hlmtre/qdb

hlmtre

I am a tiny part of the universe experiencing itself.

I am currently the network administrator for Northern Valley Indian Health, a series of healthcare clinics in Northern California. I do a lot of networking, but also manage all of our Linux infrastructure, using saltstack for automation. In my spare time (which is a rarity with a tiny human), I play guitar and competitive FPSes with old friends. We are not very good. Occasionally I have the brain energy to program, making my own little projects and sometimes contributing to existing open source projects.

I live in Calfornia with my wife and tiny human and three cats.

Projects

• pybot (@hlmtre/pybot) A python IRC bot I started all the way back in 2012, to learn python and the IRC protocol. Development has slowed but believe it or not still happens.
• homemaker (@hlmtre/homemaker) Slightly more than yet another dotfile manager, written in Rust.

You can contact me via email or on irc (irc.zero9f9.com), probably in #fg.

qdb's Issues

CVE-2020-7656 (Medium) detected in jquery-1.8.3.min.js - autoclosed

CVE-2020-7656 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.3.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.min.js

Path to vulnerable library: /jquery-1.8.3.min.js

Dependency Hierarchy:

• ❌ jquery-1.8.3.min.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Publish Date: 2020-05-19

URL: CVE-2020-7656

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q4m3-2j7h-f7xw

Release Date: 2020-05-28

Fix Resolution: jquery - 1.9.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-4.3.0.js - autoclosed

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.3.0.js

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.3.0/lodash.js

Path to vulnerable library: /lodash.js

Dependency Hierarchy:

• ❌ lodash-4.3.0.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11

---

Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-4.3.0.js - autoclosed

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.3.0.js

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.3.0/lodash.js

Path to vulnerable library: /lodash.js

Dependency Hierarchy:

• ❌ lodash-4.3.0.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-8203 (High) detected in lodash-4.3.0.js - autoclosed

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-4.3.0.js

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.3.0/lodash.js

Path to vulnerable library: /lodash.js

Dependency Hierarchy:

• ❌ lodash-4.3.0.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-10-21

Fix Resolution: lodash - 4.17.19

---

Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in lodash-4.3.0.js - autoclosed

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Library - lodash-4.3.0.js

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.3.0/lodash.js

Path to vulnerable library: /lodash.js

Dependency Hierarchy:

• ❌ lodash-4.3.0.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2015-9251 (Medium) detected in jquery-1.8.3.min.js - autoclosed

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.3.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.min.js

Path to vulnerable library: /jquery-1.8.3.min.js

Dependency Hierarchy:

• ❌ jquery-1.8.3.min.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-28500 (Medium) detected in lodash-4.3.0.js - autoclosed

CVE-2020-28500 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.3.0.js

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.3.0/lodash.js

Path to vulnerable library: /lodash.js

Dependency Hierarchy:

• ❌ lodash-4.3.0.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution: lodash-4.17.21

---

Step up your Open Source Security Game with WhiteSource here

CVE-2012-6708 (Medium) detected in jquery-1.8.3.min.js - autoclosed

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.3.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.min.js

Path to vulnerable library: /jquery-1.8.3.min.js

Dependency Hierarchy:

• ❌ jquery-1.8.3.min.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-4.3.0.js - autoclosed

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-4.3.0.js

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.3.0/lodash.js

Path to vulnerable library: /lodash.js

Dependency Hierarchy:

• ❌ lodash-4.3.0.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-11022 (Medium) detected in jquery-1.8.3.min.js - autoclosed

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.3.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.min.js

Path to vulnerable library: /jquery-1.8.3.min.js

Dependency Hierarchy:

• ❌ jquery-1.8.3.min.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2016-7103 (Medium) detected in candidatsCandidATS210-Stable - autoclosed

CVE-2016-7103 - Medium Severity Vulnerability

Vulnerable Library - candidatsCandidATS210-Stable

Continuation of CATS

Library home page: https://sourceforge.net/projects/candidats/

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerable Source Files (1)

/jquery-ui.js

Vulnerability Details

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

Publish Date: 2017-03-15

URL: CVE-2016-7103

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2016-7103

Release Date: 2017-03-15

Fix Resolution: 1.12.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-4.3.0.js - autoclosed

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.3.0.js

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/lodash.js/4.3.0/lodash.js

Path to vulnerable library: /lodash.js

Dependency Hierarchy:

• ❌ lodash-4.3.0.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-11023 (Medium) detected in jquery-1.8.3.min.js - autoclosed

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.3.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.3/jquery.min.js

Path to vulnerable library: /jquery-1.8.3.min.js

Dependency Hierarchy:

• ❌ jquery-1.8.3.min.js (Vulnerable Library)

Found in HEAD commit: e385c8b851ce6874e4c2825b7a357cd9008375e9

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

---

Step up your Open Source Security Game with WhiteSource here