Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-02 05:09:06 +00:00
parent 824ce281ea
commit b4cb684cc0
894 changed files with 1636 additions and 4908 deletions
@@ -3,9 +3,7 @@
  "id": "GHSA-gm9x-q798-hmr4",
  "modified": "2021-09-23T17:26:33Z",
  "published": "2020-07-29T14:53:40Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Command Injection in git-tags-remote",
  "details": "All versions of `git-tags-remote ` are vulnerable to Command Injection. The package fails to sanitize the repository input and passes it directly to an `exec` call on the `get` function . This may allow attackers to execute arbitrary code in the system if the `repo` value passed to the function is user-controlled.  \n\nThe following proof-of-concept creates a file in `/tmp`:  \n```\nconst gitTagsRemote = require('git-tags-remote');\n\ngitTagsRemote.get('https://github.com/sh0ji/git-tags-remote.git; echo \"Injection Success\" > /tmp/command-injection.test')\n.then(tags => console.log(tags));\n```",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-jmqm-f2gx-4fjv",
  "modified": "2021-09-22T19:00:07Z",
  "published": "2020-07-07T18:59:10Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Sensitive information exposure through logs in npm-registry-fetch",
  "details": "Affected versions of `npm-registry-fetch` are vulnerable to an information exposure vulnerability through log files. The cli supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-wvh7-5p38-2qfc",
  "modified": "2021-09-22T21:05:43Z",
  "published": "2020-07-23T18:20:10Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Storing Password in Local Storage",
  "details": "The `setPassword` method (http://parseplatform.org/Parse-SDK-JS/api/2.9.1/Parse.User.html#setPassword) stores the user's password in localStorage as raw text making it vulnerable to anyone with access to your localStorage. We believe this is the only time that password is stored at all. In the documentation under Users > Signing Up, it clearly states, \"We never store passwords in plaintext, nor will we ever transmit passwords back to the client in plaintext.\"\n\nExample Code:\n```js\nasync () => {\n    const user = Parse.User.current()\n    if (user) {\n        user.setPassword('newpass')\n        await user.save()\n    }\n}\n```\nAfter running the above code, the new password will be stored in localStorage as a property named \"password\".\n\nProposed Solution:\nBefore saving anything to localStorage, Parse should strip out any properties named \"password\" that are attempting to be stored with a Parse.User type object.\n\nConfiguration:\nParse SDK: 2.9.1\nParse Server: 3.9.0",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "methodOverride Middleware Reflected Cross-Site Scripting in connect",
  "details": "Connect is a stack of middleware that is executed in order in each request.\n\nThe \"methodOverride\" middleware allows the http post to override the method of the request with the value of the \"_method\" post key or with the header \"x-http-method-override\".\n\nBecause the user post input was not checked, req.method could contain any kind of value. Because the req.method did not match any common method VERB, connect answered with a 404 page containing the \"Cannot `[method]` `[url]`\" content. The method was not properly encoded for output in the browser.\n\n\n###Example:\n```\n~ curl \"localhost:3000\" -d \"_method=<script src=http://nodesecurity.io/xss.js></script>\"\nCannot <SCRIPT SRC=HTTP://NODESECURITY.IO/XSS.JS></SCRIPT> /\n```\n\n## Recommendation\n\nUpdate to the newest version of Connect or disable methodOverride. It is not possible to avoid the vulnerability if you have enabled this middleware in the top of your stack.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-6qqj-rx4w-r3cj",
  "modified": "2021-09-23T19:45:13Z",
  "published": "2020-08-31T22:48:44Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "CSRF Vulnerability in jquery-ujs",
  "details": "Versions 1.0.3 and earlier of jquery-ujs are vulnerable to an information leakage attack that may enable attackers to launch CSRF attacks, as it allows attackers to send CSRF tokens to external domains.\n\nWhen an attacker controls the href attribute of an anchor tag, or\nthe action attribute of a form tag triggering a POST action, the attacker can set the\nhref or action to \" https://attacker.com\". By prepending a space to the external domain, it causes jQuery to consider it a same origin request, resulting in the user's CSRF token being sent to the external domain.\n\n\n## Recommendation\n\nUpgrade jquery-ujs to version 1.0.4 or later.",
  "severity": [
@@ -8,9 +8,7 @@
  ],
  "summary": "API Admin Auth Weakness in tomato",
  "details": "Versions of `tomato` prior to 0.0.6 are affected by a somewhat complex authentication bypass vulnerability in the admin service when only a single access key is configured on the server. The vulnerability allows an attacker to guess the password for the admin service, no matter how complex that password is, in less than 200 requests.\n\n\n## Details\nThe tomato API has an admin service that is enabled by setting up an `access_key` in the config options. This `access_key` is intended to protect the API admin from unauthorized access.\n\n\nTomato verifies the `access_key` by checking to see if the server `access_key` incorporates the user provided value at any location. This allows an attacker to provide a single character as an `access_key`, and so long as the server key contains at least one instance of that character it will be considered a valid key.\n\n## Proof of Concept\nThis is the snippet of code that does the comparison to authorize requests.\n\n```\nif (access_key && config.master.api.access_key.indexOf(access_key) !== -1) {\n```\n\nFor an access_key that is set to anything that includes the letter 'a' the following request would be authorized.\n\n```\n$ curl -X POST \"http://localhost:8081/api/exec\" -H \"Content-Type: application/json\" -d @test -H \"access-key: a\"\n{\n \"cmd\": \"ls\",\n \"path\": \".\",\n \"stdout\": \"app.js\\nconfig.js\\nlog\\nnode_modules\\nserver.js\\n\",\n \"stderr\": \"\"\n}\n```\n\n\n\n## Recommendation\n\nUpdate to version 0.0.6 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Hidden Directories Always Served in inert",
  "details": "Versions 1.1.1 and earlier of `inert` are vulnerable to an information leakage vulnerability which causes files in hidden directories to be served, even when showHidden is false.\n\nThe inert directory handler always allows files in hidden directories to be served, even when `showHidden` is false.\n\n\n## Recommendation\n\nUpdate to version >= 1.1.1.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-j7wp-vjj6-cp5m",
  "modified": "2021-09-23T18:55:46Z",
  "published": "2020-08-11T19:40:10Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cross-Site Scripting in @progress/kendo-angular-editor",
  "details": "Kendo UI for Angular Editor Component (npm package @progress/kendo-angular-editor) before version 1.2.3 is vulnerable to Cross-Site Scripting. When the Editor content contains potentially malicious scripts in element event handlers, they get executed.\nAdding the following content to the Editor value demonstrates the issue: `<img src=\"\" onerror=alert(document.domain)>`.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -8,9 +8,7 @@
  ],
  "summary": "Directory Traversal in fancy-server",
  "details": "Versions 0.1.4 and earlier of fancy-server are vulnerable to a directory traversal attack. \n\nStandard attack vectors such as `../` will allow an attacker to read files outside of the served directory.\n\n\n## Recommendation\n\nUpgrade to version 0.1.4 or greater.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-q6j3-c4wc-63vw",
  "modified": "2021-09-23T18:50:16Z",
  "published": "2020-08-11T14:54:40Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "CSRF tokens leaked in URL by canned query form",
  "details": "### Impact\n\nThe HTML form for a read-only canned query includes the hidden CSRF token field added in #798 for writable canned queries (#698).\n\nThis means that submitting those read-only forms exposes the CSRF token in the URL - for example on https://latest.datasette.io/fixtures/neighborhood_search submitting the form took me to:\n\nhttps://latest.datasette.io/fixtures/neighborhood_search?text=down&csrftoken=CSRFTOKEN-HERE\n\nThis token could potentially leak to an attacker if the resulting page has a link to an external site on it and the user clicks the link, since the token would be exposed in the referral logs.\n\n### Patches\n\nA fix for this issue has been released in Datasette 0.46.\n\n### Workarounds\n\nYou can fix this issue in a Datasette instance without upgrading by copying the [0.46 query.html template](https://raw.githubusercontent.com/simonw/datasette/0.46/datasette/templates/query.html) into a custom `templates/` directory and running Datasette with the `--template-dir=templates/` option.\n\n### References\n\nIssue 918 discusses this in details: https://github.com/simonw/datasette/issues/918\n\n### For more information\n\nContact swillison at gmail with any questions.",
  "severity": [
@@ -8,9 +8,7 @@
  ],
  "summary": "Command Injection in ungit",
  "details": "Versions of `ungit` prior to 0.9.0 are affected by a command injection vulnerability in the `url` parameter.\n\n\n## Recommendation\n\nUpdate version 0.9.0 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-whrh-9j4q-g7ph",
  "modified": "2021-09-23T18:38:11Z",
  "published": "2020-08-05T21:43:19Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "CSRF Vulnerability in polaris-website",
  "details": "### Impact\nCSRF vulnerability:\nIn some very specific circumstances, an attacker would be able to update your settings.\nBasically you would need to navigate to hackersite.com while logged into our panel. Then they could modify your settings. They couldn't check if it worked, nor could they read your settings.\n\n### Patches\nAs of v1.1.1 this has been patched by implementing the Double submit pattern using a cookie.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [Polaris-React](https://github.com/polaris-rbx/polaris-react)\n* Email us at [hi@nezto.re](mailto:hi@nezto.re)\n* Join our discord (preferred): https://discord.gg/QevWabU",
  "severity": [
@@ -8,9 +8,7 @@
  ],
  "summary": "Denial of service in fastify",
  "details": "A denial of service vulnerability exists in Fastify v2.14.1 and v3.0.0-rc.4 that allows a malicious user to trigger resource exhaustion (when the allErrors option is used) with specially crafted schemas.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-224h-p7p5-rh85",
  "modified": "2021-09-23T21:43:28Z",
  "published": "2020-09-01T17:32:26Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Directory Traversal in wenluhong1",
  "details": "Affected versions of `wenluhong1` resolve relative file paths, resulting in a directory traversal vulnerability. A malicious actor can use this vulnerability to access files outside of the intended directory root, which may result in the disclosure of private files on the vulnerable system.\n\nExample request:\n```\nGET /../../../../../../../../../../etc/passwd HTTP/1.1\nhost:foo\n```\n\n\n## Recommendation\n\nNo patch is available for this vulnerability.\n\nIt is recommended that the package is only used for local development, and if the functionality is needed for production, a different package is used instead.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-28xx-8j99-m32j",
  "modified": "2021-10-01T13:11:55Z",
  "published": "2020-09-01T20:37:25Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in nginxbeautifier",
  "details": "Version 1.0.14 of `nginxbeautifier` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 1.0.14 of this module is found installed you will want to replace it with a version before or after 1.0.14. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-2q6w-rxf3-4wc9",
  "modified": "2021-09-24T16:54:22Z",
  "published": "2020-09-01T19:49:18Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in codify",
  "details": "Version 0.3.1 of `codify` contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to `https://js-metrics.com/minjs.php?pl=`\n\n\n\n## Recommendation\n\nIf version 0.3.1 of this module is found installed you will want to replace it with a version before or after 0.3.1. In addition to replacing the installed module, you will also want to evaluate your application to determine whether or not user data was compromised.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-33gc-f8v9-v8hm",
  "modified": "2021-10-01T13:27:36Z",
  "published": "2020-09-01T20:41:40Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in ladder-text-js",
  "details": "`ladder-text-js` contained a malicious script that attempted to delete all files when `npm test` was run.\n\n\n\n## Recommendation\n\nThis module has been unpublished from the npm Registry. If you find this module in your environment remove it.",
  "severity": [
--- a/Show More
+++ b/Show More