ioana-nicolae/first

first's Issues

CVE-2019-14540 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2019-14540 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

Publish Date: 2019-09-15

URL: CVE-2019-14540

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14540

Release Date: 2019-09-15

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.5,2.9.10,2.10.0.pr3,2.11.0.rc1

WS-2017-0247 (High) detected in ms-0.7.1.tgz, ms-0.7.2.tgz - autoclosed

WS-2017-0247 - High Severity Vulnerability

Vulnerable Libraries - ms-0.7.1.tgz, ms-0.7.2.tgz

ms-0.7.1.tgz

Tiny ms conversion utility

Library home page: https://registry.npmjs.org/ms/-/ms-0.7.1.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/ms/package.json

Dependency Hierarchy:

• serve-index-1.8.0.tgz (Root Library)
  • debug-2.2.0.tgz
    • ❌ ms-0.7.1.tgz (Vulnerable Library)

ms-0.7.2.tgz

Tiny milisecond conversion utility

Library home page: https://registry.npmjs.org/ms/-/ms-0.7.2.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/ms/package.json

Dependency Hierarchy:

• serve-favicon-2.3.2.tgz (Root Library)
  • ❌ ms-0.7.2.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS).

Publish Date: 2017-04-12

URL: WS-2017-0247

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: vercel/ms#89

Release Date: 2017-04-12

Fix Resolution: 2.1.1

CVE-2014-10064 (High) detected in qs-0.1.0.tgz - autoclosed

CVE-2014-10064 - High Severity Vulnerability

Vulnerable Library - qs-0.1.0.tgz

querystring parser

Library home page: https://registry.npmjs.org/qs/-/qs-0.1.0.tgz

Path to dependency file: first/angular.js-master/angular.js-master/yarn.lock

Path to vulnerable library: first/angular.js-master/angular.js-master/yarn.lock

Dependency Hierarchy:

• angular-benchpress-0.2.2.tgz (Root Library)
  • di-2.0.0-pre-9.tgz
    • traceur-0.0.33.tgz
      • q-io-1.10.9.tgz
        • ❌ qs-0.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.

Publish Date: 2018-05-31

URL: CVE-2014-10064

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/28

Release Date: 2014-08-06

Fix Resolution: Update to version 1.0.0 or later

CVE-2020-9548 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-9548 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to br.com.anteros.dbcp.AnterosDBCPConfig (aka anteros-core).

Publish Date: 2020-03-02

URL: CVE-2020-9548

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9548

Release Date: 2020-03-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.7.9.7,2.8.11.6,2.9.10.4

CVE-2019-14893 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2019-14893 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

A flaw was discovered in FasterXML jackson-databind in all versions before 2.9.10 and 2.10.0, where it would permit polymorphic deserialization of malicious objects using the xalan JNDI gadget when used in conjunction with polymorphic type handling methods such as enableDefaultTyping() or when @JsonTypeInfo is using Id.CLASS or Id.MINIMAL_CLASS or in any other way which ObjectMapper.readValue might instantiate objects from unsafe sources. An attacker could use this flaw to execute arbitrary code.

Publish Date: 2020-03-02

URL: CVE-2019-14893

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14893

Release Date: 2020-03-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.0

CVE-2020-14061 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-14061 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oracle.jms.AQjmsQueueConnectionFactory, oracle.jms.AQjmsXATopicConnectionFactory, oracle.jms.AQjmsTopicConnectionFactory, oracle.jms.AQjmsXAQueueConnectionFactory, and oracle.jms.AQjmsXAConnectionFactory (aka weblogic/oracle-aqjms).

Publish Date: 2020-06-14

URL: CVE-2020-14061

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14061

Release Date: 2020-06-14

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.0

CVE-2020-9547 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-9547 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.ibatis.sqlmap.engine.transaction.jta.JtaTransactionConfig (aka ibatis-sqlmap).

Publish Date: 2020-03-02

URL: CVE-2020-9547

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9547

Release Date: 2020-03-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.3

CVE-2018-20676 (Medium) detected in bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz - autoclosed

CVE-2018-20676 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz

bootstrap-3.3.7.tgz

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.3.7.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/bootstrap/package.json

Dependency Hierarchy:

• angular-benchpress-0.2.2.tgz (Root Library)
  • ❌ bootstrap-3.3.7.tgz (Vulnerable Library)

bootstrap-3.1.1.tgz

Sleek, intuitive, and powerful front-end framework for faster and easier web development.

Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.1.1.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: /angular.js-master/angular.js-master/node_modules/bootstrap/package.json

Dependency Hierarchy:

• ❌ bootstrap-3.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

Publish Date: 2019-01-09

URL: CVE-2018-20676

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20676

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0

WS-2018-0628 (Medium) detected in marked-0.3.6.tgz - autoclosed

WS-2018-0628 - Medium Severity Vulnerability

Vulnerable Library - marked-0.3.6.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.6.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: /angular.js-master/angular.js-master/node_modules/marked/package.json

Dependency Hierarchy:

• ❌ marked-0.3.6.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

marked before 0.4.0 is vulnerable to Regular Expression Denial of Service (REDoS) through heading in marked.js.

Publish Date: 2018-04-16

URL: WS-2018-0628

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/markedjs/marked/releases/tag/0.4.0

Release Date: 2018-04-16

Fix Resolution: marked - 0.4.0

---

⛑️ Automatic Remediation is available for this issue

CVE-2019-10746 (High) detected in mixin-deep-1.3.1.tgz - autoclosed

CVE-2019-10746 - High Severity Vulnerability

Vulnerable Library - mixin-deep-1.3.1.tgz

Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.

Library home page: https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz

Path to dependency file: first/angular.js-master/angular.js-master/yarn.lock

Path to vulnerable library: first/angular.js-master/angular.js-master/yarn.lock

Dependency Hierarchy:

• changez-angular-2.1.3.tgz (Root Library)
  • changez-2.1.2.tgz
    • nunjucks-3.2.0.tgz
      • chokidar-2.0.3.tgz
        • anymatch-2.0.0.tgz
          • micromatch-3.1.10.tgz
            • extglob-2.0.4.tgz
              • expand-brackets-2.1.4.tgz
                • snapdragon-0.8.2.tgz
                  • base-0.11.2.tgz
                  • ❌ mixin-deep-1.3.1.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-08-23

URL: CVE-2019-10746

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jonschlinkert/mixin-deep@8f464c8

Release Date: 2019-07-11

Fix Resolution: 1.3.2,2.0.1

CVE-2019-8331 (Medium) detected in bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz - autoclosed

CVE-2019-8331 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz

bootstrap-3.3.7.tgz

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.3.7.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/bootstrap/package.json

Dependency Hierarchy:

• angular-benchpress-0.2.2.tgz (Root Library)
  • ❌ bootstrap-3.3.7.tgz (Vulnerable Library)

bootstrap-3.1.1.tgz

Sleek, intuitive, and powerful front-end framework for faster and easier web development.

Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.1.1.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: /angular.js-master/angular.js-master/node_modules/bootstrap/package.json

Dependency Hierarchy:

• ❌ bootstrap-3.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Publish Date: 2019-02-20

URL: CVE-2019-8331

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#28236

Release Date: 2019-02-20

Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1

CVE-2020-14060 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-14060 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to oadd.org.apache.xalan.lib.sql.JNDIConnectionPool (aka apache/drill).

Publish Date: 2020-06-14

URL: CVE-2020-14060

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14060

Release Date: 2020-06-14

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.0

CVE-2018-16469 (High) detected in merge-1.2.0.tgz - autoclosed

CVE-2018-16469 - High Severity Vulnerability

Vulnerable Library - merge-1.2.0.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

Library home page: https://registry.npmjs.org/merge/-/merge-1.2.0.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/merge/package.json

Dependency Hierarchy:

• commitizen-2.9.5.tgz (Root Library)
  • find-node-modules-1.0.4.tgz
    • ❌ merge-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.

Publish Date: 2018-10-30

URL: CVE-2018-16469

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16469

Release Date: 2018-10-30

Fix Resolution: v1.2.1

WS-2018-0590 (High) detected in diff-1.4.0.tgz - autoclosed

WS-2018-0590 - High Severity Vulnerability

Vulnerable Library - diff-1.4.0.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-1.4.0.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/diff/package.json

Dependency Hierarchy:

• promises-aplus-tests-2.1.2.tgz (Root Library)
  • mocha-2.5.3.tgz
    • ❌ diff-1.4.0.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2018-03-05

URL: WS-2018-0590

CVSS 3 Score Details (7.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: kpdecker/jsdiff@2aec429

Release Date: 2018-03-05

Fix Resolution: 3.5.0

CVE-2020-11112 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-11112 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.proxy.provider.remoting.RmiProvider (aka apache/commons-proxy).

Publish Date: 2020-03-31

URL: CVE-2020-11112

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11112

Release Date: 2020-03-31

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.4,2.10.0

CVE-2020-8203 (High) detected in multiple libraries - autoclosed

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Libraries - lodash-4.3.0.tgz, lodash-1.0.2.tgz, lodash-2.4.2.tgz, lodash-4.17.2.tgz, lodash-3.10.1.tgz

lodash-4.3.0.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.3.0.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-1.0.1.tgz (Root Library)
  • grunt-legacy-util-1.0.0.tgz
    • ❌ lodash-4.3.0.tgz (Vulnerable Library)

lodash-1.0.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-1.0.2.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/lodash/package.json

Dependency Hierarchy:

• jasmine-node-2.0.0.tgz (Root Library)
  • gaze-0.5.2.tgz
    • globule-0.1.0.tgz
      • ❌ lodash-1.0.2.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/lodash/package.json

Dependency Hierarchy:

• cheerio-0.17.0.tgz (Root Library)
  • ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-4.17.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/lodash/package.json

Dependency Hierarchy:

• commitizen-2.9.5.tgz (Root Library)
  • ❌ lodash-4.17.2.tgz (Vulnerable Library)

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/lodash/package.json

Dependency Hierarchy:

• dgeni-0.4.9.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution: lodash - 4.17.19

CVE-2020-10672 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-10672 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.aries.transaction.jms.internal.XaPooledConnectionFactory (aka aries.transaction.jms).

Publish Date: 2020-03-18

URL: CVE-2020-10672

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-10672

Release Date: 2020-03-18

Fix Resolution: jackson-databind-2.9.10.4

WS-2018-0625 (High) detected in xmlbuilder-4.2.1.tgz - autoclosed

WS-2018-0625 - High Severity Vulnerability

Vulnerable Library - xmlbuilder-4.2.1.tgz

An XML builder for node.js

Library home page: https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-4.2.1.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/xmlbuilder/package.json

Dependency Hierarchy:

• selenium-webdriver-4.0.0-alpha.1.tgz (Root Library)
  • xml2js-0.4.17.tgz
    • ❌ xmlbuilder-4.2.1.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

The package xmlbuilder-js before 9.0.5 is vulnerable to denial of service due to a regular expression issue.

Publish Date: 2018-02-08

URL: WS-2018-0625

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: oozcitak/xmlbuilder-js@bbf929a

Release Date: 2018-02-08

Fix Resolution: 9.0.5

CVE-2017-16138 (High) detected in mime-1.3.4.tgz - autoclosed

CVE-2017-16138 - High Severity Vulnerability

Vulnerable Library - mime-1.3.4.tgz

A comprehensive library for mime-type mapping

Library home page: https://registry.npmjs.org/mime/-/mime-1.3.4.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/mime/package.json

Dependency Hierarchy:

• q-io-1.13.2.tgz (Root Library)
  • ❌ mime-1.3.4.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

Publish Date: 2018-06-07

URL: CVE-2017-16138

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138

Release Date: 2018-06-07

Fix Resolution: 1.4.1,2.0.3

CVE-2017-16024 (Medium) detected in sync-exec-0.6.2.tgz - autoclosed

CVE-2017-16024 - Medium Severity Vulnerability

Vulnerable Library - sync-exec-0.6.2.tgz

Synchronous exec with status code support. Requires no external dependencies, no need for node-gyp compilations etc.

Library home page: https://registry.npmjs.org/sync-exec/-/sync-exec-0.6.2.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/sync-exec/package.json

Dependency Hierarchy:

• npm-run-4.1.0.tgz (Root Library)
  • ❌ sync-exec-0.6.2.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

The sync-exec module is used to simulate child_process.execSync in node versions <0.11.9. Sync-exec uses tmp directories as a buffer before returning values. Other users on the server have read access to the tmp directory, possibly allowing an attacker on the server to obtain confidential information from the buffer/tmp file, while it exists.

Publish Date: 2018-06-04

URL: CVE-2017-16024

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/310

Release Date: 2017-04-14

Fix Resolution: There is currently no direct patch for `sync-exec`, as the `child_process.execSync` function provided in Node.js v0.12.0 and later provides the same functionality natively.

The best mitigation currently is to update to Node.js v0.12.0 or later, and migrate all uses of sync-exec to child_process.execSync().

CVE-2019-10744 (High) detected in multiple libraries - autoclosed

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Libraries - lodash-4.3.0.tgz, lodash-1.0.2.tgz, lodash.template-3.6.2.tgz, lodash-2.4.2.tgz, lodash-4.17.2.tgz, lodash-3.10.1.tgz

lodash-4.3.0.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.3.0.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/lodash/package.json

Dependency Hierarchy:

• grunt-1.0.1.tgz (Root Library)
  • grunt-legacy-util-1.0.0.tgz
    • ❌ lodash-4.3.0.tgz (Vulnerable Library)

lodash-1.0.2.tgz

A utility library delivering consistency, customization, performance, and extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-1.0.2.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/lodash/package.json

Dependency Hierarchy:

• jasmine-node-2.0.0.tgz (Root Library)
  • gaze-0.5.2.tgz
    • globule-0.1.0.tgz
      • ❌ lodash-1.0.2.tgz (Vulnerable Library)

lodash.template-3.6.2.tgz

The modern build of lodash’s `_.template` as a module.

Library home page: https://registry.npmjs.org/lodash.template/-/lodash.template-3.6.2.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/lodash.template/package.json

Dependency Hierarchy:

• gulp-util-3.0.8.tgz (Root Library)
  • ❌ lodash.template-3.6.2.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/lodash/package.json

Dependency Hierarchy:

• cheerio-0.17.0.tgz (Root Library)
  • ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-4.17.2.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.2.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/lodash/package.json

Dependency Hierarchy:

• commitizen-2.9.5.tgz (Root Library)
  • ❌ lodash-4.17.2.tgz (Vulnerable Library)

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/lodash/package.json

Dependency Hierarchy:

• dgeni-0.4.9.tgz (Root Library)
  • ❌ lodash-3.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0

CVE-2019-10747 (High) detected in set-value-2.0.0.tgz, set-value-0.4.3.tgz - autoclosed

CVE-2019-10747 - High Severity Vulnerability

Vulnerable Libraries - set-value-2.0.0.tgz, set-value-0.4.3.tgz

set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: first/angular.js-master/angular.js-master/yarn.lock

Path to vulnerable library: first/angular.js-master/angular.js-master/yarn.lock

Dependency Hierarchy:

• changez-angular-2.1.3.tgz (Root Library)
  • changez-2.1.2.tgz
    • nunjucks-3.2.0.tgz
      • chokidar-2.0.3.tgz
        • anymatch-2.0.0.tgz
          • micromatch-3.1.10.tgz
            • extglob-2.0.4.tgz
              • expand-brackets-2.1.4.tgz
                • snapdragon-0.8.2.tgz
                  • base-0.11.2.tgz
                  • cache-base-1.0.1.tgz
                  • ❌ set-value-2.0.0.tgz (Vulnerable Library)

set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: first/angular.js-master/angular.js-master/yarn.lock

Path to vulnerable library: first/angular.js-master/angular.js-master/yarn.lock

Dependency Hierarchy:

• changez-angular-2.1.3.tgz (Root Library)
  • changez-2.1.2.tgz
    • nunjucks-3.2.0.tgz
      • chokidar-2.0.3.tgz
        • anymatch-2.0.0.tgz
          • micromatch-3.1.10.tgz
            • extglob-2.0.4.tgz
              • expand-brackets-2.1.4.tgz
                • snapdragon-0.8.2.tgz
                  • base-0.11.2.tgz
                  • cache-base-1.0.1.tgz
                  • union-value-1.0.0.tgz
                  • ❌ set-value-0.4.3.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Publish Date: 2019-08-23

URL: CVE-2019-10747

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jonschlinkert/set-value@95e9d99

Release Date: 2019-07-24

Fix Resolution: 2.0.1,3.0.1

CVE-2019-17531 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2019-17531 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

Publish Date: 2019-10-12

URL: CVE-2019-17531

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17531

Release Date: 2019-10-12

Fix Resolution: 2.10

CVE-2017-16118 (High) detected in forwarded-0.1.0.tgz - autoclosed

CVE-2017-16118 - High Severity Vulnerability

Vulnerable Library - forwarded-0.1.0.tgz

Parse HTTP X-Forwarded-For header

Library home page: https://registry.npmjs.org/forwarded/-/forwarded-0.1.0.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/forwarded/package.json

Dependency Hierarchy:

• angular-benchpress-0.2.2.tgz (Root Library)
  • express-4.14.1.tgz
    • proxy-addr-1.1.3.tgz
      • ❌ forwarded-0.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

The forwarded module is used by the Express.js framework to handle the X-Forwarded-For header. It is vulnerable to a regular expression denial of service when it's passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Publish Date: 2018-06-07

URL: CVE-2017-16118

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/527/versions

Release Date: 2018-06-07

Fix Resolution: 0.1.2

CVE-2019-10202 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2019-10202 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

A series of deserialization vulnerabilities have been discovered in Codehaus 1.9.x implemented in EAP 7. This CVE fixes CVE-2017-17485, CVE-2017-7525, CVE-2017-15095, CVE-2018-5968, CVE-2018-7489, CVE-2018-1000873, CVE-2019-12086 reported for FasterXML jackson-databind by implementing a whitelist approach that will mitigate these vulnerabilities and future ones alike.

Publish Date: 2019-10-01

URL: CVE-2019-10202

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://access.redhat.com/errata/RHSA-2019:2938

Release Date: 2019-10-01

Fix Resolution: JBoss Enterprise Application Platform - 7.2.4;com.fasterxml.jackson.core:jackson-databind:2.9.9

WS-2019-0379 (Medium) detected in commons-codec-1.11.jar - autoclosed

WS-2019-0379 - Medium Severity Vulnerability

Vulnerable Library - commons-codec-1.11.jar

The Apache Commons Codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/commons-codec/commons-codec/1.11/commons-codec-1.11.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • httpclient-4.5.9.jar
      • ❌ commons-codec-1.11.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2019-05-20

URL: WS-2019-0379

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: apache/commons-codec@48b6157

Release Date: 2019-05-12

Fix Resolution: 1.13-RC1

WS-2018-0075 (Medium) detected in concat-stream-1.4.10.tgz - autoclosed

WS-2018-0075 - Medium Severity Vulnerability

Vulnerable Library - concat-stream-1.4.10.tgz

writable stream that concatenates strings or binary data and calls a callback with the result

Library home page: https://registry.npmjs.org/concat-stream/-/concat-stream-1.4.10.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/concat-stream/package.json

Dependency Hierarchy:

• grunt-eslint-19.0.0.tgz (Root Library)
  • eslint-3.15.0.tgz
    • ❌ concat-stream-1.4.10.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

Versions of concat-stream before 1.5.2 are vulnerable to memory exposure if userp provided input is passed into write()

Versions <1.3.0 are not affected due to not using unguarded Buffer constructor.

Publish Date: 2018-04-25

URL: WS-2018-0075

CVSS 3 Score Details (5.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/597

Release Date: 2018-01-27

Fix Resolution: 1.5.2

CVE-2017-16137 (Medium) detected in debug-2.6.0.tgz, debug-2.2.0.tgz - autoclosed

CVE-2017-16137 - Medium Severity Vulnerability

Vulnerable Libraries - debug-2.6.0.tgz, debug-2.2.0.tgz

debug-2.6.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-2.6.0.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/debug/package.json

Dependency Hierarchy:

• grunt-contrib-connect-1.0.2.tgz (Root Library)
  • morgan-1.8.0.tgz
    • ❌ debug-2.6.0.tgz (Vulnerable Library)

debug-2.2.0.tgz

small debugging utility

Library home page: https://registry.npmjs.org/debug/-/debug-2.2.0.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/debug/package.json

Dependency Hierarchy:

• serve-index-1.8.0.tgz (Root Library)
  • ❌ debug-2.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-16137

Release Date: 2018-06-07

Fix Resolution: 2.6.9

CVE-2019-17267 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2019-17267 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Publish Date: 2019-10-07

URL: CVE-2019-17267

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2460

Release Date: 2019-10-07

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.5,2.9.10

CVE-2020-15168 (Medium) detected in node-fetch-2.6.0.tgz - autoclosed

CVE-2020-15168 - Medium Severity Vulnerability

Vulnerable Library - node-fetch-2.6.0.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.0.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/node-fetch/package.json,first_depth_0/angular.js-master/angular.js-master/scripts/docs.angularjs.org-firebase/functions/node_modules/node-fetch/package.json

Dependency Hierarchy:

• firebase-admin-8.12.1.tgz (Root Library)
  • storage-4.7.0.tgz
    • gaxios-3.0.3.tgz
      • ❌ node-fetch-2.6.0.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

Publish Date: 2020-09-10

URL: CVE-2020-15168

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w7rc-rwvf-8q5r

Release Date: 2020-09-17

Fix Resolution: 2.6.1,3.0.0-beta.9

CVE-2020-14062 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-14062 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.5 mishandles the interaction between serialization gadgets and typing, related to com.sun.org.apache.xalan.internal.lib.sql.JNDIConnectionPool (aka xalan2).

Publish Date: 2020-06-14

URL: CVE-2020-14062

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14062

Release Date: 2020-06-14

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.0

CVE-2018-20677 (Medium) detected in bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz - autoclosed

CVE-2018-20677 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz

bootstrap-3.3.7.tgz

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.3.7.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/bootstrap/package.json

Dependency Hierarchy:

• angular-benchpress-0.2.2.tgz (Root Library)
  • ❌ bootstrap-3.3.7.tgz (Vulnerable Library)

bootstrap-3.1.1.tgz

Sleek, intuitive, and powerful front-end framework for faster and easier web development.

Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.1.1.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: /angular.js-master/angular.js-master/node_modules/bootstrap/package.json

Dependency Hierarchy:

• ❌ bootstrap-3.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Publish Date: 2019-01-09

URL: CVE-2018-20677

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677

Release Date: 2019-01-09

Fix Resolution: Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0

CVE-2018-14040 (Medium) detected in bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz - autoclosed

CVE-2018-14040 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz

bootstrap-3.3.7.tgz

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.3.7.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/bootstrap/package.json

Dependency Hierarchy:

• angular-benchpress-0.2.2.tgz (Root Library)
  • ❌ bootstrap-3.3.7.tgz (Vulnerable Library)

bootstrap-3.1.1.tgz

Sleek, intuitive, and powerful front-end framework for faster and easier web development.

Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.1.1.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: /angular.js-master/angular.js-master/node_modules/bootstrap/package.json

Dependency Hierarchy:

• ❌ bootstrap-3.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Publish Date: 2018-07-13

URL: CVE-2018-14040

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#26630

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0

CVE-2020-10673 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-10673 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to com.caucho.config.types.ResourceRef (aka caucho-quercus).

Publish Date: 2020-03-18

URL: CVE-2020-10673

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2660

Release Date: 2020-03-18

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.4

CVE-2018-14042 (Medium) detected in bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz - autoclosed

CVE-2018-14042 - Medium Severity Vulnerability

Vulnerable Libraries - bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz

bootstrap-3.3.7.tgz

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.3.7.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/bootstrap/package.json

Dependency Hierarchy:

• angular-benchpress-0.2.2.tgz (Root Library)
  • ❌ bootstrap-3.3.7.tgz (Vulnerable Library)

bootstrap-3.1.1.tgz

Sleek, intuitive, and powerful front-end framework for faster and easier web development.

Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.1.1.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: /angular.js-master/angular.js-master/node_modules/bootstrap/package.json

Dependency Hierarchy:

• ❌ bootstrap-3.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Publish Date: 2018-07-13

URL: CVE-2018-14042

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: twbs/bootstrap#26630

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0

CVE-2020-11113 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-11113 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.openjpa.ee.WASRegistryManagedRuntime (aka openjpa).

Publish Date: 2020-03-31

URL: CVE-2020-11113

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113

Release Date: 2020-03-31

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.4;2.10.0

WS-2018-0124 (Medium) detected in jackson-core-2.6.7.jar - autoclosed

WS-2018-0124 - Medium Severity Vulnerability

Vulnerable Library - jackson-core-2.6.7.jar

Core Jackson abstractions, basic JSON streaming API implementation

Library home page: https://github.com/FasterXML/jackson-core

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.6.7/jackson-core-2.6.7.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • jackson-databind-2.6.7.3.jar
      • ❌ jackson-core-2.6.7.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

In Jackson Core before version 2.8.6 if the REST endpoint consumes POST requests with JSON or XML data and data are invalid, the first unrecognized token is printed to server.log. If the first token is word of length 10MB, the whole word is printed. This is potentially dangerous and can be used to attack the server by filling the disk with logs.

Publish Date: 2018-06-24

URL: WS-2018-0124

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=WS-2018-0124

Release Date: 2018-01-24

Fix Resolution: 2.8.6

CVE-2020-8840 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-8840 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Publish Date: 2020-02-10

URL: CVE-2020-8840

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2620

Release Date: 2020-02-10

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.3

CVE-2020-11620 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-11620 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.commons.jelly.impl.Embedded (aka commons-jelly).

Publish Date: 2020-04-07

URL: CVE-2020-11620

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11620

Release Date: 2020-04-07

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.4

WS-2018-0232 (Medium) detected in underscore.string-3.2.3.tgz - autoclosed

WS-2018-0232 - Medium Severity Vulnerability

Vulnerable Library - underscore.string-3.2.3.tgz

String manipulation extensions for Underscore.js javascript library.

Library home page: https://registry.npmjs.org/underscore.string/-/underscore.string-3.2.3.tgz

Path to dependency file: first/angular.js-master/angular.js-master/yarn.lock

Path to vulnerable library: first/angular.js-master/angular.js-master/yarn.lock

Dependency Hierarchy:

• grunt-1.0.1.tgz (Root Library)
  • grunt-legacy-log-1.0.0.tgz
    • ❌ underscore.string-3.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

Underscore.string, before 3.3.5, is vulnerable to Regular Expression Denial of Service (ReDoS).

Publish Date: 2018-10-03

URL: WS-2018-0232

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/745

Release Date: 2018-12-30

Fix Resolution: 3.3.5

CVE-2019-20149 (High) detected in kind-of-6.0.2.tgz - autoclosed

CVE-2019-20149 - High Severity Vulnerability

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/kind-of/package.json

Dependency Hierarchy:

• dgeni-packages-0.26.5.tgz (Root Library)
  • nunjucks-3.2.0.tgz
    • chokidar-2.0.3.tgz
      • anymatch-2.0.0.tgz
        • micromatch-3.1.10.tgz
          • ❌ kind-of-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149

Release Date: 2020-08-24

Fix Resolution: 6.0.3

CVE-2020-9546 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-9546 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.hadoop.shaded.com.zaxxer.hikari.HikariConfig (aka shaded hikari-config).

Publish Date: 2020-03-02

URL: CVE-2020-9546

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9546

Release Date: 2020-03-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.10.3

WS-2018-0125 (Medium) detected in jackson-core-2.6.7.jar - autoclosed

WS-2018-0125 - Medium Severity Vulnerability

Vulnerable Library - jackson-core-2.6.7.jar

Core Jackson abstractions, basic JSON streaming API implementation

Library home page: https://github.com/FasterXML/jackson-core

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-core/2.6.7/jackson-core-2.6.7.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • jackson-databind-2.6.7.3.jar
      • ❌ jackson-core-2.6.7.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

OutOfMemoryError when writing BigDecimal In Jackson Core before version 2.7.7.
When enabled the WRITE_BIGDECIMAL_AS_PLAIN setting, Jackson will attempt to write out the whole number, no matter how large the exponent.

Publish Date: 2016-08-25

URL: WS-2018-0125

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/FasterXML/jackson-core/releases/tag/jackson-core-2.7.7

Release Date: 2016-08-25

Fix Resolution: com.fasterxml.jackson.core:jackson-core:2.7.7

CVE-2017-16099 (High) detected in no-case-2.3.1.tgz - autoclosed

CVE-2017-16099 - High Severity Vulnerability

Vulnerable Library - no-case-2.3.1.tgz

Remove case from a string

Library home page: https://registry.npmjs.org/no-case/-/no-case-2.3.1.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/no-case/package.json

Dependency Hierarchy:

• dgeni-packages-0.26.5.tgz (Root Library)
  • change-case-3.0.0.tgz
    • ❌ no-case-2.3.1.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

The no-case module is vulnerable to regular expression denial of service. When malicious untrusted user input is passed into no-case it can block the event loop causing a denial of service condition.

Publish Date: 2018-06-07

URL: CVE-2017-16099

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/529/versions

Release Date: 2018-06-07

Fix Resolution: 2.3.2

CVE-2020-11111 (High) detected in jackson-databind-2.6.7.3.jar - autoclosed

CVE-2020-11111 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.6.7.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: first/pom.xml

Path to vulnerable library: /home/wss-scanner/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.6.7.3/jackson-databind-2.6.7.3.jar

Dependency Hierarchy:

• aws-java-sdk-1.11.856.jar (Root Library)
  • aws-java-sdk-core-1.11.856.jar
    • ❌ jackson-databind-2.6.7.3.jar (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to org.apache.activemq.* (aka activemq-jms, activemq-core, activemq-pool, and activemq-pool-jms).

Publish Date: 2020-03-31

URL: CVE-2020-11111

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11113

Release Date: 2020-03-31

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.4,2.10.0

CVE-2017-16119 (High) detected in fresh-0.3.0.tgz - autoclosed

CVE-2017-16119 - High Severity Vulnerability

Vulnerable Library - fresh-0.3.0.tgz

HTTP response freshness testing

Library home page: https://registry.npmjs.org/fresh/-/fresh-0.3.0.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/fresh/package.json

Dependency Hierarchy:

• serve-favicon-2.3.2.tgz (Root Library)
  • ❌ fresh-0.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Publish Date: 2018-06-07

URL: CVE-2017-16119

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/526

Release Date: 2018-06-07

Fix Resolution: fresh - 0.5.2

CVE-2017-16114 (High) detected in marked-0.3.6.tgz - autoclosed

CVE-2017-16114 - High Severity Vulnerability

Vulnerable Library - marked-0.3.6.tgz

A markdown parser built for speed

Library home page: https://registry.npmjs.org/marked/-/marked-0.3.6.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: /angular.js-master/angular.js-master/node_modules/marked/package.json

Dependency Hierarchy:

• ❌ marked-0.3.6.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

The marked module is vulnerable to a regular expression denial of service. Based on the information published in the public issue, 1k characters can block for around 6 seconds.

Publish Date: 2018-06-07

URL: CVE-2017-16114

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/531/versions

Release Date: 2018-06-07

Fix Resolution: 0.3.9

---

⛑️ Automatic Remediation is available for this issue

CVE-2020-7598 (Medium) detected in multiple libraries - autoclosed

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Libraries - minimist-1.2.0.tgz, minimist-0.0.8.tgz, minimist-0.0.10.tgz, minimist-0.2.0.tgz

minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/minimist/package.json

Dependency Hierarchy:

• firebase-tools-8.3.0.tgz (Root Library)
  • superstatic-6.0.4.tgz
    • nash-3.0.0.tgz
      • ❌ minimist-1.2.0.tgz (Vulnerable Library)

minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/minimist/package.json

Dependency Hierarchy:

• dgeni-packages-0.26.5.tgz (Root Library)
  • mkdirp-0.5.1.tgz
    • ❌ minimist-0.0.8.tgz (Vulnerable Library)

minimist-0.0.10.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/minimist/package.json

Dependency Hierarchy:

• dgeni-0.4.9.tgz (Root Library)
  • optimist-0.6.1.tgz
    • ❌ minimist-0.0.10.tgz (Vulnerable Library)

minimist-0.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.2.0.tgz

Path to dependency file: first_depth_0/angular.js-master/angular.js-master/package.json

Path to vulnerable library: first_depth_0/angular.js-master/angular.js-master/node_modules/minimist/package.json

Dependency Hierarchy:

• gulp-foreach-0.0.1.tgz (Root Library)
  • gulp-util-2.2.20.tgz
    • ❌ minimist-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branches: dev, testing

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3

WS-2018-0121 (Medium) detected in concat-with-sourcemaps-1.0.4.tgz - autoclosed

WS-2018-0121 - Medium Severity Vulnerability

Vulnerable Library - concat-with-sourcemaps-1.0.4.tgz

Concatenate file contents with a custom separator and generate a source map

Library home page: https://registry.npmjs.org/concat-with-sourcemaps/-/concat-with-sourcemaps-1.0.4.tgz

Path to dependency file: first/angular.js-master/angular.js-master/yarn.lock

Path to vulnerable library: first/angular.js-master/angular.js-master/yarn.lock

Dependency Hierarchy:

• gulp-concat-2.6.1.tgz (Root Library)
  • ❌ concat-with-sourcemaps-1.0.4.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

Out-of-bounds Read.
concat-with-sourcemaps allocates uninitialized Buffers when number is passed as a separator.

Publish Date: 2018-05-09

URL: WS-2018-0121

CVSS 2 Score Details (6.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/320166

Release Date: 2018-05-09

Fix Resolution: 1.0.7

WS-2019-0019 (Medium) detected in braces-1.8.5.tgz - autoclosed

WS-2019-0019 - Medium Severity Vulnerability

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Path to dependency file: first/angular.js-master/angular.js-master/yarn.lock

Path to vulnerable library: first/angular.js-master/angular.js-master/yarn.lock

Dependency Hierarchy:

• gulp-3.8.11.tgz (Root Library)
  • liftoff-2.3.0.tgz
    • findup-sync-0.4.2.tgz
      • micromatch-2.3.11.tgz
        • ❌ braces-1.8.5.tgz (Vulnerable Library)

Found in HEAD commit: 6e040516f98074b37f69996b76c1c99015c1d685

Found in base branch: master

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2018-02-16

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1