releases/'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/103361'}]","{'cwe_ids': ['CWE-185'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:53:19Z', 'nvd_published_at': '2018-03-09T20:29:00Z'}"11521.4.0,GHSA-mc23-976p-j42x,2022-12-18T23:44:26Z,2019-01-14T16:19:55Z,,['CVE-2019-0542'],xterm vulnerable to remote code execution ,A remote code execution vulnerability exists in Xterm.js when the component mishandles special characters.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'xterm'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.8.1'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'xterm'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.9.0'}, {'fixed': '3.9.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'xterm'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.10.0'}, {'fixed': '3.10.1'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-0542'}, {'type': 'WEB', 'url': 'https://github.com/xtermjs/xterm.js/commit/3592c641cd0348e0b698e8a180aea2072c6bcd9a'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHBA-2019:0959'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1422'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2551'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2552'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-mc23-976p-j42x'}, {'type': 'PACKAGE', 'url': 'https://github.com/xtermjs/xterm.js'}, {'type': 'WEB', 'url': 'https://github.com/xtermjs/xterm.js/releases/tag/3.8.1'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/106434'}]","{'cwe_ids': ['CWE-94'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:45:48Z', 'nvd_published_at': '2019-01-09T15:29:00Z'}"11531.4.0,GHSA-f9hv-mg5h-xcw9,2023-06-12T22:34:10Z,2019-01-04T19:06:57Z,,['CVE-2018-19360'],Deserialization of Untrusted Data in jackson-databind due to polymorphic deserialization,FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.9.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'fixed': '2.8.11.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.8.11.2'}}, {'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.9.5'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.7.9.4'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-19360'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson-databind/issues/2186'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHBA-2019:0959'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0782'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0877'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1782'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1797'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1822'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1823'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2804'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2858'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3002'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3140'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3149'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3892'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:4037'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-f9hv-mg5h-xcw9'}, {'type': 'WEB', 'url': 'https://issues.apache.org/jira/browse/TINKERPOP-2121'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html'}, {'type': 'WEB', 'url': 'https://seclists.org/bugtraq/2019/May/68'}, {'type': 'WEB', 'url': 'https://security.netapp.com/advisory/ntap-20190530-0003/'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2019/dsa-4452'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/107985'}]","{'cwe_ids': ['CWE-502'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:34:16Z', 'nvd_published_at': None}"11541.4.0,GHSA-4q69-q4q7-x82c,2023-09-06T20:01:34Z,2019-01-04T17:41:46Z,,['CVE-2017-18353'],rendertron can remotely shut down Chrome instance,Rendertron 1.0.0 includes an `_ah/stop` route to shutdown the Chrome instance responsible for serving render requests to all users. Visiting this route with a GET request allows any unauthorized remote attacker to disable the core service of the application.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'npm', 'name': 'rendertron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-18353'}, {'type': 'WEB', 'url': 'https://github.com/GoogleChrome/rendertron/pull/88'}, {'type': 'WEB', 'url': 'https://github.com/GoogleChrome/rendertron/commit/8d70628c96ae72eff6eebb451d26fc9ed6b58b0e'}, {'type': 'WEB', 'url': 'https://bugs.chromium.org/p/chromium/issues/detail?id=759111'}, {'type': 'PACKAGE', 'url': 'https://github.com/GoogleChrome/rendertron'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-4q69-q4q7-x82c'}]","{'cwe_ids': ['CWE-284'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:58:46Z', 'nvd_published_at': None}"11551.4.0,GHSA-77rc-x84q-pv4f,2022-09-14T22:41:33Z,2019-01-25T16:19:19Z,,['CVE-2018-20245'],Improper Certificate Validation in Apache Airflow,The LDAP auth backend (airflow.contrib.auth.backends.ldap_auth) prior to Apache Airflow 1.10.1 was misconfigured and contained improper checking of exceptions which disabled server certificate checking.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.10.1'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-20245'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-77rc-x84q-pv4f'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/b549c7573b342a6e457e5a3225c33054244343927bbfb2a4cdc4cf73@%3Cdev.airflow.apache.org%3E'}]","{'cwe_ids': ['CWE-295'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:21:58Z', 'nvd_published_at': None}"11561.4.0,GHSA-3wc8-659g-r88q,2020-06-16T20:56:44Z,2019-01-25T16:18:56Z,,['CVE-2019-3774'],Low severity vulnerability that affects org.springframework.batch:spring-batch-core,"Spring Batch versions 3.0.9, 4.0.1, 4.1.0, and older unsupported versions, were susceptible to XML External Entity Injection (XXE) when receiving XML data from untrusted sources.",[],"[{'package': {'ecosystem': 'Maven', 'name': 'org.springframework.batch:spring-batch-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.10'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.batch:spring-batch-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.2'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.springframework.batch:spring-batch-core'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.1'}]}], 'versions': ['4.1.0']}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2019-3774'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-3wc8-659g-r88q'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r01292194daa9ed3117b34dabec0c26929f6db13b9613fc144f720d52@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r0153a08177fcfac7584c7b9ea3027f1e8f18f770126f905b9989190e@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r08e7ddc354bdcbf95d88399f18b3d804865034f8bc706095e594b29f@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r2349237482bcec43632d9d78d7d2804520d9a82f4d8b1fd96bb616b8@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r47c7f67a3067ec09262eef0705abc42ea1b646699d9198bcaf8dad02@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r5fbb63e405d2211c16524d33f52e3b122109d3bc88d5f74623fb212d@%3Ccommits.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r78645ca0eef44a276e144447fb2087db758b1fb8826d0330b3f0da1a@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r79991aeb5d0c53c67e400e037c72758a06607752ca2f23b5302dd61f@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r96d90e59bb12af5e5c631dcf7d7d80857a52bf3dc44d5b85553e7fc4@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/ra329bb85da9da93ac6f9b5fc0fc5446a3af0ee2a62c5de484da0af54@%3Ccommits.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/ra62a3bf48ab4e0e9aaed970b03d79a73224d68a4275858c707542f6c@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/ra8c7573911082e9968f4835943045ad0952232bb6314becf23dc3de5@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/raae74a9290784e20e86fcd4e2525fa8700aeed6f65f3613b5b04bb11@%3Ccommits.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rb9fe3ae33246d7f11604a1c85c861cb013a1e32248a43a0c22457107@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rcd26a5409af7356b5f69b2fafae3cf621bff8bf155f50e9ccf9ed5f6@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rcd4945d66d8bb2fc92396af56a70ede4af983a2c98166f1281338346@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/ree71c6425d2cc0e36b77bda6902965a657c1e09c7229459811d66474@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rf83697efcbcfe1131e31bbc7025cb3ee1db5d9185e9481093b2ef961@%3Cissues.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rfea6eebfebb13bc015f258e7fa31d4e24a4202601be3b307da28d530@%3Ccommits.servicemix.apache.org%3E'}, {'type': 'WEB', 'url': 'https://pivotal.io/security/cve-2019-3774'}]","{'cwe_ids': ['CWE-611'], 'severity': 'LOW', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:56:44Z', 'nvd_published_at': None}"11571.4.0,GHSA-9gqg-3fxr-9hv7,2023-08-30T23:28:15Z,2019-01-25T16:19:09Z,,['CVE-2017-17836'],Apache Airflow vulnerable to XSS,"In Apache Airflow 1.8.2 and earlier, an experimental Airflow feature displayed authenticated cookies, as well as passwords to databases used by Airflow. An attacker who has limited access to airflow, weather it be via XSS or by leaving a machine unlocked can exfil all credentials from the system.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.8.2'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-17836'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-9gqg-3fxr-9hv7'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57@%3Cdev.airflow.apache.org%3E'}]","{'cwe_ids': ['CWE-79'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:28:37Z', 'nvd_published_at': None}"11581.4.0,GHSA-38rv-5jqc-m2cv,2023-09-01T20:25:56Z,2019-01-04T17:48:09Z,,['CVE-2017-0906'],Recurly vulnerable to SSRF,"The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource.get` method that could result in compromise of API keys or other critical resources.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'recurly'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.6.0'}, {'fixed': '2.6.2'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'recurly'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.5.0'}, {'fixed': '2.5.1'}]}], 'versions': ['2.5.0']}, {'package': {'ecosystem': 'PyPI', 'name': 'recurly'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.4.0'}, {'fixed': '2.4.5'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'recurly'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.3.0'}, {'fixed': '2.3.1'}]}], 'versions': ['2.3.0']}, {'package': {'ecosystem': 'PyPI', 'name': 'recurly'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.2.0'}, {'fixed': '2.2.22'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'recurly'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.1.0'}, {'fixed': '2.1.16'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'recurly'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.0.5'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-0906'}, {'type': 'WEB', 'url': 'https://github.com/recurly/recurly-client-python/commit/049c74699ce93cf126feff06d632ea63fba36742'}, {'type': 'WEB', 'url': 'https://hackerone.com/reports/288635'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-38rv-5jqc-m2cv'}]","{'cwe_ids': ['CWE-918'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:54:38Z', 'nvd_published_at': None}"11591.4.0,GHSA-3mgp-fx93-9xv5,2023-01-23T20:33:58Z,2019-01-17T13:57:34Z,,['CVE-2018-20676'],XSS vulnerability that affects bootstrap,"In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'bootstrap'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.4.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-20676'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/issues/27044'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/pull/27047'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHBA-2019:1076'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHBA-2019:1570'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1456'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3023'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0132'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0133'}, {'type': 'WEB', 'url': 'https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/'}, {'type': 'PACKAGE', 'url': 'https://github.com/twbs/bootstrap'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:55:33Z', 'nvd_published_at': '2019-01-09T05:29:00Z'}"11601.4.0,GHSA-7qqv-r2q4-jxhm,2021-09-03T21:43:07Z,2019-01-14T16:19:31Z,,['CVE-2018-1000809'],High severity vulnerability that affects privacyIDEA,privacyIDEA version 2.23.1 and earlier contains a Improper Input Validation vulnerability in token validation api that can result in Denial-of-Service. This attack appear to be exploitable via http request with user=<space>&pass= to /validate/check url. This vulnerability appears to have been fixed in 2.23.2.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'privacyIDEA'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '2.23.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-1000809'}, {'type': 'WEB', 'url': 'https://github.com/privacyidea/privacyidea/issues/1227'}, {'type': 'WEB', 'url': 'https://github.com/privacyidea/privacyidea/commit/a3edc09beffa2104f357fe24971ea3211ce40751'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-7qqv-r2q4-jxhm'}, {'type': 'PACKAGE', 'url': 'https://github.com/privacyidea/privacyidea'}]","{'cwe_ids': ['CWE-20'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:23:21Z', 'nvd_published_at': None}"11611.4.0,GHSA-68wv-rjrm-576p,2022-09-14T22:40:56Z,2019-01-25T16:19:14Z,,['CVE-2017-17835'],Cross-Site Request Forgery (CSRF) in Apache Airflow,"In Apache Airflow 1.8.2 and earlier, a CSRF vulnerability allowed for a remote command injection on a default install of Airflow.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'apache-airflow'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.9.0'}]}], 'database_specific': {'last_known_affected_version_range': '<= 1.8.2'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-17835'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-68wv-rjrm-576p'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/ade4d54ebf614f68dc81a08891755e60ea58ba88e0209233eeea5f57@%3Cdev.airflow.apache.org%3E'}]","{'cwe_ids': ['CWE-352'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:18:39Z', 'nvd_published_at': None}"11621.4.0,GHSA-ph58-4vrj-w6hr,2023-01-23T21:29:22Z,2019-01-17T13:57:56Z,,['CVE-2018-20677'],bootstrap Cross-site Scripting vulnerability,"In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'bootstrap'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.4.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-20677'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/issues/27045'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/issues/27915#issuecomment-452140906'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/issues/27915#issuecomment-452196628'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/pull/27047'}, {'type': 'WEB', 'url': 'https://github.com/twbs/bootstrap/commit/2a5ba23ce8f041f3548317acc992ed8a736b609d'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHBA-2019:1076'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHBA-2019:1570'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1456'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3023'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0132'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2020:0133'}, {'type': 'WEB', 'url': 'https://blog.getbootstrap.com/2018/12/13/bootstrap-3-4-0/'}, {'type': 'PACKAGE', 'url': 'https://github.com/twbs/bootstrap'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e@%3Cdev.superset.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:49:11Z', 'nvd_published_at': '2019-01-09T05:29:00Z'}"11631.4.0,GHSA-mx9v-gmh4-mgqw,2022-09-14T22:31:36Z,2019-01-04T19:07:01Z,,['CVE-2018-19361'],Deserialization of Untrusted Data in jackson-databind,FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.9.5'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.7.9.4'}}, {'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.9.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'fixed': '2.8.11.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.8.11.2'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-19361'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson-databind/issues/2186'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHBA-2019:0959'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0782'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0877'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1782'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1797'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1822'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1823'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2804'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2858'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3002'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3140'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3149'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3892'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:4037'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-mx9v-gmh4-mgqw'}, {'type': 'WEB', 'url': 'https://issues.apache.org/jira/browse/TINKERPOP-2121'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html'}, {'type': 'WEB', 'url': 'https://seclists.org/bugtraq/2019/May/68'}, {'type': 'WEB', 'url': 'https://security.netapp.com/advisory/ntap-20190530-0003/'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2019/dsa-4452'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/107985'}]","{'cwe_ids': ['CWE-502'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:47:38Z', 'nvd_published_at': None}"11641.4.0,GHSA-j87c-cj65-vmh5,2023-09-06T20:06:31Z,2019-01-04T17:41:51Z,,['CVE-2017-18354'],rendertron LFI vulnerability,Rendertron 1.0.0 allows for alternative protocols such as 'file://' introducing a Local File Inclusion (LFI) bug where arbitrary files can be read by a remote attacker.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'rendertron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-18354'}, {'type': 'WEB', 'url': 'https://github.com/GoogleChrome/rendertron/pull/88'}, {'type': 'WEB', 'url': 'https://github.com/GoogleChrome/rendertron/commit/8d70628c96ae72eff6eebb451d26fc9ed6b58b0e'}, {'type': 'WEB', 'url': 'https://bugs.chromium.org/p/chromium/issues/detail?id=759111'}, {'type': 'PACKAGE', 'url': 'https://github.com/GoogleChrome/rendertron'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-j87c-cj65-vmh5'}]","{'cwe_ids': ['CWE-22'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:42:38Z', 'nvd_published_at': None}"11651.4.0,GHSA-xvwv-6wvx-px9x,2023-09-01T21:13:18Z,2019-01-04T17:47:21Z,,['CVE-2017-1000484'],Plone Open Redirect,"By linking to a specific url in Plone 2.5-5.1rc1 with a parameter, an attacker could send you to his own website. On its own this is not so bad: the attacker could more easily link directly to his own website instead. But in combination with another attack, you could be sent to the Plone login form and login, then get redirected to the specific url, and then get a second redirect to the attacker website. ","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'plone'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.3.16'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'plone'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.1.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-1000484'}, {'type': 'WEB', 'url': 'https://github.com/plone/Products.CMFPlone/issues/2232'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-xvwv-6wvx-px9x'}, {'type': 'PACKAGE', 'url': 'https://github.com/plone/Plone'}, {'type': 'WEB', 'url': 'https://plone.org/security/hotfix/20171128/an-open-redirection-when-calling-a-specific-url'}]","{'cwe_ids': ['CWE-601'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T22:04:39Z', 'nvd_published_at': None}"11661.4.0,GHSA-mvjj-gqq2-p4hw,2023-09-13T19:45:25Z,2019-01-04T19:05:35Z,,['CVE-2018-6341'],Cross-Site Scripting in react-dom,"Affected versions of `react-dom` are vulnerable to Cross-Site Scripting (XSS). The package fails to validate attribute names in HTML tags which may lead to Cross-Site Scripting in specific scenarios. This may allow attackers to execute arbitrary JavaScript in the victim's browser. To be affected by this vulnerability, the application needs to:1167- be a server-side React app1168- be rendered to HTML using `ReactDOMServer`1169- include an attribute name from user input in an HTML tag1170 1171 1172## Recommendation1173 1174If you are using `react-dom` 16.0.x, upgrade to 16.0.1 or later.  1175If you are using `react-dom` 16.1.x, upgrade to 16.1.2 or later.  1176If you are using `react-dom` 16.2.x, upgrade to 16.2.1 or later.  1177If you are using `react-dom` 16.3.x, upgrade to 16.3.3 or later.  1178If you are using `react-dom` 16.4.x, upgrade to 16.4.2 or later.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'react-dom'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '16.0.0'}, {'fixed': '16.0.1'}]}], 'versions': ['16.0.0']}, {'package': {'ecosystem': 'npm', 'name': 'react-dom'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '16.1.0'}, {'fixed': '16.1.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'react-dom'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '16.2.0'}, {'fixed': '16.2.1'}]}], 'versions': ['16.2.0']}, {'package': {'ecosystem': 'npm', 'name': 'react-dom'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '16.3.0'}, {'fixed': '16.3.3'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'react-dom'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '16.4.0'}, {'fixed': '16.4.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-6341'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-mvjj-gqq2-p4hw'}, {'type': 'WEB', 'url': 'https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html'}, {'type': 'WEB', 'url': 'https://snyk.io/vuln/npm:react-dom:20180802'}, {'type': 'WEB', 'url': 'https://twitter.com/reactjs/status/1024745321987887104'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/1421'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:47:15Z', 'nvd_published_at': None}"11791.4.0,GHSA-chj8-5xgw-wcvj,2021-09-09T18:04:45Z,2019-01-07T19:14:46Z,,['CVE-2016-8750'],Moderate severity vulnerability that affects org.apache.karaf:apache-karaf,"Apache Karaf prior to 4.0.8 used the LDAPLoginModule to authenticate users to a directory via LDAP. However, it did not encoding usernames properly and hence was vulnerable to LDAP injection attacks leading to a denial of service.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.karaf:apache-karaf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '4.0.8'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2016-8750'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2018:1322'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-chj8-5xgw-wcvj'}, {'type': 'WEB', 'url': 'https://karaf.apache.org/security/cve-2016-8750.txt'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/103098'}]","{'cwe_ids': ['CWE-90'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:31:46Z', 'nvd_published_at': None}"11801.4.0,GHSA-98gj-wwxm-cj3h,2023-08-07T16:27:52Z,2019-01-04T17:47:50Z,,['CVE-2017-16876'],mistune Cross-site scripting (XSS) vulnerability,"Cross-site scripting (XSS) vulnerability in the _keyify function in mistune.py in Mistune before 0.8.1 allows remote attackers to inject arbitrary web script or HTML by leveraging failure to escape the ""key"" argument.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'mistune'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '0.8.1'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-16876'}, {'type': 'WEB', 'url': 'https://github.com/lepture/mistune/commit/5f06d724bc05580e7f203db2d4a4905fc1127f98'}, {'type': 'WEB', 'url': 'https://bugzilla.redhat.com/show_bug.cgi?id=1524596'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-98gj-wwxm-cj3h'}, {'type': 'PACKAGE', 'url': 'https://github.com/lepture/mistune'}, {'type': 'WEB', 'url': 'https://github.com/lepture/mistune/blob/master/CHANGES.rst'}, {'type': 'WEB', 'url': 'https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/NUR3GMHQBMA3UC4PFMCK6GCLOQC4LQQC/'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:27:52Z', 'nvd_published_at': None}"11811.4.0,GHSA-vx85-mj8c-4qm6,2023-09-11T18:30:27Z,2019-01-17T13:56:33Z,,['CVE-2018-11798'],Apache Thrift Node.js static web server sandbox escape,The Apache Thrift Node.js static web server in versions 0.9.2 through 0.11.0 have been determined to contain a security vulnerability in which a remote user has the ability to access files outside the set webservers docroot path.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.thrift:libthrift'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0.9.2'}, {'fixed': '0.12.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-11798'}, {'type': 'WEB', 'url': 'https://github.com/apache/thrift/pull/1606'}, {'type': 'WEB', 'url': 'https://github.com/apache/thrift/commit/2a2b72f6c8aef200ecee4984f011e06052288ff2'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1545'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3140'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-vx85-mj8c-4qm6'}, {'type': 'WEB', 'url': 'https://issues.apache.org/jira/browse/THRIFT-4647'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/6e9edd282684896cedf615fb67a02bebfe6007f2d5baf03ba52e34fd@%3Cuser.thrift.apache.org%3E'}, {'type': 'WEB', 'url': 'https://web.archive.org/web/20200227094236/http://www.securityfocus.com/bid/106501'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html'}]","{'cwe_ids': ['CWE-538'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:58:46Z', 'nvd_published_at': None}"11821.4.0,GHSA-37hp-765x-j95x,2023-09-05T14:07:04Z,2019-01-04T17:50:26Z,,['CVE-2017-7233'],Django Open redirect and possible XSS attack via user-supplied numeric redirect URLs,"Django 1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18 relies on user input in some cases to redirect the user to an ""on success"" URL. The security check for these redirects (namely ``django.utils.http.is_safe_url()``) considered some numeric URLs ""safe"" when they shouldn't be, aka an open redirect vulnerability. Also, if a developer relies on ``is_safe_url()`` to provide safe redirect targets and puts such a URL into a link, they could suffer from an XSS attack.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.10'}, {'fixed': '1.10.7'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.9'}, {'fixed': '1.9.13'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8'}, {'fixed': '1.8.18'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-7233'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2017:1445'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2017:1451'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2017:1462'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2017:1470'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2017:1596'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2017:3093'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2018:2927'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-37hp-765x-j95x'}, {'type': 'PACKAGE', 'url': 'https://github.com/django/django'}, {'type': 'WEB', 'url': 'https://www.djangoproject.com/weblog/2017/apr/04/security-releases/'}, {'type': 'WEB', 'url': 'http://www.debian.org/security/2017/dsa-3835'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/97406'}, {'type': 'WEB', 'url': 'http://www.securitytracker.com/id/1038177'}]","{'cwe_ids': ['CWE-601'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:54:21Z', 'nvd_published_at': None}"11831.4.0,GHSA-c8hm-7hpq-7jhg,2021-06-10T23:51:07Z,2019-01-04T19:07:03Z,,['CVE-2018-19362'],High severity vulnerability that affects com.fasterxml.jackson.core:jackson-databind,FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.9.8'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'fixed': '2.8.11.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.8.11.2'}}, {'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.7.0'}, {'fixed': '2.7.9.5'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.7.9.4'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-19362'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson-databind/issues/2186'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson-databind/commit/42912cac4753f3f718ece875e4d486f8264c2f2b'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHBA-2019:0959'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0782'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0877'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1782'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1797'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1822'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1823'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2804'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2858'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3002'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3140'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3149'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3892'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:4037'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.8'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-c8hm-7hpq-7jhg'}, {'type': 'WEB', 'url': 'https://issues.apache.org/jira/browse/TINKERPOP-2121'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/37e1ed724a1b0e5d191d98c822c426670bdfde83804567131847d2a3@%3Cdevnull.infra.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3@%3Ccommits.nifi.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/c70da3cb6e3f03e0ad8013e38b6959419d866c4a7c80fdd34b73f25c@%3Ccommits.pulsar.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b@%3Ccommits.nifi.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html'}, {'type': 'WEB', 'url': 'https://seclists.org/bugtraq/2019/May/68'}, {'type': 'WEB', 'url': 'https://security.netapp.com/advisory/ntap-20190530-0003/'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2019/dsa-4452'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpujan2020.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/107985'}]","{'cwe_ids': ['CWE-502'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:30:35Z', 'nvd_published_at': None}"11841.4.0,GHSA-4gq5-ch57-c2mg,2023-09-13T18:31:09Z,2019-01-04T19:09:49Z,,['CVE-2018-14719'],Arbitrary Code Execution in jackson-databind,"FasterXML jackson-databind 2.x before 2.9.7, 2.8.11.3, and 2.7.9.5 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.9.0'}, {'fixed': '2.9.7'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.8.0'}, {'fixed': '2.8.11.3'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.8.11.2'}}, {'package': {'ecosystem': 'Maven', 'name': 'com.fasterxml.jackson.core:jackson-databind'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.7.9.5'}]}], 'database_specific': {'last_known_affected_version_range': '<= 2.7.9.4'}}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-14719'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson-databind/issues/2097'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson-databind/commit/87d29af25e82a249ea15858e2d4ecbf64091db44'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHBA-2019:0959'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0782'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0877'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1782'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1797'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1822'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:1823'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2804'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:2858'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3002'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3140'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3149'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:3892'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:4037'}, {'type': 'PACKAGE', 'url': 'https://github.com/FasterXML/jackson-databind'}, {'type': 'WEB', 'url': 'https://github.com/FasterXML/jackson/wiki/Jackson-Release-2.9.7'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f@%3Cdev.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442@%3Cdev.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc@%3Cissues.drill.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8@%3Ccommits.pulsar.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/rf1bbc0ea4a9f014cf94df9a12a6477d24a27f52741dbc87f2fd52ff2@%3Cissues.geode.apache.org%3E'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2019/03/msg00005.html'}, {'type': 'WEB', 'url': 'https://seclists.org/bugtraq/2019/May/68'}, {'type': 'WEB', 'url': 'https://security.netapp.com/advisory/ntap-20190530-0003/'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2019/dsa-4452'}, {'type': 'WEB', 'url': 'https://www.oracle.com/security-alerts/cpuapr2020.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuapr2019-5072813.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujan2019-5072801.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpujul2019-5072835.html'}, {'type': 'WEB', 'url': 'https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html'}]","{'cwe_ids': ['CWE-502'], 'severity': 'CRITICAL', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:58:21Z', 'nvd_published_at': '2019-01-02T18:29:00Z'}"11851.4.0,GHSA-cq9c-55r7-455x,2022-09-14T22:34:31Z,2019-01-07T19:14:51Z,,['CVE-2018-11787'],Improper Authentication in Apache Karaf,"In Apache Karaf version prior to 3.0.9, 4.0.9, 4.1.1, when the webconsole feature is installed in Karaf, it is available at .../system/console and requires authentication to access it. One part of the console is a Gogo shell/console that gives access to the command line console of Karaf via a Web browser, and when navigated to it is available at .../system/console/gogo. Trying to go directly to that URL does require authentication. And optional bundle that some applications use is the Pax Web Extender Whiteboard, it is part of the pax-war feature and perhaps others. When it is installed, the Gogo console becomes available at another URL .../gogo/, and that URL is not secured giving access to the Karaf console to unauthenticated users. A mitigation for the issue is to manually stop/uninstall Gogo plugin bundle that is installed with the webconsole feature, although of course this removes the console from the .../system/console application, not only from the unauthenticated endpoint. One could also stop/uninstall the Pax Web Extender Whiteboard, but other components/applications may require it and so their functionality would be reduced/compromised.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H'}]","[{'package': {'ecosystem': 'Maven', 'name': 'org.apache.karaf:apache-karaf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '3.0.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.karaf:apache-karaf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.0.9'}]}]}, {'package': {'ecosystem': 'Maven', 'name': 'org.apache.karaf:apache-karaf'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.1.0'}, {'fixed': '4.1.1'}]}], 'versions': ['4.1.0']}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-11787'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-cq9c-55r7-455x'}, {'type': 'WEB', 'url': 'https://issues.apache.org/jira/browse/KARAF-4993'}, {'type': 'WEB', 'url': 'https://lists.apache.org/thread.html/d9ba4c3104ba32225646879a057b75b54430f349c246c85469037d3c@%3Cdev.karaf.apache.org%3E'}, {'type': 'WEB', 'url': 'http://karaf.apache.org/security/cve-2018-11787.txt'}]","{'cwe_ids': ['CWE-287'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:32:22Z', 'nvd_published_at': None}"11861.4.0,GHSA-29gp-92wp-94q8,2022-08-03T19:36:45Z,2019-01-04T17:41:20Z,,['CVE-2018-6342'],react-dev-utils on Windows vulnerable to Remote Code Execution,"`react-dev-utils` on Windows is vulnerable to remote code execution.1187 1188 1189## Recommendation1190 1191Update to one of the following versions, depending on the release line that you are using.1192- 1.0.41193- 2.0.21194- 3.1.21195- 4.2.21196- 5.0.21197- 6.0.0-next.a671462c",[],"[{'package': {'ecosystem': 'npm', 'name': 'react-dev-utils'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.0.0'}, {'fixed': '1.0.4'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'react-dev-utils'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0.0'}, {'fixed': '2.0.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'react-dev-utils'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '3.0.0'}, {'fixed': '3.1.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'react-dev-utils'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '4.0.0'}, {'fixed': '4.2.2'}]}]}, {'package': {'ecosystem': 'npm', 'name': 'react-dev-utils'}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '5.0.0'}, {'fixed': '5.0.2'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-6342'}, {'type': 'WEB', 'url': 'https://github.com/facebook/create-react-app/pull/4866'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-29gp-92wp-94q8'}, {'type': 'PACKAGE', 'url': 'https://github.com/facebook/create-react-app'}, {'type': 'WEB', 'url': 'https://github.com/facebook/create-react-app/releases/tag/v1.1.5'}, {'type': 'WEB', 'url': 'https://www.npmjs.com/advisories/695'}]","{'cwe_ids': ['CWE-78'], 'severity': 'HIGH', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:51:46Z', 'nvd_published_at': '2018-12-31T22:29:00Z'}"11981.4.0,GHSA-2f9x-5v75-3qv4,2023-09-05T14:06:09Z,2019-01-04T17:50:00Z,,['CVE-2018-7537'],Django Denial-of-service possibility in truncatechars_html and truncatewords_html template filters,"An issue was discovered in Django 2.0 before 2.0.3, 1.11 before 1.11.11, and 1.8 before 1.8.19. If django.utils.text.Truncator's chars() and words() methods were passed the html=True argument, they were extremely slow to evaluate certain inputs due to a catastrophic backtracking vulnerability in a regular expression. The chars() and words() methods are used to implement the truncatechars_html and truncatewords_html template filters, which were thus vulnerable.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '2.0'}, {'fixed': '2.0.3'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.11'}, {'fixed': '1.11.11'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8'}, {'fixed': '1.8.19'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2018-7537'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2018:2927'}, {'type': 'WEB', 'url': 'https://access.redhat.com/errata/RHSA-2019:0265'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-2f9x-5v75-3qv4'}, {'type': 'PACKAGE', 'url': 'https://github.com/django/django'}, {'type': 'WEB', 'url': 'https://lists.debian.org/debian-lts-announce/2018/03/msg00006.html'}, {'type': 'WEB', 'url': 'https://usn.ubuntu.com/3591-1/'}, {'type': 'WEB', 'url': 'https://www.debian.org/security/2018/dsa-4161'}, {'type': 'WEB', 'url': 'https://www.djangoproject.com/weblog/2018/mar/06/security-releases/'}, {'type': 'WEB', 'url': 'http://www.securityfocus.com/bid/103357'}]","{'cwe_ids': ['CWE-185'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T20:51:51Z', 'nvd_published_at': None}"11991.4.0,GHSA-h4hv-m4h4-mhwg,2023-09-05T18:19:49Z,2019-01-04T17:50:17Z,,['CVE-2017-7234'],Django open redirect,"A maliciously crafted URL to a Django (1.10 before 1.10.7, 1.9 before 1.9.13, and 1.8 before 1.8.18) site using the `django.views.static.serve()` view could redirect to any other domain, aka an open redirect vulnerability.","[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.10'}, {'fixed': '1.10.7'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.9'}, {'fixed': '1.9.13'}]}]}, {'package': {'ecosystem': 'PyPI', 'name': 'django'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '1.8'}, {'fixed': '1.8.18'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-7234'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-h4hv-m4h4-mhwg'}, {'type': 'PACKAGE', 'url': 'https://github.com/django/django'}, {'type': 'WEB', 'url': 'https://web.archive.org/web/20170429023907/http://www.securitytracker.com/id/1038177'}, {'type': 'WEB', 'url': 'https://web.archive.org/web/20170526042328/http://www.securityfocus.com/bid/97401'}, {'type': 'WEB', 'url': 'https://www.djangoproject.com/weblog/2017/apr/04/security-releases/'}, {'type': 'WEB', 'url': 'http://www.debian.org/security/2017/dsa-3835'}]","{'cwe_ids': ['CWE-601'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:38:44Z', 'nvd_published_at': None}"12001.4.0,GHSA-j88m-953w-8r2c,2023-09-06T20:07:11Z,2019-01-07T19:14:21Z,,['CVE-2017-18352'],rendertron XSS vulnerability,Error reporting within Rendertron 1.0.0 allows reflected Cross Site Scripting (XSS) from invalid URLs.,"[{'type': 'CVSS_V3', 'score': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}]","[{'package': {'ecosystem': 'npm', 'name': 'rendertron'}, 'ecosystem_specific': {'affected_functions': ['']}, 'ranges': [{'type': 'ECOSYSTEM', 'events': [{'introduced': '0'}, {'fixed': '1.1.0'}]}]}]","[{'type': 'ADVISORY', 'url': 'https://nvd.nist.gov/vuln/detail/CVE-2017-18352'}, {'type': 'WEB', 'url': 'https://github.com/GoogleChrome/rendertron/pull/88'}, {'type': 'WEB', 'url': 'https://github.com/GoogleChrome/rendertron/commit/8d70628c96ae72eff6eebb451d26fc9ed6b58b0e'}, {'type': 'WEB', 'url': 'https://bugs.chromium.org/p/chromium/issues/detail?id=759111'}, {'type': 'PACKAGE', 'url': 'https://github.com/GoogleChrome/rendertron'}, {'type': 'ADVISORY', 'url': 'https://github.com/advisories/GHSA-j88m-953w-8r2c'}]","{'cwe_ids': ['CWE-79'], 'severity': 'MODERATE', 'github_reviewed': True, 'github_reviewed_at': '2020-06-16T21:42:41Z', 'nvd_published_at': None}"

Showing the first 1,200 of 4998 lines. Download the file for the rest.