dmyers87/boomstrap-react

React Components and Mixins for Boomstrap

boomstrap-react's Issues

CVE-2022-31129 (High) detected in moment-2.29.1.tgz, moment-2.20.1.tgz

CVE-2022-31129 - High Severity Vulnerability

Vulnerable Libraries - moment-2.29.1.tgz, moment-2.20.1.tgz

moment-2.29.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.29.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment/package.json

Dependency Hierarchy:

• ❌ moment-2.29.1.tgz (Vulnerable Library)

moment-2.20.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.20.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/changelog/node_modules/moment/package.json

Dependency Hierarchy:

• changelog-1.4.2.tgz (Root Library)
  • ❌ moment-2.20.1.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Publish Date: 2022-07-06

URL: CVE-2022-31129

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wc69-rhjr-hc9g

Release Date: 2022-07-06

Fix Resolution: 2.29.4

---

⛑️ Automatic Remediation is available for this issue

CVE-2017-16116 (High) detected in underscore.string-2.0.0.tgz - autoclosed

CVE-2017-16116 - High Severity Vulnerability

Vulnerable Library - underscore.string-2.0.0.tgz

String manipulation extensions for Underscore.js javascript library.

Library home page: https://registry.npmjs.org/underscore.string/-/underscore.string-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/underscore.string/package.json

Dependency Hierarchy:

• jest-cli-0.2.2.tgz (Root Library)
  • cover-0.2.9.tgz
    • ❌ underscore.string-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

The string module is a module that provides extra string operations. The string module is vulnerable to regular expression denial of service when specifically crafted untrusted user input is passed into the underscore or unescapeHTML methods.

Publish Date: 2018-06-07

URL: CVE-2017-16116

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-16116

Release Date: 2018-06-07

Fix Resolution (underscore.string): 3.3.5

Direct dependency fix Resolution (jest-cli): 13.0.0

---

⛑️ Automatic Remediation is available for this issue

CVE-2017-16137 (Medium) detected in debug-2.2.0.tgz

CVE-2017-16137 - Medium Severity Vulnerability

Vulnerable Library - debug-2.2.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/express-session/node_modules/debug/package.json,/node_modules/connect/node_modules/debug/package.json,/node_modules/connect-timeout/node_modules/debug/package.json,/node_modules/send/node_modules/debug/package.json,/node_modules/finalhandler/node_modules/debug/package.json,/node_modules/body-parser/node_modules/debug/package.json,/node_modules/serve-index/node_modules/debug/package.json,/node_modules/tiny-lr/node_modules/debug/package.json,/node_modules/compression/node_modules/debug/package.json,/node_modules/morgan/node_modules/debug/package.json

Dependency Hierarchy:

• webpack-dev-server-1.16.5.tgz (Root Library)
  • compression-1.5.2.tgz
    • ❌ debug-2.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16137

Release Date: 2018-06-07

Fix Resolution: 2.6.9

CVE-2021-23382 (High) detected in postcss-4.1.16.tgz, postcss-5.2.18.tgz

CVE-2021-23382 - High Severity Vulnerability

Vulnerable Libraries - postcss-4.1.16.tgz, postcss-5.2.18.tgz

postcss-4.1.16.tgz

Tool for transforming CSS with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-4.1.16.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/autoprefixer-core/node_modules/postcss/package.json

Dependency Hierarchy:

• autoprefixer-loader-2.1.0.tgz (Root Library)
  • autoprefixer-core-5.2.1.tgz
    • ❌ postcss-4.1.16.tgz (Vulnerable Library)

postcss-5.2.18.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-5.2.18.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss/package.json

Dependency Hierarchy:

• autoprefixer-loader-2.1.0.tgz (Root Library)
  • ❌ postcss-5.2.18.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution: postcss - 8.2.13

CVE-2022-0686 (High) detected in url-parse-1.5.4.tgz

CVE-2022-0686 - High Severity Vulnerability

Vulnerable Library - url-parse-1.5.4.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

• webpack-dev-server-1.16.5.tgz (Root Library)
  • sockjs-client-1.5.2.tgz
    • ❌ url-parse-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Publish Date: 2022-02-20

URL: CVE-2022-0686

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686

Release Date: 2022-02-20

Fix Resolution: url-parse - 1.5.8

WS-2018-0107 (High) detected in open-0.0.5.tgz

WS-2018-0107 - High Severity Vulnerability

Vulnerable Library - open-0.0.5.tgz

open a file or url in the user's preferred application

Library home page: https://registry.npmjs.org/open/-/open-0.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/open/package.json

Dependency Hierarchy:

• webpack-dev-server-1.16.5.tgz (Root Library)
  • ❌ open-0.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

All versions of open are vulnerable to command injection when unsanitized user input is passed in.

Publish Date: 2018-05-16

URL: WS-2018-0107

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/WS-2018-0107

Release Date: 2018-01-27

Fix Resolution: open - 6.0.0

CVE-2018-16487 (Medium) detected in multiple libraries

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Libraries - lodash-2.4.2.tgz, lodash-1.0.2.tgz, lodash-3.10.1.tgz, lodash-4.17.5.tgz

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-1.0.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/globule/node_modules/lodash/package.json

Dependency Hierarchy:

• gulp-3.9.1.tgz (Root Library)
  • vinyl-fs-0.3.14.tgz
    • glob-watcher-0.0.6.tgz
      • gaze-0.5.2.tgz
        • globule-0.1.0.tgz
          • ❌ lodash-1.0.2.tgz (Vulnerable Library)

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-core/node_modules/lodash/package.json,/node_modules/babel/node_modules/lodash/package.json,/node_modules/babel-plugin-proto-to-assign/node_modules/lodash/package.json,/node_modules/babel-jest/node_modules/lodash/package.json,/node_modules/inquirer/node_modules/lodash/package.json

Dependency Hierarchy:

• babel-core-5.8.38.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/changelog/node_modules/lodash/package.json

Dependency Hierarchy:

• changelog-1.4.2.tgz (Root Library)
  • ❌ lodash-4.17.5.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/380873

Release Date: 2019-02-01

Fix Resolution: 4.17.11

---

⛑️ Automatic Remediation is available for this issue

WS-2019-0169 (Medium) detected in marked-0.3.19.tgz

WS-2019-0169 - Medium Severity Vulnerability

Vulnerable Library - marked-0.3.19.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.19.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/marked/package.json

Dependency Hierarchy:

• ❌ marked-0.3.19.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

marked versions >0.3.14 and < 0.6.2 has Regular Expression Denial of Service vulnerability Email addresses may be evaluated in quadratic time, allowing attackers to potentially crash the node process due to resource exhaustion.

Publish Date: 2019-04-03

URL: WS-2019-0169

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/812

Release Date: 2019-04-03

Fix Resolution: 0.6.2

---

⛑️ Automatic Remediation is available for this issue

CVE-2019-1010266 (Medium) detected in multiple libraries

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Libraries - lodash-4.17.5.tgz, lodash-3.10.1.tgz, lodash-2.4.2.tgz, lodash-1.0.2.tgz

lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/changelog/node_modules/lodash/package.json

Dependency Hierarchy:

• changelog-1.4.2.tgz (Root Library)
  • ❌ lodash-4.17.5.tgz (Vulnerable Library)

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-core/node_modules/lodash/package.json,/node_modules/babel/node_modules/lodash/package.json,/node_modules/babel-plugin-proto-to-assign/node_modules/lodash/package.json,/node_modules/babel-jest/node_modules/lodash/package.json,/node_modules/inquirer/node_modules/lodash/package.json

Dependency Hierarchy:

• babel-core-5.8.38.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-1.0.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/globule/node_modules/lodash/package.json

Dependency Hierarchy:

• gulp-3.9.1.tgz (Root Library)
  • vinyl-fs-0.3.14.tgz
    • glob-watcher-0.0.6.tgz
      • gaze-0.5.2.tgz
        • globule-0.1.0.tgz
          • ❌ lodash-1.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-07-17

Fix Resolution: 4.17.11

---

⛑️ Automatic Remediation is available for this issue

CVE-2022-1650 (Critical) detected in eventsource-1.1.0.tgz

CVE-2022-1650 - High Severity Vulnerability

Vulnerable Library - eventsource-1.1.0.tgz

W3C compliant EventSource client for Node.js and browser (polyfill)

Library home page: https://registry.npmjs.org/eventsource/-/eventsource-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/eventsource/package.json

Dependency Hierarchy:

• webpack-dev-server-1.16.5.tgz (Root Library)
  • sockjs-client-1.5.2.tgz
    • ❌ eventsource-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository eventsource/eventsource prior to v2.0.2.

Publish Date: 2022-05-12

URL: CVE-2022-1650

CVSS 3 Score Details (9.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-05-12

Fix Resolution: eventsource - 1.1.1,2.0.2

CVE-2018-14732 (High) detected in webpack-dev-server-1.16.5.tgz

CVE-2018-14732 - High Severity Vulnerability

Vulnerable Library - webpack-dev-server-1.16.5.tgz

Serves a webpack app. Updates the browser on changes.

Library home page: https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-1.16.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/webpack-dev-server/package.json

Dependency Hierarchy:

• ❌ webpack-dev-server-1.16.5.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

Publish Date: 2018-09-21

URL: CVE-2018-14732

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14732

Release Date: 2018-09-21

Fix Resolution: 3.1.6

---

⛑️ Automatic Remediation is available for this issue

CVE-2022-0639 (Medium) detected in url-parse-1.5.4.tgz

CVE-2022-0639 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.5.4.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

• webpack-dev-server-1.16.5.tgz (Root Library)
  • sockjs-client-1.5.2.tgz
    • ❌ url-parse-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.7.

Publish Date: 2022-02-17

URL: CVE-2022-0639

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0639

Release Date: 2022-02-17

Fix Resolution: url-parse - 1.5.7

CVE-2017-1000048 (High) detected in multiple libraries

CVE-2017-1000048 - High Severity Vulnerability

Vulnerable Libraries - qs-2.4.1.tgz, qs-4.0.0.tgz, qs-5.2.0.tgz, qs-5.1.0.tgz, qs-2.3.3.tgz

qs-2.4.1.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-2.4.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/react-router/node_modules/qs/package.json

Dependency Hierarchy:

• react-router-0.13.6.tgz (Root Library)
  • ❌ qs-2.4.1.tgz (Vulnerable Library)

qs-4.0.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy:

• gulp-connect-2.3.1.tgz (Root Library)
  • connect-2.30.2.tgz
    • ❌ qs-4.0.0.tgz (Vulnerable Library)

qs-5.2.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-5.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tiny-lr/node_modules/body-parser/node_modules/qs/package.json

Dependency Hierarchy:

• gulp-connect-2.3.1.tgz (Root Library)
  • tiny-lr-0.2.1.tgz
    • body-parser-1.14.2.tgz
      • ❌ qs-5.2.0.tgz (Vulnerable Library)

qs-5.1.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-5.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tiny-lr/node_modules/qs/package.json

Dependency Hierarchy:

• gulp-connect-2.3.1.tgz (Root Library)
  • tiny-lr-0.2.1.tgz
    • ❌ qs-5.1.0.tgz (Vulnerable Library)

qs-2.3.3.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-2.3.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/superagent/node_modules/qs/package.json

Dependency Hierarchy:

• superagent-1.8.5.tgz (Root Library)
  • ❌ qs-2.3.3.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Publish Date: 2017-07-17

URL: CVE-2017-1000048

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000048

Release Date: 2017-07-13

Fix Resolution (qs): 6.0.4

Direct dependency fix Resolution (react-router): 1.0.0

Fix Resolution (qs): 6.0.4

Direct dependency fix Resolution (gulp-connect): 5.6.1

Fix Resolution (qs): 6.0.4

Direct dependency fix Resolution (gulp-connect): 5.6.1

Fix Resolution (qs): 6.0.4

Direct dependency fix Resolution (gulp-connect): 5.6.1

Fix Resolution (qs): 6.0.4

Direct dependency fix Resolution (superagent): 2.0.0

---

⛑️ Automatic Remediation is available for this issue

CVE-2022-21680 (High) detected in marked-0.3.19.tgz

CVE-2022-21680 - High Severity Vulnerability

Vulnerable Library - marked-0.3.19.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.19.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/marked/package.json

Dependency Hierarchy:

• ❌ marked-0.3.19.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression block.def may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Publish Date: 2022-01-14

URL: CVE-2022-21680

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rrrm-qjm4-v8hf

Release Date: 2022-01-14

Fix Resolution: 4.0.10

---

⛑️ Automatic Remediation is available for this issue

WS-2018-0111 (High) detected in base64-url-1.2.1.tgz

WS-2018-0111 - High Severity Vulnerability

Vulnerable Library - base64-url-1.2.1.tgz

Base64 encode, decode, escape and unescape for URL applications

Library home page: https://registry.npmjs.org/base64-url/-/base64-url-1.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/base64-url/package.json

Dependency Hierarchy:

• gulp-connect-2.3.1.tgz (Root Library)
  • connect-2.30.2.tgz
    • express-session-1.11.3.tgz
      • uid-safe-2.0.0.tgz
        • ❌ base64-url-1.2.1.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Versions of base64-url before 2.0.0 are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input.

Publish Date: 2018-05-16

URL: WS-2018-0111

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/660

Release Date: 2018-01-27

Fix Resolution: 2.0.0

CVE-2020-28500 (Medium) detected in multiple libraries

CVE-2020-28500 - Medium Severity Vulnerability

Vulnerable Libraries - lodash-1.0.2.tgz, lodash-3.10.1.tgz, lodash-2.4.2.tgz, lodash-4.17.5.tgz

lodash-1.0.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/globule/node_modules/lodash/package.json

Dependency Hierarchy:

• gulp-3.9.1.tgz (Root Library)
  • vinyl-fs-0.3.14.tgz
    • glob-watcher-0.0.6.tgz
      • gaze-0.5.2.tgz
        • globule-0.1.0.tgz
          • ❌ lodash-1.0.2.tgz (Vulnerable Library)

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-core/node_modules/lodash/package.json,/node_modules/babel/node_modules/lodash/package.json,/node_modules/babel-plugin-proto-to-assign/node_modules/lodash/package.json,/node_modules/babel-jest/node_modules/lodash/package.json,/node_modules/inquirer/node_modules/lodash/package.json

Dependency Hierarchy:

• babel-core-5.8.38.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/changelog/node_modules/lodash/package.json

Dependency Hierarchy:

• changelog-1.4.2.tgz (Root Library)
  • ❌ lodash-4.17.5.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution: 4.17.21

---

⛑️ Automatic Remediation is available for this issue

CVE-2018-16492 (High) detected in extend-3.0.0.tgz, extend-1.3.0.tgz

CVE-2018-16492 - High Severity Vulnerability

Vulnerable Libraries - extend-3.0.0.tgz, extend-1.3.0.tgz

extend-3.0.0.tgz

Port of jQuery.extend for node.js and the browser

Library home page: https://registry.npmjs.org/extend/-/extend-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/superagent/node_modules/extend/package.json

Dependency Hierarchy:

• superagent-1.8.5.tgz (Root Library)
  • ❌ extend-3.0.0.tgz (Vulnerable Library)

extend-1.3.0.tgz

Port of jQuery.extend for node.js and the browser

Library home page: https://registry.npmjs.org/extend/-/extend-1.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/uglifyify/node_modules/extend/package.json

Dependency Hierarchy:

• uglifyify-3.0.4.tgz (Root Library)
  • ❌ extend-1.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16492

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/381185

Release Date: 2019-02-01

Fix Resolution: extend - v3.0.2,v2.0.2

CVE-2021-44906 (High) detected in minimist-0.0.10.tgz, minimist-1.2.5.tgz

CVE-2021-44906 - High Severity Vulnerability

Vulnerable Libraries - minimist-0.0.10.tgz, minimist-1.2.5.tgz

minimist-0.0.10.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/optimist/node_modules/minimist/package.json

Dependency Hierarchy:

• jest-cli-0.2.2.tgz (Root Library)
  • optimist-0.6.1.tgz
    • ❌ minimist-0.0.10.tgz (Vulnerable Library)

minimist-1.2.5.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

• gulp-3.9.1.tgz (Root Library)
  • ❌ minimist-1.2.5.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-03-17

Fix Resolution: minimist - 1.2.6

WS-2019-0063 (High) detected in js-yaml-3.4.5.tgz

WS-2019-0063 - High Severity Vulnerability

Vulnerable Library - js-yaml-3.4.5.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.4.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/js-yaml/package.json

Dependency Hierarchy:

• eslint-1.10.3.tgz (Root Library)
  • ❌ js-yaml-3.4.5.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-05

URL: WS-2019-0063

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-05

Fix Resolution: js-yaml - 3.13.1

CVE-2020-7598 (Medium) detected in minimist-0.0.10.tgz

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Library - minimist-0.0.10.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/optimist/node_modules/minimist/package.json

Dependency Hierarchy:

• jest-cli-0.2.2.tgz (Root Library)
  • optimist-0.6.1.tgz
    • ❌ minimist-0.0.10.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3

CVE-2018-1000620 (High) detected in cryptiles-2.0.5.tgz, cryptiles-3.1.4.tgz

CVE-2018-1000620 - High Severity Vulnerability

Vulnerable Libraries - cryptiles-2.0.5.tgz, cryptiles-3.1.4.tgz

cryptiles-2.0.5.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-2.0.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/less/node_modules/cryptiles/package.json

Dependency Hierarchy:

• less-2.7.3.tgz (Root Library)
  • request-2.81.0.tgz
    • hawk-3.1.3.tgz
      • ❌ cryptiles-2.0.5.tgz (Vulnerable Library)

cryptiles-3.1.4.tgz

General purpose crypto utilities

Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-3.1.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/cryptiles/package.json

Dependency Hierarchy:

• changelog-1.4.2.tgz (Root Library)
  • request-2.83.0.tgz
    • hawk-6.0.2.tgz
      • ❌ cryptiles-3.1.4.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620

Release Date: 2018-07-09

Fix Resolution: v4.1.2

CVE-2016-10540 (High) detected in minimatch-2.0.10.tgz, minimatch-0.2.14.tgz

CVE-2016-10540 - High Severity Vulnerability

Vulnerable Libraries - minimatch-2.0.10.tgz, minimatch-0.2.14.tgz

minimatch-2.0.10.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-2.0.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimatch/package.json

Dependency Hierarchy:

• babel-core-5.8.38.tgz (Root Library)
  • ❌ minimatch-2.0.10.tgz (Vulnerable Library)

minimatch-0.2.14.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-0.2.14.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/globule/node_modules/minimatch/package.json

Dependency Hierarchy:

• gulp-3.9.1.tgz (Root Library)
  • vinyl-fs-0.3.14.tgz
    • glob-watcher-0.0.6.tgz
      • gaze-0.5.2.tgz
        • globule-0.1.0.tgz
          • ❌ minimatch-0.2.14.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.

Publish Date: 2018-05-31

URL: CVE-2016-10540

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-10540

Release Date: 2018-04-26

Fix Resolution (minimatch): 3.0.2

Direct dependency fix Resolution (babel-core): 6.10.4

Fix Resolution (minimatch): 3.0.2

Direct dependency fix Resolution (gulp): 4.0.0

---

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-43138 (High) detected in multiple libraries - autoclosed

CVE-2021-43138 - High Severity Vulnerability

Vulnerable Libraries - async-0.9.2.tgz, async-1.5.2.tgz, async-0.2.10.tgz, async-0.2.6.tgz

async-0.9.2.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-0.9.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/watchpack/node_modules/async/package.json,/node_modules/react-docgen/node_modules/async/package.json

Dependency Hierarchy:

• webpack-1.15.0.tgz (Root Library)
  • watchpack-0.2.9.tgz
    • ❌ async-0.9.2.tgz (Vulnerable Library)

async-1.5.2.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-1.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/webpack/node_modules/async/package.json,/node_modules/superagent/node_modules/async/package.json

Dependency Hierarchy:

• superagent-1.8.5.tgz (Root Library)
  • form-data-1.0.0-rc3.tgz
    • ❌ async-1.5.2.tgz (Vulnerable Library)

async-0.2.10.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-0.2.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/webpack/node_modules/uglify-js/node_modules/async/package.json

Dependency Hierarchy:

• webpack-1.15.0.tgz (Root Library)
  • uglify-js-2.7.5.tgz
    • ❌ async-0.2.10.tgz (Vulnerable Library)

async-0.2.6.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-0.2.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Dependency Hierarchy:

• jest-cli-0.2.2.tgz (Root Library)
  • node-find-files-0.0.4.tgz
    • ❌ async-0.2.6.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (webpack): 4.0.0

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (superagent): 3.0.0

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (webpack): 4.0.0

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (jest-cli): 24.3.0

---

⛑️ Automatic Remediation is available for this issue

WS-2019-0017 (Medium) detected in clean-css-3.4.28.tgz

WS-2019-0017 - Medium Severity Vulnerability

Vulnerable Library - clean-css-3.4.28.tgz

A well-tested CSS minifier

Library home page: https://registry.npmjs.org/clean-css/-/clean-css-3.4.28.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/clean-css/package.json

Dependency Hierarchy:

• css-loader-0.12.1.tgz (Root Library)
  • ❌ clean-css-3.4.28.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2018-03-06

URL: WS-2019-0017

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wxhq-pm8v-cw75

Release Date: 2018-03-06

Fix Resolution: clean-css - 4.1.11

CVE-2022-0144 (High) detected in shelljs-0.5.3.tgz

CVE-2022-0144 - High Severity Vulnerability

Vulnerable Library - shelljs-0.5.3.tgz

Portable Unix shell commands for Node.js

Library home page: https://registry.npmjs.org/shelljs/-/shelljs-0.5.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/shelljs/package.json

Dependency Hierarchy:

• eslint-1.10.3.tgz (Root Library)
  • ❌ shelljs-0.5.3.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

shelljs is vulnerable to Improper Privilege Management

Publish Date: 2022-01-11

URL: CVE-2022-0144

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-01-11

Fix Resolution: shelljs - 0.8.5

CVE-2017-16129 (Medium) detected in superagent-1.8.5.tgz

CVE-2017-16129 - Medium Severity Vulnerability

Vulnerable Library - superagent-1.8.5.tgz

elegant & feature rich browser / node HTTP with a fluent API

Library home page: https://registry.npmjs.org/superagent/-/superagent-1.8.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/superagent/package.json

Dependency Hierarchy:

• ❌ superagent-1.8.5.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

The HTTP client module superagent is vulnerable to ZIP bomb attacks. In a ZIP bomb attack, the HTTP server replies with a compressed response that becomes several magnitudes larger once uncompressed. If a client does not take special care when processing such responses, it may result in excessive CPU and/or memory consumption. An attacker might exploit such a weakness for a DoS attack. To exploit this the attacker must control the location (URL) that superagent makes a request to.

Publish Date: 2018-06-07

URL: CVE-2017-16129

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/479/versions

Release Date: 2018-04-26

Fix Resolution: 3.7.0

---

⛑️ Automatic Remediation is available for this issue

CVE-2018-3728 (High) detected in hoek-2.16.3.tgz

CVE-2018-3728 - High Severity Vulnerability

Vulnerable Library - hoek-2.16.3.tgz

General purpose node utilities

Library home page: https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/less/node_modules/hoek/package.json

Dependency Hierarchy:

• less-2.7.3.tgz (Root Library)
  • request-2.81.0.tgz
    • hawk-3.1.3.tgz
      • ❌ hoek-2.16.3.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-03-30

URL: CVE-2018-3728

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16082

Release Date: 2018-03-30

Fix Resolution: 4.2.0,5.0.3

WS-2018-0590 (High) detected in diff-1.0.8.tgz

WS-2018-0590 - High Severity Vulnerability

Vulnerable Library - diff-1.0.8.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-1.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/diff/package.json

Dependency Hierarchy:

• jest-cli-0.2.2.tgz (Root Library)
  • ❌ diff-1.0.8.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2018-03-05

URL: WS-2018-0590

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-03-05

Fix Resolution: 3.5.0

WS-2020-0163 (Medium) detected in marked-0.3.19.tgz

WS-2020-0163 - Medium Severity Vulnerability

Vulnerable Library - marked-0.3.19.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.19.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/marked/package.json

Dependency Hierarchy:

• ❌ marked-0.3.19.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.

Publish Date: 2020-07-02

URL: WS-2020-0163

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-02

Fix Resolution: 1.1.1

---

⛑️ Automatic Remediation is available for this issue

CVE-2022-29167 (High) detected in hawk-3.1.3.tgz, hawk-6.0.2.tgz

CVE-2022-29167 - High Severity Vulnerability

Vulnerable Libraries - hawk-3.1.3.tgz, hawk-6.0.2.tgz

hawk-3.1.3.tgz

HTTP Hawk Authentication Scheme

Library home page: https://registry.npmjs.org/hawk/-/hawk-3.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/less/node_modules/hawk/package.json

Dependency Hierarchy:

• less-2.7.3.tgz (Root Library)
  • request-2.81.0.tgz
    • ❌ hawk-3.1.3.tgz (Vulnerable Library)

hawk-6.0.2.tgz

HTTP Hawk Authentication Scheme

Library home page: https://registry.npmjs.org/hawk/-/hawk-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/hawk/package.json

Dependency Hierarchy:

• changelog-1.4.2.tgz (Root Library)
  • request-2.83.0.tgz
    • ❌ hawk-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Hawk is an HTTP authentication scheme providing mechanisms for making authenticated HTTP requests with partial cryptographic verification of the request and response, covering the HTTP method, request URI, host, and optionally the request payload. Hawk used a regular expression to parse Host HTTP header (Hawk.utils.parseHost()), which was subject to regular expression DoS attack - meaning each added character in the attacker's input increases the computation time exponentially. parseHost() was patched in 9.0.1 to use built-in URL class to parse hostname instead. Hawk.authenticate() accepts options argument. If that contains host and port, those would be used instead of a call to utils.parseHost().

Publish Date: 2022-05-05

URL: CVE-2022-29167

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-44pw-h2cw-w3vq

Release Date: 2022-05-05

Fix Resolution: hawk - 9.0.1

CVE-2020-8203 (High) detected in multiple libraries

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Libraries - lodash-1.0.2.tgz, lodash-2.4.2.tgz, lodash-3.10.1.tgz, lodash-4.17.5.tgz

lodash-1.0.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/globule/node_modules/lodash/package.json

Dependency Hierarchy:

• gulp-3.9.1.tgz (Root Library)
  • vinyl-fs-0.3.14.tgz
    • glob-watcher-0.0.6.tgz
      • gaze-0.5.2.tgz
        • globule-0.1.0.tgz
          • ❌ lodash-1.0.2.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-core/node_modules/lodash/package.json,/node_modules/babel/node_modules/lodash/package.json,/node_modules/babel-plugin-proto-to-assign/node_modules/lodash/package.json,/node_modules/babel-jest/node_modules/lodash/package.json,/node_modules/inquirer/node_modules/lodash/package.json

Dependency Hierarchy:

• babel-core-5.8.38.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/changelog/node_modules/lodash/package.json

Dependency Hierarchy:

• changelog-1.4.2.tgz (Root Library)
  • ❌ lodash-4.17.5.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution: 4.17.9

---

⛑️ Automatic Remediation is available for this issue

WS-2018-0628 (Medium) detected in marked-0.3.19.tgz

WS-2018-0628 - Medium Severity Vulnerability

Vulnerable Library - marked-0.3.19.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.19.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/marked/package.json

Dependency Hierarchy:

• ❌ marked-0.3.19.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

marked before 0.4.0 is vulnerable to Regular Expression Denial of Service (REDoS) through heading in marked.js.

Publish Date: 2018-04-16

URL: WS-2018-0628

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-04-16

Fix Resolution: 0.4.0

---

⛑️ Automatic Remediation is available for this issue

CVE-2019-10744 (High) detected in multiple libraries

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Libraries - lodash.template-3.6.2.tgz, lodash-3.10.1.tgz, lodash-4.17.5.tgz, lodash.merge-3.3.2.tgz, lodash-2.4.2.tgz, lodash-1.0.2.tgz

lodash.template-3.6.2.tgz

The modern build of lodash’s `_.template` as a module.

Library home page: https://registry.npmjs.org/lodash.template/-/lodash.template-3.6.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash.template/package.json

Dependency Hierarchy:

• gulp-util-3.0.8.tgz (Root Library)
  • ❌ lodash.template-3.6.2.tgz (Vulnerable Library)

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-core/node_modules/lodash/package.json,/node_modules/babel/node_modules/lodash/package.json,/node_modules/babel-plugin-proto-to-assign/node_modules/lodash/package.json,/node_modules/babel-jest/node_modules/lodash/package.json,/node_modules/inquirer/node_modules/lodash/package.json

Dependency Hierarchy:

• babel-core-5.8.38.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/changelog/node_modules/lodash/package.json

Dependency Hierarchy:

• changelog-1.4.2.tgz (Root Library)
  • ❌ lodash-4.17.5.tgz (Vulnerable Library)

lodash.merge-3.3.2.tgz

The modern build of lodash’s `_.merge` as a module.

Library home page: https://registry.npmjs.org/lodash.merge/-/lodash.merge-3.3.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash.merge/package.json

Dependency Hierarchy:

• eslint-1.10.3.tgz (Root Library)
  • ❌ lodash.merge-3.3.2.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-1.0.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/globule/node_modules/lodash/package.json

Dependency Hierarchy:

• gulp-3.9.1.tgz (Root Library)
  • vinyl-fs-0.3.14.tgz
    • glob-watcher-0.0.6.tgz
      • gaze-0.5.2.tgz
        • globule-0.1.0.tgz
          • ❌ lodash-1.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution: 4.17.12

---

⛑️ Automatic Remediation is available for this issue

WS-2018-0347 (Medium) detected in eslint-1.10.3.tgz

WS-2018-0347 - Medium Severity Vulnerability

Vulnerable Library - eslint-1.10.3.tgz

An AST-based pattern checker for JavaScript.

Library home page: https://registry.npmjs.org/eslint/-/eslint-1.10.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/eslint/package.json

Dependency Hierarchy:

• ❌ eslint-1.10.3.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

A vulnerability was descovered in eslint before 4.18.2. One of the regexes in eslint is vulnerable to catastrophic backtracking.

Publish Date: 2018-02-27

URL: WS-2018-0347

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-02-27

Fix Resolution: 4.18.2

---

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24785 (High) detected in moment-2.20.1.tgz, moment-2.29.1.tgz

CVE-2022-24785 - High Severity Vulnerability

Vulnerable Libraries - moment-2.20.1.tgz, moment-2.29.1.tgz

moment-2.20.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.20.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/changelog/node_modules/moment/package.json

Dependency Hierarchy:

• changelog-1.4.2.tgz (Root Library)
  • ❌ moment-2.20.1.tgz (Vulnerable Library)

moment-2.29.1.tgz

Parse, validate, manipulate, and display dates

Library home page: https://registry.npmjs.org/moment/-/moment-2.29.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/moment/package.json

Dependency Hierarchy:

• ❌ moment-2.29.1.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution: 2.29.2

---

⛑️ Automatic Remediation is available for this issue

CVE-2016-10539 (High) detected in negotiator-0.5.3.tgz

CVE-2016-10539 - High Severity Vulnerability

Vulnerable Library - negotiator-0.5.3.tgz

HTTP content negotiation

Library home page: https://registry.npmjs.org/negotiator/-/negotiator-0.5.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/negotiator/package.json

Dependency Hierarchy:

• webpack-dev-server-1.16.5.tgz (Root Library)
  • compression-1.5.2.tgz
    • accepts-1.2.13.tgz
      • ❌ negotiator-0.5.3.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.

Publish Date: 2018-05-31

URL: CVE-2016-10539

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/106

Release Date: 2018-05-31

Fix Resolution: 0.6.1

WS-2019-0032 (High) detected in js-yaml-3.4.5.tgz

WS-2019-0032 - High Severity Vulnerability

Vulnerable Library - js-yaml-3.4.5.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.4.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/js-yaml/package.json

Dependency Hierarchy:

• eslint-1.10.3.tgz (Root Library)
  • ❌ js-yaml-3.4.5.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-20

URL: WS-2019-0032

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-20

Fix Resolution: js-yaml - 3.13.0

CVE-2021-35065 (High) detected in glob-parent-2.0.0.tgz - autoclosed

CVE-2021-35065 - High Severity Vulnerability

Vulnerable Library - glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

• babel-5.8.38.tgz (Root Library)
  • chokidar-1.7.0.tgz
    • ❌ glob-parent-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

The package glob-parent before 6.0.1 are vulnerable to Regular Expression Denial of Service (ReDoS)

Publish Date: 2021-06-22

URL: CVE-2021-35065

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cj88-88mr-972w

Release Date: 2021-06-22

Fix Resolution (glob-parent): 6.0.1

Direct dependency fix Resolution (babel): 6.0.0

---

⛑️ Automatic Remediation is available for this issue

CVE-2018-3721 (Medium) detected in multiple libraries

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Libraries - lodash-1.0.2.tgz, lodash-3.10.1.tgz, lodash.merge-3.3.2.tgz, lodash-2.4.2.tgz

lodash-1.0.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/globule/node_modules/lodash/package.json

Dependency Hierarchy:

• gulp-3.9.1.tgz (Root Library)
  • vinyl-fs-0.3.14.tgz
    • glob-watcher-0.0.6.tgz
      • gaze-0.5.2.tgz
        • globule-0.1.0.tgz
          • ❌ lodash-1.0.2.tgz (Vulnerable Library)

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-core/node_modules/lodash/package.json,/node_modules/babel/node_modules/lodash/package.json,/node_modules/babel-plugin-proto-to-assign/node_modules/lodash/package.json,/node_modules/babel-jest/node_modules/lodash/package.json,/node_modules/inquirer/node_modules/lodash/package.json

Dependency Hierarchy:

• babel-core-5.8.38.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

lodash.merge-3.3.2.tgz

The modern build of lodash’s `_.merge` as a module.

Library home page: https://registry.npmjs.org/lodash.merge/-/lodash.merge-3.3.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash.merge/package.json

Dependency Hierarchy:

• eslint-1.10.3.tgz (Root Library)
  • ❌ lodash.merge-3.3.2.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• ❌ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1067

Release Date: 2018-04-26

Fix Resolution: 4.17.5

---

⛑️ Automatic Remediation is available for this issue

CVE-2020-7760 (High) detected in codemirror-5.0.0.min.js, javascript-4.13.0.min.js

CVE-2020-7760 - High Severity Vulnerability

Vulnerable Libraries - codemirror-5.0.0.min.js, javascript-4.13.0.min.js

codemirror-5.0.0.min.js

In-browser code editing made bearable

Library home page: https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.0.0/codemirror.min.js

Path to dependency file: /index.html

Path to vulnerable library: /index.html

Dependency Hierarchy:

• ❌ codemirror-5.0.0.min.js (Vulnerable Library)

javascript-4.13.0.min.js

In-browser code editing made bearable

Library home page: https://cdnjs.cloudflare.com/ajax/libs/codemirror/4.13.0/mode/javascript/javascript.min.js

Path to dependency file: /index.html

Path to vulnerable library: /index.html

Dependency Hierarchy:

• ❌ javascript-4.13.0.min.js (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/.?/)

Publish Date: 2020-10-30

URL: CVE-2020-7760

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7760

Release Date: 2020-10-30

Fix Resolution: codemirror - 5.58.2

CVE-2022-21681 (High) detected in marked-0.3.19.tgz

CVE-2022-21681 - High Severity Vulnerability

Vulnerable Library - marked-0.3.19.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.19.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/marked/package.json

Dependency Hierarchy:

• ❌ marked-0.3.19.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.

Publish Date: 2022-01-14

URL: CVE-2022-21681

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5v2h-r2cx-5xgj

Release Date: 2022-01-14

Fix Resolution: 4.0.10

---

⛑️ Automatic Remediation is available for this issue

CVE-2019-5413 (High) detected in morgan-1.6.1.tgz

CVE-2019-5413 - High Severity Vulnerability

Vulnerable Library - morgan-1.6.1.tgz

HTTP request logger middleware for node.js

Library home page: https://registry.npmjs.org/morgan/-/morgan-1.6.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/morgan/package.json

Dependency Hierarchy:

• gulp-connect-2.3.1.tgz (Root Library)
  • connect-2.30.2.tgz
    • ❌ morgan-1.6.1.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

Publish Date: 2019-03-21

URL: CVE-2019-5413

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/390881

Release Date: 2019-03-21

Fix Resolution: 1.9.1

WS-2018-0589 (Low) detected in nwmatcher-1.3.9.tgz

WS-2018-0589 - Low Severity Vulnerability

Vulnerable Library - nwmatcher-1.3.9.tgz

A CSS3-compliant JavaScript selector engine.

Library home page: https://registry.npmjs.org/nwmatcher/-/nwmatcher-1.3.9.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nwmatcher/package.json

Dependency Hierarchy:

• jest-cli-0.2.2.tgz (Root Library)
  • jsdom-0.10.6.tgz
    • ❌ nwmatcher-1.3.9.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

A Regular Expression vulnerability was found in nwmatcher before 1.4.4. The fix replacing multiple repeated instances of the "\s*" pattern.

Publish Date: 2018-03-05

URL: WS-2018-0589

CVSS 3 Score Details (3.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-03-05

Fix Resolution: 1.4.4

CVE-2021-23358 (High) detected in underscore-1.6.0.tgz

CVE-2021-23358 - High Severity Vulnerability

Vulnerable Library - underscore-1.6.0.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nomnom/node_modules/underscore/package.json

Dependency Hierarchy:

• react-docgen-1.3.0.tgz (Root Library)
  • nomnom-1.8.1.tgz
    • ❌ underscore-1.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution: underscore - 1.12.1,1.13.0-2

CVE-2021-23337 (High) detected in multiple libraries

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Libraries - lodash-1.0.2.tgz, lodash-3.10.1.tgz, lodash-2.4.2.tgz, lodash-4.17.5.tgz

lodash-1.0.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/globule/node_modules/lodash/package.json

Dependency Hierarchy:

• gulp-3.9.1.tgz (Root Library)
  • vinyl-fs-0.3.14.tgz
    • glob-watcher-0.0.6.tgz
      • gaze-0.5.2.tgz
        • globule-0.1.0.tgz
          • ❌ lodash-1.0.2.tgz (Vulnerable Library)

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/babel-core/node_modules/lodash/package.json,/node_modules/babel/node_modules/lodash/package.json,/node_modules/babel-plugin-proto-to-assign/node_modules/lodash/package.json,/node_modules/babel-jest/node_modules/lodash/package.json,/node_modules/inquirer/node_modules/lodash/package.json

Dependency Hierarchy:

• babel-core-5.8.38.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

• ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-4.17.5.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/changelog/node_modules/lodash/package.json

Dependency Hierarchy:

• changelog-1.4.2.tgz (Root Library)
  • ❌ lodash-4.17.5.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2021-02-15

Fix Resolution: 4.17.21

---

⛑️ Automatic Remediation is available for this issue

CVE-2017-16138 (High) detected in mime-1.3.4.tgz, mime-1.3.6.tgz

CVE-2017-16138 - High Severity Vulnerability

Vulnerable Libraries - mime-1.3.4.tgz, mime-1.3.6.tgz

mime-1.3.4.tgz

A comprehensive library for mime-type mapping

Library home page: https://registry.npmjs.org/mime/-/mime-1.3.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/send/node_modules/mime/package.json,/node_modules/superagent/node_modules/mime/package.json

Dependency Hierarchy:

• superagent-1.8.5.tgz (Root Library)
  • ❌ mime-1.3.4.tgz (Vulnerable Library)

mime-1.3.6.tgz

A comprehensive library for mime-type mapping

Library home page: https://registry.npmjs.org/mime/-/mime-1.3.6.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-loader/node_modules/mime/package.json

Dependency Hierarchy:

• component-playground-1.0.3.tgz (Root Library)
  • url-loader-0.5.9.tgz
    • ❌ mime-1.3.6.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

Publish Date: 2018-06-07

URL: CVE-2017-16138

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138

Release Date: 2018-06-07

Fix Resolution: 1.4.1,2.0.3

CVE-2017-16119 (High) detected in fresh-0.3.0.tgz

CVE-2017-16119 - High Severity Vulnerability

Vulnerable Library - fresh-0.3.0.tgz

HTTP response freshness testing

Library home page: https://registry.npmjs.org/fresh/-/fresh-0.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/fresh/package.json

Dependency Hierarchy:

• gulp-connect-2.3.1.tgz (Root Library)
  • connect-2.30.2.tgz
    • ❌ fresh-0.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Publish Date: 2018-06-07

URL: CVE-2017-16119

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/526

Release Date: 2018-06-07

Fix Resolution: fresh - 0.5.2

CVE-2020-15366 (Medium) detected in ajv-4.11.8.tgz, ajv-5.5.2.tgz

CVE-2020-15366 - Medium Severity Vulnerability

Vulnerable Libraries - ajv-4.11.8.tgz, ajv-5.5.2.tgz

ajv-4.11.8.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-4.11.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/less/node_modules/ajv/package.json

Dependency Hierarchy:

• less-2.7.3.tgz (Root Library)
  • request-2.81.0.tgz
    • har-validator-4.2.1.tgz
      • ❌ ajv-4.11.8.tgz (Vulnerable Library)

ajv-5.5.2.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-5.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ajv/package.json

Dependency Hierarchy:

• changelog-1.4.2.tgz (Root Library)
  • request-2.83.0.tgz
    • har-validator-5.0.3.tgz
      • ❌ ajv-5.5.2.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-15

Fix Resolution: ajv - 6.12.3

CVE-2020-28469 (High) detected in glob-parent-2.0.0.tgz

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Library - glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

• babel-5.8.38.tgz (Root Library)
  • chokidar-1.7.0.tgz
    • ❌ glob-parent-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (babel): 6.0.0

---

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0512 (Medium) detected in url-parse-1.5.4.tgz

CVE-2022-0512 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.5.4.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

• webpack-dev-server-1.16.5.tgz (Root Library)
  • sockjs-client-1.5.2.tgz
    • ❌ url-parse-1.5.4.tgz (Vulnerable Library)

Found in HEAD commit: 56ff85f974b05cab00c2299011cfbdf611dd773d

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

Publish Date: 2022-02-14

URL: CVE-2022-0512

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0512

Release Date: 2022-02-14

Fix Resolution (url-parse): 1.5.6

Direct dependency fix Resolution (webpack-dev-server): 2.2.0

---

⛑️ Automatic Remediation is available for this issue