@capriza/far (>=0.1.2 <=2.4.2), @cobalt-engine/cobower (=2.0.0) +365 more potentially affected by CVE-2018-20835 via tar-fs (>=0.1.8 <=1.16.0)

tar-fs NPM version =0.1.8, =0.1.2, =6.0.3, =6.0.3, =6.0.3, =2.1.1, =0.10.2, =0.0.0-beta.1, =0.0.0-beta.1, =0.0.0-beta.1, =0.1.0, =0.1.0, =1.1.3, =1.1.15 - @monsieurbarti/micro-connector =3.1.7 and more Source cves: CVE-2018-20835 Source advisory: OSV:GHSA-X2MC-8FGJ-3WMR...

aiolambda (>=0.2.0 <=0.3.0), alcazar-web-framework (=0.0.2) +161 more potentially affected by CVE-2019-10906 via jinja2 (=2.10.0)

jinja2 PYPI version =2.10.0 is affected by a known vulnerability. The following packages have a transitive dependency on jinja2 and may be impacted: - aiolambda =0.2.0, =1.10.3, =3.0.0, =0.1.0, =0.0.1, =0.2.0, =0.6.7.post3, =0.7.1, =0.1.1, =1.2.1, =0.0.2, =0.0.3 - burl =1.0.0 and more Source cves...

@anzeblabla/react-native-markdown-editor (>=1.0.3 <=2.1.1), @gorangajic/react-native-markdown (=0.1.1) +22 more potentially affected by CVE-2019-9844 via simple-markdown (>=0.0.9 <=0.4.2)

simple-markdown NPM version =0.0.9, =1.0.3, =1.3.0, =1.0.1, =1.0.4, =2.3.0, =0.1.0, =1.2.0, =2.4.0, =1.2.0, =1.1.0, =1.0.0, =1.10.0 and more Source cves: CVE-2019-9844 Source advisory: OSV:GHSA-QJ3F-9GMQ-FWV5...

eskapade-spark (>=0.8.0 <=0.8.2), pytispark (>=1.0.0rc2 <=1.0.1) potentially affected by CVE-2018-1334 via pyspark (=2.1.2)

pyspark PYPI version =2.1.2 is affected by a known vulnerability. The following packages have a transitive dependency on pyspark and may be impacted: - eskapade-spark =0.8.0, =1.0.0rc2, =1.0.1 Source cves: CVE-2018-1334 Source advisory: OSV:GHSA-6MQQ-8R44-VMJC...

apeman-demo-static (>=2.0.0 <=2.0.8), apeman-demo-web (=3.0.1) +23 more potentially affected by CVE-2016-10582 via closurecompiler (>=1.1.4 <=1.6.1)

closurecompiler NPM version =1.1.4, =2.0.0, =1.5.6, =1.0.0, =0.2.0, =0.1.0, =0.4.0, =0.9.0, =1.0.0, =0.3.0, =0.1.0, =0.1.3, =0.0.1, =0.1.1 - makona-editor =0.0.1 and more Source cves: CVE-2016-10582 Source advisory: OSV:GHSA-HJGP-8FFR-HWWR...

0x00-pl--avg-pack-to-ttf (>=0.0.2 <=0.0.6), 0x00-pl--svg-pack-to-ttf (>=0.0.7 <=0.0.15) +3410 more potentially affected by CVE-2016-10538 via cli (>=0.10.0 <=0.9.0)

cli NPM version =0.10.0, =0.0.2, =0.0.7, =1.2.0, =2.2.4, =2.11.4, =2.0.0, =2.11.4, =3.0.0, =0.1.4, =1.1.0, =0.1.0, =1.0.0, =1.1.0, =1.1.0, =1.1.5 and more Source cves: CVE-2016-10538 Source advisory: OSV:GHSA-6CPC-MJ5C-M9RQ...

1tp (>=0.0.1 <=0.11.2), 5aces-service-registry (=1.0.1) +498 more potentially affected by CVE-2016-10536 via engine.io-client (>=0.1.0 <=1.6.8)

engine.io-client NPM version =0.1.0, =0.0.1, =1.0.1, =0.12.0-edge9, =0.0.1, =1.8.4, =1.0.0, =1.0.30, =0.1.0, =2.0.0-beta.1, =3.6.0, =3.7.0 and more Source cves: CVE-2016-10536 Source advisory: OSV:GHSA-4R4M-HJWJ-43P8...

cklauth (>=0.1.0 <=0.3.0), dj-saml-idp (>=1.1.0 <=1.2.1) +18 more potentially affected by CVE-2019-6975 via django (>=2.0.0 <=2.0.1)

django PYPI version =2.0.0, =0.1.0, =1.1.0, =4.3.1, =1.2.7, =0.1.0, =1.7.0, =0.0.3, =0.0.20, =0.1.0 - djangotheming =0.1.0 - fastaudiovisal =0.0.1 - fastaudiovisual =0.0.1 and more Source cves: CVE-2019-6975 Source advisory: OSV:GHSA-WH4H-V3F2-R2PP...

GHSA-VX85-MJ8C-4QM6 vulnerabilities

Vulnerabilities for packages: druid, trino...

GHSA-9MXF-G3X6-WV74 vulnerabilities

Vulnerabilities for packages: hive...

com.github.CCweixiao:hbase-sdk-thrift-core_1.x (>=2.0.7 <=2.0.8), org.apache.hbase:hbase-assembly (>=1.4.0 <=1.4.13) +1 more potentially affected by CVE-2018-8025 via org.apache.hbase:hbase-thrift (>=1.4.0 <=1.4.4)

org.apache.hbase:hbase-thrift MAVEN version =1.4.0, =2.0.7, =1.4.0, =1.4.0, =1.4.13 Source cves: CVE-2018-8025 Source advisory: OSV:GHSA-R86J-2GC6-2CQ9...

com.github.CCweixiao:hbase-sdk-thrift (=3.0.0), com.hydraql:hydraql-thrift (>=1.0.1 <=1.0.4) +2 more potentially affected by CVE-2018-8025 via org.apache.hbase:hbase-thrift (>=0.96.0-hadoop1 <=1.2.0)

org.apache.hbase:hbase-thrift MAVEN version =0.96.0-hadoop1, =1.0.1, =0.96.0-hadoop1, =0.98.24-hadoop1 Source cves: CVE-2018-8025 Source advisory: OSV:GHSA-R86J-2GC6-2CQ9...

Moderate severity vulnerability that affects org.keycloak:keycloak-core

Withdrawn: Duplicate of CVE-2017-12161 / GHSA-959q-32g8-vvp7...

ColumnPack:ColumnPack-plugin (=1.0.3), CustomHistory:CustomHistory (>=1.1 <=1.3) +17184 more potentially affected by CVE-2016-5007 via org.springframework:spring-core (>=1.2 <=4.3.0.RELEASE)

org.springframework:spring-core MAVEN version =1.2, =1.1, =1.3, =0.0.1, =0.1.6, =0.1.4-SB1X, =0.1.0, =0.1.0, =1.0, =5.0.9, =0.0.20, =0.0.34 - ar.com.onready:spring-resttemplate-logger =1.0.2 - at.chrl:chrl-jms =1.1.0 and more Source cves: CVE-2016-5007 Source advisory: OSV:GHSA-8CRV-49FR-2H6J...

br.net.woodstock.rockframework:rockframework-core (>=1.2.1 <=1.2.2), com.alanpoi:alanpoi-all (>=1.3.5 <=3.0.0) +64 more potentially affected by CVE-2016-1000342 via org.bouncycastle:bcprov-jdk14 (>=1.38 <=1.55)

org.bouncycastle:bcprov-jdk14 MAVEN version =1.38, =1.2.1, =1.3.5, =1.3.5, =2.0, =1.0, =1.6.1.P24, =1.7, =0.0.1, =1.0, =1.1 - com.github.lkkushan101.RestAssuredPDFReport:com.github.lkkushan101.RestAssuredPDFReport =1.00 - com.github.lkkushan101.appiumlocator:com.github.lkkushan101.appiumlocator...

burp-ui (>=0.4.1 <=0.5.1), certbot-pinned (=0.17.0) +82 more potentially affected by CVE-2018-1000808 via pyopenssl (>=16.0.0 <=17.4.0)

pyopenssl PYPI version =16.0.0, =0.4.1, =1.2.1.20160901, =0.9.5, =0.2.10.3, =2.2.0, =0.5.0, =0.3.0, =0.2.4, =0.9.2, =0.9.7, =1.9.5, =1.1.1, =1.3.0 and more Source cves: CVE-2018-1000808 Source advisory: OSV:GHSA-2RCM-PHC9-3945...

1ib (>=1.0.9 <=1.0.11), 20190403-utils (=1.0.0) +10533 more potentially affected by CVE-2017-16137 via debug (>=4.0.0 <=4.3.0)

debug NPM version =4.0.0, =1.0.9, =1.0.1, =1.1.2, =1.0.0, =4.11.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.2.3 and more Source cves: CVE-2017-16137 Source advisory: OSV:GHSA-GXPJ-CX7G-858C...

@folk-org/js-dav (>=1.0.0 <=1.0.3), @lettercms/models (>=0.0.1 <=0.0.12) +187 more potentially affected by CVE-2017-16082 via pg (>=4.0.0 <=4.5.6)

pg NPM version =4.0.0, =1.0.0, =0.0.1, =1.0.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.15 and more Source cves: CVE-2017-16082 Source advisory: OSV:GHSA-WC9V-MJ63-M9G5...

3rr (>=0.0.1 <=0.0.2), @apechimp/cool-led (=1.0.0) +321 more potentially affected by CVE-2015-9242 via ecstatic (>=0.1.6 <=1.3.1)

ecstatic NPM version =0.1.6, =0.0.1, =0.2.3, =0.2.1, =0.1.1, =1.0.0, =1.6.9, =0.0.6, =3.0.0-0, =0.0.0, =0.0.1, =0.0.4 and more Source cves: CVE-2015-9242 Source advisory: OSV:GHSA-VWJC-Q9PX-R9VQ...

Arbitrary JavaScript Execution

Overview A vulnerability exists in bassmaster = 1.5.1 that allows for an attacker to provide arbitrary JavaScript that is then executed server side via eval. Recommendation Update to bassmaster version 1.5.2 or greater. References - Commit b751602 - GitHub Advisory...