Advisory Database Sync

2026-05-22 18:04:22 -07:00 · 2024-12-02 05:10:34 +00:00
parent 6ea52e3e7c
commit edb3638c88
885 changed files with 1528 additions and 4584 deletions
@@ -3,14 +3,10 @@
  "id": "GHSA-22q9-hqm5-mhmc",
  "modified": "2021-09-28T17:01:08Z",
  "published": "2020-09-11T21:22:24Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cross-Site Scripting in swagger-ui",
  "details": "Versions of `swagger-ui` prior to 2.2.1 are vulnerable to Cross-Site Scripting (XSS). The package fails to encode output in GET requests. The request is meant to respond with Content-Type `application/json` which does not trigger the vulnerability but if the web server changes the header to `text/html` it may allow attackers to execute arbitrary JavaScript.\n\n\n## Recommendation\n\nUpgrade to version 2.2.1 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-388g-jwpg-x6j4",
  "modified": "2021-09-28T17:00:22Z",
  "published": "2020-09-11T21:20:14Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cross-Site Scripting in swagger-ui",
  "details": "Versions of `swagger-ui` prior to 3.0.13 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize YAML files imported from URLs or copied-pasted. This may allow attackers to execute arbitrary JavaScript.\n\n\n## Recommendation\n\nUpgrade to version 3.0.13 or later.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-3f95-w5h5-fq86",
  "modified": "2020-08-31T18:43:27Z",
  "published": "2020-09-11T21:22:24Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Prototype Pollution in mergify",
  "details": "All versions of `mergify` are vulnerable to Prototype Pollution. The `mergify()` function allows attackers to modify the prototype of Object causing the addition or modification of an existing property that will exist on all objects.\n\n\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative module as the package is deprecated.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-48gc-5j93-5cfq",
  "modified": "2020-08-31T18:42:15Z",
  "published": "2020-09-11T21:15:54Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Path Traversal in serve",
  "details": "Versions of `serve` prior to 10.1.2 are vulnerable to Path Traversal. Explicitly ignored folders can be accessed through relative paths, which allows attackers to access hidden folders and files.\n\n\n## Recommendation\n\nUpgrade to version 10.1.2 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-4q2f-8g74-qm56",
  "modified": "2020-08-31T18:45:01Z",
  "published": "2020-09-03T17:18:05Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cross-Site Scripting in takeapeek",
  "details": "All versions of `takeapeek` are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-5634-rv46-48jf",
  "modified": "2020-08-31T18:44:51Z",
  "published": "2020-09-03T17:13:45Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cross-Site Scripting in bleach",
  "details": "All versions of `bleach` are vulnerable to Cross-Site Scripting. It is possible to bypass the package's HTML sanitization with payloads such as `\"<<script><</script>script>alert('xss');</<script><</script>script>\"` regardless of the passed options. This may allow attackers to execute arbitrary JavaScript in the victim's browser.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-588m-9qg5-35pq",
  "modified": "2021-09-28T22:06:18Z",
  "published": "2020-09-03T17:19:09Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Reverse Tabnabbing in quill",
  "details": "Versions of `quill` prior to 1.3.7 are vulnerable to [Reverse Tabnabbing](https://www.owasp.org/index.php/Reverse_Tabnabbing). The package uses `target='_blank'` in anchor tags, allowing attackers to access `window.opener` for the original page when opening links. This is commonly used for phishing attacks.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-5g6j-8hv4-vfgj",
  "modified": "2020-08-31T18:43:22Z",
  "published": "2020-09-11T21:21:19Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cross-Site Scripting in node-red",
  "details": "Versions of `node-red` prior to 0.18.6 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize the `name` field in new items, allowing attackers to execute arbitrary JavaScript in the victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 0.18.6 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-6879-xr95-5gf4",
  "modified": "2021-09-30T17:16:35Z",
  "published": "2020-09-03T17:20:15Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in malicious-do-not-install",
  "details": "All versions of `malicious-do-not-install` contain malicious code. The package copies the contents of `/etc/passwd` and `/etc/shadow` to files in the local `/tmp/` folder.\n\n\n## Recommendation\n\nRemove the package from your environment and rotate affected credentials.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-6m6m-j2hm-pxrg",
  "modified": "2021-09-30T19:33:36Z",
  "published": "2020-09-03T17:37:05Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in cicada-render",
  "details": "All versions of `cicada-render` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-8m5v-f2wp-wqr9",
  "modified": "2021-09-30T17:50:11Z",
  "published": "2020-09-03T17:30:36Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in ali-contributors",
  "details": "All versions of `ali-contributors` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-8q2c-2396-hf7j",
  "modified": "2021-09-30T19:31:14Z",
  "published": "2020-09-03T17:34:55Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Malicious Package in appx-compiler",
  "details": "All versions of `appx-compiler` contain malicious code. The package uploads system information to a remote server, downloads a file and executes it.\n\n\n## Recommendation\n\nAny computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.\n\nThe package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-9pcf-h8q9-63f6",
  "modified": "2020-08-31T18:44:49Z",
  "published": "2020-09-03T17:12:41Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Sandbox Breakout / Arbitrary Code Execution in safe-eval",
  "details": "All versions of `safe-eval` are vulnerable to Sandbox Escape leading to Remote Code Execution. A payload chaining a function's callee and caller constructors can escape the sandbox and execute arbitrary code.  \n\nFor example, the payload \n```\n((() => { \nconst targetKey = Object.keys(this)[0]; \nObject.defineProperty(this, targetKey, { \nget: function() { \nreturn arguments.callee.caller.constructor( \n\"return global.process.mainModule.require('child_process').execSync('pwd').toString()\" \n)(); \n} \n}); \n})();```\nmay be used to print the `pwd` to the console.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -36,9 +32,7 @@
    }
  ],
  "database_specific": {
-    "cwe_ids": [
-
-    ],
+    "cwe_ids": [],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2020-08-31T18:44:49Z",
@@ -3,14 +3,10 @@
  "id": "GHSA-9qgh-7pgp-hp7r",
  "modified": "2020-08-31T18:44:42Z",
  "published": "2020-09-03T17:10:31Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cross-Site Scripting in graylog-web-interface",
  "details": "All versions of  `graylog-web-interface` are vulnerable to Cross-Site Scripting (XSS). The package fails to escape output on the `TypeAhead` and `QueryInput` components, which may allow attackers to execute arbitrary JavaScript on the victim's browser.\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-9r3m-mhfm-39cm",
  "modified": "2020-08-31T18:42:08Z",
  "published": "2020-09-11T21:10:29Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Incorrect Calculation in bigint-money",
  "details": "Versions of `bigint-money` prior to 0.6.2 are vulnerable to an Incorrect Calculation. The package incorrectly rounded certain numbers, which could have drastic consequences due to its usage in financial systems.\n\n\n## Recommendation\n\nUpgrade to version 0.6.2 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,9 +3,7 @@
  "id": "GHSA-9v62-24cr-58cx",
  "modified": "2021-09-28T16:08:17Z",
  "published": "2020-09-11T21:12:39Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Denial of Service in node-sass",
  "details": "Affected versions of `node-sass` are vulnerable to Denial of Service (DoS). Crafted objects passed to the `renderSync` function may trigger C++ assertions in `CustomImporterBridge::get_importer_entry` and `CustomImporterBridge::post_process_return_value` that crash the Node process. This may allow attackers to crash the system's running Node process and lead to Denial of Service.\n\n\n## Recommendation\n\nUpgrade to version 4.13.1 or later",
  "severity": [
@@ -3,9 +3,7 @@
  "id": "GHSA-c53x-wwx2-pg96",
  "modified": "2021-09-28T17:27:43Z",
  "published": "2020-09-03T17:03:58Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cross-Site Scripting in @berslucas/liljs",
  "details": "Versions of  `@berslucas/liljs` prior to 1.0.2 are vulnerable to Cross-Site Scripting (XSS). The package uses the unsafe `innerHTML` function without sanitizing input, which may allow attackers to execute arbitrary JavaScript on the victim's browser.\n\n\n## Recommendation\n\nUpgrade to version 1.0.2 or later.",
  "severity": [
@@ -3,14 +3,10 @@
  "id": "GHSA-cpgr-wmr9-qxv4",
  "modified": "2020-08-31T18:43:20Z",
  "published": "2020-09-11T21:20:14Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Cross-Site Scripting in serve",
  "details": "Versions of `serve` prior to 10.0.2 are vulnerable to Cross-Site Scripting (XSS). The package fails to sanitize filenames, allowing attackers to execute arbitrary JavaScript in the victim's browser through files with names containing malicious code.\n\n\n## Recommendation\n\nUpgrade to version 10.0.2 or later.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-crf7-fvjx-863q",
  "modified": "2020-08-31T18:44:37Z",
  "published": "2020-09-03T17:09:26Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "Path Traversal in zero",
  "details": "Versions of `zero` prior to 1.0.6 are vulnerable to Path Traversal.  Due to insufficient input sanitization in URLs, attackers can access server files by using relative paths when fetching files. \n\n\n## Recommendation\n\nUpgrade to version 1.0.6 or later.\n",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
@@ -3,14 +3,10 @@
  "id": "GHSA-crpm-fm48-chj7",
  "modified": "2020-08-31T18:42:11Z",
  "published": "2020-09-11T21:13:44Z",
-  "aliases": [
-
-  ],
+  "aliases": [],
  "summary": "SQL Injection in resquel",
  "details": "All versions of `resquel` are vulnerable to SQL Injection. Query parameters are not properly sanitized, allowing attackers to inject SQL statements and execute arbitrary SQL queries\n\n\n## Recommendation\n\nNo fix is currently available. Consider using an alternative package until a fix is made available.",
-  "severity": [
-
-  ],
+  "severity": [],
  "affected": [
    {
      "package": {
--- a/Show More
+++ b/Show More