Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-03 05:20:15 +00:00
parent 6f7eb87f19
commit 5f0a7516d5
939 changed files with 1098 additions and 3294 deletions
@@ -8,9 +8,7 @@
  ],
  "summary": "actionpack Cross-site Scripting vulnerability",
  "details": "Cross-site scripting (XSS) vulnerability in the simple_format helper in `actionpack/lib/action_view/helpers/text_helper.rb` in Ruby on Rails 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted HTML attribute.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "DataTable Vulnerable to Cross-Site Scripting",
  "details": "Cross-site scripting (XSS) vulnerability in the DataTables plugin 1.10.8 and earlier for jQuery allows remote attackers to inject arbitrary web script or HTML via the scripts parameter to media/unit_testing/templates/6776.php.\n\n\n## Recommendation\n\nUpdate to a version greater than 1.10.8. A [fix](https://github.com/DataTables/DataTablesSrc/commit/ccf86dc5982bd8e16d) appears in [version 1.10.10](https://github.com/DataTables/DataTablesSrc/commits/1.10.10?after=9780a3693572757d87bf70e48bd7555faf974f28+34&branch=1.10.10&qualified_name=refs%2Ftags%2F1.10.10).",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-28f8-hqmc-7ph8",
  "modified": "2023-07-27T00:06:44Z",
  "published": "2020-09-11T21:19:09Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in ember-power-timepicker",
  "details": "Version 1.0.8 of `ember-power-timepicker` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.0.7",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -29,9 +25,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:40:57Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-3fv6-q5xv-fhpw",
  "modified": "2023-07-27T00:01:55Z",
  "published": "2020-09-01T19:50:23Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in coffee-project",
  "details": "Version 1.7.5 of `coffee-project` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 1.7.5 of this module is found installed you will want to replace it with a version before or after 1.7.5. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.7.4",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -29,9 +25,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:30:12Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-3wh2-2pp3-2823",
  "modified": "2023-07-27T00:02:26Z",
  "published": "2020-09-01T20:35:18Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in simple-alipay",
  "details": "Version 1.0.1 of `simple-alipay` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 1.0.1 of this module is found installed you will want to replace it with a version before or after 1.0.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.0.0",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -29,9 +25,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:30:49Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-53jx-4wwh-gcqj",
  "modified": "2023-07-27T00:09:48Z",
  "published": "2020-09-11T21:11:34Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in angular-location-update",
  "details": "Version 0.0.3 of `angular-location-update` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 0.0.2",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -29,9 +25,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:40:55Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-9p49-cwh3-4qhf",
  "modified": "2023-07-27T00:05:10Z",
  "published": "2020-09-11T21:21:19Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in grunt-radic",
  "details": "Version 0.1.1 of `grunt-radic` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 0.1.0",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -29,9 +25,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:41:04Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-j4ch-mw66-xmqv",
  "modified": "2023-07-27T00:07:25Z",
  "published": "2020-09-03T19:16:44Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in pensi-scheduler",
  "details": "Version 1.1.3 of `pensi-scheduler` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.1.2",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -29,9 +25,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:47:31Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-p32g-242c-76h3",
  "modified": "2023-07-27T00:09:19Z",
  "published": "2020-09-11T21:14:49Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in geoheat",
  "details": "Version 1.3.2 of `geoheat` contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment and evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 1.3.1",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -29,9 +25,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:40:59Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-pv55-r6j3-wp94",
  "modified": "2023-07-27T00:04:06Z",
  "published": "2020-09-01T20:45:57Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in eslint-config-eslint",
  "details": "Version 5.0.2 of `eslint-config-eslint` was published without authorization and was found to contain malicious code. This code would read the users `.npmrc` file and send any found authentication tokens to a remote server.\n\n\n## Recommendation\n\nThe best course of action if you found this package installed in your environment is to revoke all your npm tokens. You can find instructions on how to do that here. https://docs.npmjs.com/getting-started/working_with_tokens#how-to-revoke-tokens\n\nUsers may consider downgrading to version 5.0.1",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -29,9 +25,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:32:17Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-xwg3-gjxh-c8pm",
  "modified": "2023-07-26T23:58:59Z",
  "published": "2020-09-03T19:14:32Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in ngx-context-menu",
  "details": "Version 0.0.26 of `ngx-context-menu` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nRemove the package from your environment. It's also recommended to evaluate your application to determine whether or not user data was compromised.\n\nUsers may consider downgrading to version 0.0.25",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -29,9 +25,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "CRITICAL",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:47:26Z",
@@ -54,9 +54,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-22T22:22:07Z",
@@ -54,9 +54,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2023-03-21T22:32:42Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-5xgj-pmjj-gw49",
  "modified": "2024-07-15T18:32:22Z",
  "published": "2024-07-15T18:32:22Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "RISC Zero zkVM notes on zero-knowledge",
  "details": "RISC Zero zkVM was designed from its inception to provide three main guarantees:\n1. *Computational integrity*: that a given software program executed correctly.\n2. *Succinctness*: that the proof of execution does not grow in relation to the program being executed.\n3. *Zero Knowledge*: that details of the program execution are not visible within the proof of program execution.\n\nUlrich Habock and Al Kindi have released [new research] that indicates that several STARK implementations -including our RISC Zero zkVM- do not meet the requirements to assert the specific property of zero knowledge provably. \n\nWhile a vast majority of real-world applications that leverage RISC Zero zkVM or similar systems depend primarily on computational integrity and succinctness, a subset of applications critically depend on the privacy guarantees provided by zero-knowledge; and for those use cases, users are cautioned to understand the research and make informed decisions based on the risks outlined in using an impacted system.\n\nAlthough the maintainers are not aware of any attacks that can take advantage of this potential weakness, they are working to proactively address this discovery as quickly as possible. \n\n[new research]: https://eprint.iacr.org/2024/1037",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -47,9 +43,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2024-07-15T18:32:22Z",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
@@ -13,9 +13,7 @@
      "score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"
    }
  ],
-  "affected": [
-
-  ],
+  "affected": [],
  "references": [
    {
      "type": "ADVISORY",
--- a/Show More
+++ b/Show More