Giter Site home page Giter Site logo

levyforchh / wire Goto Github PK

View Code? Open in Web Editor NEW

This project forked from square/wire

0.0 1.0 0.0 10.65 MB

gRPC and protocol buffers for Android, Kotlin, and Java.

Home Page: https://square.github.io/wire/

License: Apache License 2.0

Shell 0.05% Java 44.64% Kotlin 55.31%

wire's Introduction

Wire

“A man got to have a code!” - Omar Little

See the project website for documentation and APIs.

As our teams and programs grow, the variety and volume of data also grows. Success will turn your simple data models into complex ones! Whether your application is storing data to disk or transmitting it over a network, the structure and interpretation of that data should be clear. Consumers work best with data they understand!

Schemas describe and document data models. If you have data, you should have a schema.

Protocol Buffers

Google's Protocol Buffers are built around a great schema language:

  • It's cross platform and language independent. Whatever programming language you use, you'll be able to use proto schemas with your application.

  • Proto schemas are backwards-compatible and future-proof. You can evolve your schema as your application loses old features and gains new ones.

  • It's focused. Proto schemas describe your data models. That's it.

Here's a sample message definition:

syntax = "proto2";

package squareup.dinosaurs;

option java_package = "com.squareup.dinosaurs";

import "squareup/geology/period.proto";

message Dinosaur {
  // Common name of this dinosaur, like "Stegosaurus".
  optional string name = 1;

  // URLs with images of this dinosaur.
  repeated string picture_urls = 2;

  optional squareup.geology.Period period = 5;
}

And here's an enum definition:

syntax = "proto2";

package squareup.geology;

option java_package = "com.squareup.geology";

enum Period {
  // 145.5 million years ago — 66.0 million years ago.
  CRETACEOUS = 1;

  // 201.3 million years ago — 145.0 million years ago.
  JURASSIC = 2;

  // 252.17 million years ago — 201.3 million years ago.
  TRIASSIC = 3;
}

This schema language is Protocol Buffers' best feature. You might even use it purely for documentation purposes, such as to describe a JSON API.

Protocol Buffers also defines a compact binary encoding of messages that conform to the schema. This encoding is fast to encode, fast to decode, small to transmit, and small to store. The binary encoding uses numeric tags from the schema, like the 5 for period above.

For example, let's encode this dinosaur:

{
  name: "Stegosaurus",
  period: JURASSIC
}

The encoded value is just 15 bytes:

Hex  Description
 0a  tag: name(1), field encoding: LENGTH_DELIMITED(2). 1 << 3 | 2
 0b  "Stegosaurus".length()
 53  'S'
 74  't'
 65  'e'
 67  'g'
 6f  'o'
 73  's'
 61  'a'
 75  'u'
 72  'r'
 75  'u'
 73  's'
 28  tag: period(5), field encoding: VARINT(0). 5 << 3 | 0
 02  JURASSIC(2)

Why Wire?

The Protocol Buffers schema language and binary encoding are both defined by Google. Wire is an independent implementation from Square that's specifically designed for Android and Java.

For each message type defined in the schema, Wire generates an immutable model class and its builder. The generated code looks like code you'd write by hand: it's documented, formatted, and simple. Wire's APIs should feel at home to programmers who like Effective Java.

That said, there are some interesting design decisions in Wire:

  • Wire messages declare public final fields instead of the usual getter methods. This cuts down on both code generated and code executed. Less code is particularly beneficial for Android programs.

  • Wire avoids case mapping. A field declared as picture_urls in a schema yields a Java field picture_urls and not the conventional pictureUrls camel case. Though the name feels awkward at first, it's fantastic whenever you use grep or more sophisticated search tools. No more mapping when navigating between schema, Java source code, and data. It also provides a gentle reminder to calling code that proto messages are a bit special.

  • Primitive types are always boxed. If a field is absent, its value is null. This is used for naturally optional fields, such as a dinosaur whose period is unknown. A field may also be null due to schema evolution: if tomorrow we add a carnivore boolean to our message definition, today's data won’t have a value for that field.

Here's the compact generated code for the Dinosaur message defined above:

// Code generated by Wire protocol buffer compiler, do not edit.
// Source file: squareup/dinosaurs/dinosaur.proto at 9:1
package com.squareup.dinosaurs;

import com.squareup.geology.Period;
import com.squareup.wire.Message;
import com.squareup.wire.ProtoAdapter;
import com.squareup.wire.WireField;
import java.util.List;
import okio.ByteString;

public final class Dinosaur extends Message<Dinosaur, Dinosaur.Builder> {
  public static final ProtoAdapter<Dinosaur> ADAPTER = ProtoAdapter.newMessageAdapter(Dinosaur.class);

  private static final long serialVersionUID = 0L;

  public static final String DEFAULT_NAME = "";

  public static final Period DEFAULT_PERIOD = Period.CRETACEOUS;

  /**
   * Common name of this dinosaur, like "Stegosaurus".
   */
  @WireField(
      tag = 1,
      adapter = "com.squareup.wire.ProtoAdapter#STRING"
  )
  public final String name;

  /**
   * URLs with images of this dinosaur.
   */
  @WireField(
      tag = 2,
      adapter = "com.squareup.wire.ProtoAdapter#STRING",
      label = WireField.Label.REPEATED
  )
  public final List<String> picture_urls;

  @WireField(
      tag = 5,
      adapter = "com.squareup.geology.Period#ADAPTER"
  )
  public final Period period;

  public Dinosaur(String name, List<String> picture_urls, Period period) {
    this(name, picture_urls, period, ByteString.EMPTY);
  }

  public Dinosaur(String name, List<String> picture_urls, Period period, ByteString unknownFields) {
    super(unknownFields);
    this.name = name;
    this.picture_urls = immutableCopyOf("picture_urls", picture_urls);
    this.period = period;
  }

  @Override
  public Builder newBuilder() {
    Builder builder = new Builder();
    builder.name = name;
    builder.picture_urls = copyOf("picture_urls", picture_urls);
    builder.period = period;
    builder.addUnknownFields(unknownFields());
    return builder;
  }

  @Override
  public boolean equals(Object other) {
    if (other == this) return true;
    if (!(other instanceof Dinosaur)) return false;
    Dinosaur o = (Dinosaur) other;
    return equals(unknownFields(), o.unknownFields())
        && equals(name, o.name)
        && equals(picture_urls, o.picture_urls)
        && equals(period, o.period);
  }

  @Override
  public int hashCode() {
    int result = super.hashCode;
    if (result == 0) {
      result = unknownFields().hashCode();
      result = result * 37 + (name != null ? name.hashCode() : 0);
      result = result * 37 + (picture_urls != null ? picture_urls.hashCode() : 1);
      result = result * 37 + (period != null ? period.hashCode() : 0);
      super.hashCode = result;
    }
    return result;
  }

  public static final class Builder extends com.squareup.wire.Message.Builder<Dinosaur, Builder> {
    public String name;

    public List<String> picture_urls;

    public Period period;

    public Builder() {
      picture_urls = newMutableList();
    }

    /**
     * Common name of this dinosaur, like "Stegosaurus".
     */
    public Builder name(String name) {
      this.name = name;
      return this;
    }

    /**
     * URLs with images of this dinosaur.
     */
    public Builder picture_urls(List<String> picture_urls) {
      checkElementsNotNull(picture_urls);
      this.picture_urls = picture_urls;
      return this;
    }

    public Builder period(Period period) {
      this.period = period;
      return this;
    }

    @Override
    public Dinosaur build() {
      return new Dinosaur(name, picture_urls, period, buildUnknownFields());
    }
  }
}

The Java code to create and access proto models is compact and readable:

Dinosaur stegosaurus = new Dinosaur.Builder()
    .name("Stegosaurus")
    .period(Period.JURASSIC)
    .build();

System.out.println("My favorite dinosaur existed in the " + stegosaurus.period + " period.");

Each type has a corresponding ProtoAdapter that can encode a message to bytes and decode bytes back into a message.

Dinosaur stegosaurus = ...
byte[] stegosaurusBytes = Dinosaur.ADAPTER.encode(stegosaurus);

byte[] tyrannosaurusBytes = ...
Dinosaur tyrannosaurus = Dinosaur.ADAPTER.decode(tyrannosaurusBytes);

When accessing a field, use Wire.get() to replace null values with the corresponding default:

Period period = Wire.get(stegosaurus.period, Dinosaur.DEFAULT_PERIOD);

This is equivalent to the following:

Period period = stegosaurus.period != null ? stegosaurus.period : Dinosaur.DEFAULT_PERIOD;

Wire Kotlin

Since version 3.0.0, Wire can generate Kotlin code. See Wire Compiler & Gradle Plugin to learn how to configure your build.

Kotlin is a pragmatic and expressive programming language that makes it easy to model data. Here's how we used Kotlin to model Protocol Buffers messages:

  • Messages feel like data classes, but in fact they're not. Compiler still generates equals(), hashCode(), toString() and copy() for you. Wire does not generate componentN() functions though, we believe that destructuring declarations are not a good fit for Protocol Buffers: a change in the schema that removes or adds a field might lead to a situation when your destructuring declaration still compiles but now describes a completely different subset of fields, rendering your code incorrect.

  • copy() is a substitute for the Builder, which is not used anymore. If your program relies on the Builder to be present, you may generate code in Java interoperability mode - Wire Compiler & Gradle Plugin explains how that works.

  • Fields are generated as properties. While this is idiomatic in Kotlin, Java code will now have to access fields using getters. If your program relies on accessing fields directly, use Java interoperability mode - the compiler will generate @JvmField annotations for each field.

  • The nullability of each field's type depends on its label: required, repeated and map fields get non-nullable types, whereas optional fields are of nullable types.

  • With the exception of required fields, each field has a default value:

    • null for optional fields,
    • emptyList() for repeated fields,
    • emptyMap() for map fields.

Here's the same Dinosaur message in Kotlin:

// Code generated by Wire protocol buffer compiler, do not edit.
// Source file: squareup/dinosaurs/dinosaur.proto
package com.squareup.dinosaurs

import com.squareup.geology.Period
import com.squareup.wire.FieldEncoding
import com.squareup.wire.Message
import com.squareup.wire.ProtoAdapter
import com.squareup.wire.ProtoReader
import com.squareup.wire.ProtoWriter
import com.squareup.wire.WireField
import kotlin.Any
import kotlin.AssertionError
import kotlin.Boolean
import kotlin.Deprecated
import kotlin.DeprecationLevel
import kotlin.Int
import kotlin.Nothing
import kotlin.String
import kotlin.collections.List
import kotlin.hashCode
import kotlin.jvm.JvmField
import okio.ByteString

class Dinosaur(
  /**
   * Common name of this dinosaur, like "Stegosaurus".
   */
  @field:WireField(
    tag = 1,
    adapter = "com.squareup.wire.ProtoAdapter#STRING"
  )
  val name: String? = null,
  /**
   * URLs with images of this dinosaur.
   */
  @field:WireField(
    tag = 2,
    adapter = "com.squareup.wire.ProtoAdapter#STRING",
    label = WireField.Label.REPEATED
  )
  val picture_urls: List<String> = emptyList(),
  @field:WireField(
    tag = 5,
    adapter = "com.squareup.geology.Period#ADAPTER"
  )
  val period: Period? = null,
  unknownFields: ByteString = ByteString.EMPTY
) : Message<Dinosaur, Nothing>(ADAPTER, unknownFields) {
  @Deprecated(
    message = "Shouldn't be used in Kotlin",
    level = DeprecationLevel.HIDDEN
  )
  override fun newBuilder(): Nothing {
    throw AssertionError()
  }

  override fun equals(other: Any?): Boolean {
    if (other === this) return true
    if (other !is Dinosaur) return false
    return unknownFields == other.unknownFields
        && name == other.name
        && picture_urls == other.picture_urls
        && period == other.period
  }

  override fun hashCode(): Int {
    var result = super.hashCode
    if (result == 0) {
      result = name.hashCode()
      result = result * 37 + picture_urls.hashCode()
      result = result * 37 + period.hashCode()
      super.hashCode = result
    }
    return result
  }

  override fun toString(): String {
    val result = mutableListOf<String>()
    if (name != null) result += """name=$name"""
    if (picture_urls.isNotEmpty()) result += """picture_urls=$picture_urls"""
    if (period != null) result += """period=$period"""
    return result.joinToString(prefix = "Dinosaur{", separator = ", ", postfix = "}")
  }

  fun copy(
    name: String? = this.name,
    picture_urls: List<String> = this.picture_urls,
    period: Period? = this.period,
    unknownFields: ByteString = this.unknownFields
  ): Dinosaur = Dinosaur(name, picture_urls, period, unknownFields)

  companion object {
    @JvmField
    val ADAPTER: ProtoAdapter<Dinosaur> = object : ProtoAdapter<Dinosaur>(
      FieldEncoding.LENGTH_DELIMITED, 
      Dinosaur::class
    ) {
      override fun encodedSize(value: Dinosaur): Int = 
        ProtoAdapter.STRING.encodedSizeWithTag(1, value.name) +
        ProtoAdapter.STRING.asRepeated().encodedSizeWithTag(2, value.picture_urls) +
        Period.ADAPTER.encodedSizeWithTag(5, value.period) +
        value.unknownFields.size

      override fun encode(writer: ProtoWriter, value: Dinosaur) {
        ProtoAdapter.STRING.encodeWithTag(writer, 1, value.name)
        ProtoAdapter.STRING.asRepeated().encodeWithTag(writer, 2, value.picture_urls)
        Period.ADAPTER.encodeWithTag(writer, 5, value.period)
        writer.writeBytes(value.unknownFields)
      }

      override fun decode(reader: ProtoReader): Dinosaur {
        var name: String? = null
        val picture_urls = mutableListOf<String>()
        var period: Period? = null
        val unknownFields = reader.forEachTag { tag ->
          when (tag) {
            1 -> name = ProtoAdapter.STRING.decode(reader)
            2 -> picture_urls.add(ProtoAdapter.STRING.decode(reader))
            5 -> period = Period.ADAPTER.decode(reader)
            else -> reader.readUnknownField(tag)
          }
        }
        return Dinosaur(
          name = name,
          picture_urls = picture_urls,
          period = period,
          unknownFields = unknownFields
        )
      }

      override fun redact(value: Dinosaur): Dinosaur = value.copy(
        unknownFields = ByteString.EMPTY
      )
    }
  }
}

Creating and accessing proto models is easy:

val stegosaurus = Dinosaur(
    name = "Stegosaurus",
    period = Period.JURASSIC
)

println("My favorite dinosaur existed in the ${stegosaurus.period} period.")

Here's how you can modify the object to add extra fields:

val stegosaurus = stegosaurus.copy(
    picture_urls = listOf("https://www.flickr.com/photos/tags/Stegosaurus/")
)

println("Here are some photos of ${stegosaurus.name}: ${stegosaurus.picture_urls}")

Wire gRPC

Since version 3.0.0, Wire supports gRPC.

Generating Code With Wire

Wire's compiler is available via a Maven plugin. Put .proto sources in your project's src/main/proto directory, then use the plugin to generate .java files. The plugin will automatically add the generated Java code to your project's source roots.

<build>
  <plugins>
    <plugin>
      <groupId>com.squareup.wire</groupId>
      <artifactId>wire-maven-plugin</artifactId>
      <version>3.1.0</version>
      <executions>
        <execution>
          <phase>generate-sources</phase>
          <goals>
            <goal>generate-sources</goal>
          </goals>
          <configuration>
            <includes>
              <!-- proto package names to generate code for -->
              <include>squareup.dinosaurs.*</include>
              <include>squareup.geology.*</include>
            </includes>
          </configuration>
        </execution>
      </executions>
    </plugin>
  </plugins>
</build>

Wire can read .proto files from the local file system and from within .jar files.

The compiler can optionally prune your schema to a subset of root types and their transitive dependencies. This is useful when sharing a schema between projects: a Java service and Android app may each use a subset of a larger shared schema.

If you don't use Maven, the compiler also has a command line interface. Just substitute wire-compiler-VERSION-jar-with-dependencies.jar with the path to your jar. Download the latest precompiled jar.

% java -jar wire-compiler-VERSION-jar-with-dependencies.jar \
    --proto_path=src/main/proto \
    --java_out=out \
    squareup/dinosaurs/dinosaur.proto \
    squareup/geology/period.proto
Writing com.squareup.dinosaurs.Dinosaur to out
Writing com.squareup.geology.Period to out

Supplying the --android flag to the compiler causes Wire messages to implement Parcelable.

If you use Proguard, then you need to add keep rules. The simplest option is to tell Proguard not to touch the Wire runtime library and your generated protocol buffers (of course these simple rules will miss opportunities to shrink and optimize the code):

-keep class com.squareup.wire.** { *; }
-keep class com.yourcompany.yourgeneratedcode.** { *; }

Get Wire

The wire-runtime package contains runtime support libraries that must be included in applications that use Wire-generated code.

With Maven:

<dependency>
  <groupId>com.squareup.wire</groupId>
  <artifactId>wire-runtime</artifactId>
  <version>3.1.0</version>
</dependency>

With Gradle:

api "com.squareup.wire:wire-runtime:3.1.0"

Snapshots of the development version are available in Sonatype's snapshots repository.

Unsupported

Wire does not support:

  • Groups - they are skipped when parsing binary input data

Wire supports custom options on messages and fields. Other custom options are ignored. Pass --excludes=google.protobuf.* to the compiler to omit options from the generated code.

Further Documentation

See Google's excellent documentation on the structure and syntax of proto schemas.

wire's People

Contributors

jakewharton avatar swankjesse avatar egorand avatar oldergod avatar jrodbx avatar mc-lovin avatar mattprecious avatar monkey-mas avatar loganj avatar mellster2012 avatar lkerford avatar congt avatar andrew-arnott avatar zachmargolis avatar rjrjr avatar ericzundel avatar nightlynexus avatar edenman avatar matthewdu avatar jgulbronson avatar alanpaulin avatar pavlospt avatar eddieringle avatar yhpark avatar panpanini avatar pforhan avatar rharter avatar rdegnan avatar sullis avatar tamird avatar

Watchers

James Cloos avatar

wire's Issues

CVE-2020-13956 (Medium) detected in httpclient-4.0.1.jar

CVE-2020-13956 - Medium Severity Vulnerability

Vulnerable Library - httpclient-4.0.1.jar

HttpComponents Client (base module)

Path to dependency file: wire/wire-runtime/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.0.1/1d7d28fa738bdbfe4fbd895d9486308999bdf440/httpclient-4.0.1.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.0.1/1d7d28fa738bdbfe4fbd895d9486308999bdf440/httpclient-4.0.1.jar

Dependency Hierarchy:

  • android-4.1.1.4.jar (Root Library)
    • httpclient-4.0.1.jar (Vulnerable Library)

Vulnerability Details

Apache HttpClient versions prior to version 4.5.13 and 5.0.3 can misinterpret malformed authority component in request URIs passed to the library as java.net.URI object and pick the wrong target host for request execution.

Publish Date: 2020-12-02

URL: CVE-2020-13956

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-13956

Release Date: 2020-07-21

Fix Resolution: org.apache.httpcomponents:httpclient:4.5.13;org.apache.httpcomponents:httpclient-osgi:4.5.13;org.apache.httpcomponents.client5:httpclient5:5.0.3;org.apache.httpcomponents.client5:httpclient5-osgi:5.0.3

CVE-2014-0114 (High) detected in commons-beanutils-1.9.3.jar

CVE-2014-0114 - High Severity Vulnerability

Vulnerable Library - commons-beanutils-1.9.3.jar

Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.

Library home page: https://commons.apache.org/proper/commons-beanutils/

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/commons-beanutils/commons-beanutils/1.9.3/c845703de334ddc6b4b3cd26835458cb1cba1f3d/commons-beanutils-1.9.3.jar,/root/.gradle/caches/modules-2/files-2.1/commons-beanutils/commons-beanutils/1.9.3/c845703de334ddc6b4b3cd26835458cb1cba1f3d/commons-beanutils-1.9.3.jar

Dependency Hierarchy:

  • checkstyle-7.7.jar (Root Library)
    • commons-beanutils-1.9.3.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requiring commons-beanutils through 1.9.2, does not suppress the class property, which allows remote attackers to "manipulate" the ClassLoader and execute arbitrary code via the class parameter, as demonstrated by the passing of this parameter to the getClass method of the ActionForm object in Struts 1.

Publish Date: 2014-04-30

URL: CVE-2014-0114

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0114

Release Date: 2014-04-30

Fix Resolution: commons-beanutils:commons-beanutils:1.9.4;org.apache.struts:struts2-core:2.0.5

CVE-2019-16777 (Medium) detected in yarn-1.15.2.tgz

CVE-2019-16777 - Medium Severity Vulnerability

Vulnerable Library - yarn-1.15.2.tgz

?? Fast, reliable, and secure dependency management.

Library home page: https://registry.npmjs.org/yarn/-/yarn-1.15.2.tgz

Path to vulnerable library: wire/build/tmp/kotlinYarnSetup/yarn-v1.15.2.tar.gz

Dependency Hierarchy:

  • yarn-1.15.2.tgz (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Publish Date: 2019-12-13

URL: CVE-2019-16777

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli

Release Date: 2019-12-13

Fix Resolution: npm - 6.13.4


  • Check this box to open an automated fix PR

CVE-2018-10237 (Medium) detected in multiple libraries

CVE-2018-10237 - Medium Severity Vulnerability

Vulnerable Libraries - guava-19.0.jar, guava-16.0.1.jar, guava-20.0.jar

guava-19.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: https://github.com/google/guava

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/19.0/6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9/guava-19.0.jar,/root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/19.0/6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9/guava-19.0.jar

Dependency Hierarchy:

  • checkstyle-7.7.jar (Root Library)
    • guava-19.0.jar (Vulnerable Library)
guava-16.0.1.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: http://code.google.com/p/guava-libraries

Path to vulnerable library: /tmp/ws-ua_20200424204542/downloadResource_1215251d-2eb2-4bd9-a5f4-7f2ee52626ee/20200424205133/guava-16.0.1.jar,/tmp/ws-ua_20200424204542/downloadResource_1215251d-2eb2-4bd9-a5f4-7f2ee52626ee/20200424205133/guava-16.0.1.jar

Dependency Hierarchy:

  • jimfs-1.0.jar (Root Library)
    • guava-16.0.1.jar (Vulnerable Library)
guava-20.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: https://github.com/google/guava

Path to dependency file: wire/wire-java-generator/build.gradle

Path to vulnerable library: le/caches/modules-2/files-2.1/com.google.guava/guava/20.0/89507701249388e1ed5ddcf8c41f4ce1be7831ef/guava-20.0.jar,le/caches/modules-2/files-2.1/com.google.guava/guava/20.0/89507701249388e1ed5ddcf8c41f4ce1be7831ef/guava-20.0.jar,/root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/20.0/89507701249388e1ed5ddcf8c41f4ce1be7831ef/guava-20.0.jar

Dependency Hierarchy:

  • jimfs-1.0.jar (Root Library)
    • guava-20.0.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Publish Date: 2018-04-26

URL: CVE-2018-10237

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-10237

Release Date: 2018-04-26

Fix Resolution: 24.1.1-jre, 24.1.1-android

CVE-2020-7656 (Medium) detected in jquery-1.7.1.min.js

CVE-2020-7656 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: wire/build/js/node_modules/sockjs/examples/express/index.html

Path to vulnerable library: wire/build/js/node_modules/sockjs/examples/express/index.html,wire/build/js/node_modules/sockjs/examples/echo/index.html,wire/build/js/node_modules/sockjs/examples/multiplex/index.html,wire/build/js/node_modules/sockjs/examples/hapi/html/index.html,wire/build/js/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Vulnerability Details

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Publish Date: 2020-05-19

URL: CVE-2020-7656

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: rails/jquery-rails@8f601cb

Release Date: 2020-05-19

Fix Resolution: jquery-rails - 2.2.0

WS-2016-0090 (Medium) detected in jquery-1.7.1.min.js

WS-2016-0090 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/wire/build/js/node_modules/sockjs/examples/hapi/html/index.html

Path to vulnerable library: /wire/build/js/node_modules/sockjs/examples/hapi/html/index.html,/wire/build/js/node_modules/sockjs/examples/express-3.x/index.html,/wire/build/js/node_modules/sockjs/examples/express/index.html,/wire/build/js/node_modules/sockjs/examples/echo/index.html,/wire/build/js/node_modules/sockjs/examples/multiplex/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

JQuery, before 2.2.0, is vulnerable to Cross-site Scripting (XSS) attacks via text/javascript response with arbitrary code execution.

Publish Date: 2016-11-27

URL: WS-2016-0090

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jquery/jquery@b078a62

Release Date: 2019-04-08

Fix Resolution: 2.2.0

CVE-2020-11023 (Medium) detected in jquery-1.7.1.min.js

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: wire/build/js/node_modules/sockjs/examples/express/index.html

Path to vulnerable library: wire/build/js/node_modules/sockjs/examples/express/index.html,wire/build/js/node_modules/sockjs/examples/echo/index.html,wire/build/js/node_modules/sockjs/examples/multiplex/index.html,wire/build/js/node_modules/sockjs/examples/hapi/html/index.html,wire/build/js/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0

CVE-2019-5448 (High) detected in yarn-1.15.2.tgz

CVE-2019-5448 - High Severity Vulnerability

Vulnerable Library - yarn-1.15.2.tgz

?? Fast, reliable, and secure dependency management.

Library home page: https://registry.npmjs.org/yarn/-/yarn-1.15.2.tgz

Path to vulnerable library: wire/build/tmp/kotlinYarnSetup/yarn-v1.15.2.tar.gz

Dependency Hierarchy:

  • yarn-1.15.2.tgz (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Yarn before 1.17.3 is vulnerable to Missing Encryption of Sensitive Data due to HTTP URLs in lockfile causing unencrypted authentication data to be sent over the network.

Publish Date: 2019-07-30

URL: CVE-2019-5448

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5448

Release Date: 2019-07-30

Fix Resolution: 1.17.3


  • Check this box to open an automated fix PR

CVE-2019-16776 (High) detected in yarn-1.15.2.tgz

CVE-2019-16776 - High Severity Vulnerability

Vulnerable Library - yarn-1.15.2.tgz

?? Fast, reliable, and secure dependency management.

Library home page: https://registry.npmjs.org/yarn/-/yarn-1.15.2.tgz

Path to vulnerable library: wire/build/tmp/kotlinYarnSetup/yarn-v1.15.2.tar.gz

Dependency Hierarchy:

  • yarn-1.15.2.tgz (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to modify and/or gain access to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Publish Date: 2019-12-13

URL: CVE-2019-16776

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli

Release Date: 2019-12-13

Fix Resolution: npm - 6.13.3;yarn - 1.21.1

CVE-2017-16119 (High) detected in AndroidUtilCode1.23.6

CVE-2017-16119 - High Severity Vulnerability

Vulnerable Library - AndroidUtilCode1.23.6

🔥 Android developers should collect the following utils(updating).

Library home page: https://github.com/Blankj/AndroidUtilCode.git

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerable Source Files (0)

Vulnerability Details

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Publish Date: 2018-06-07

URL: CVE-2017-16119

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16119

Release Date: 2018-06-07

Fix Resolution: 0.5.2

CVE-2020-7662 (High) detected in JSSDKV2.1.13

CVE-2020-7662 - High Severity Vulnerability

Vulnerable Library - JSSDKV2.1.13

Library home page: https://github.com/Cocos-BCX/JSSDK.git

Vulnerable Source Files (0)

Vulnerability Details

websocket-extensions npm module prior to 1.0.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

Publish Date: 2020-06-02

URL: CVE-2020-7662

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7662

Release Date: 2020-06-02

Fix Resolution: websocket-extensions:0.1.4

CVE-2020-13822 (High) detected in SickRage9.4.197.dev2

CVE-2020-13822 - High Severity Vulnerability

Vulnerable Library - SickRage9.4.197.dev2

Mirror of OFFICIAL SiCKRAGE

Library home page: https://github.com/SickRage/SickRage.git

Vulnerable Source Files (1)

wire/build/js/node_modules/elliptic/lib/elliptic/ec/signature.js

Vulnerability Details

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Publish Date: 2020-06-04

URL: CVE-2020-13822

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/indutny/elliptic/tree/v6.5.3

Release Date: 2020-06-04

Fix Resolution: v6.5.3

WS-2019-0424 (Medium) detected in SickRage9.4.197.dev2

WS-2019-0424 - Medium Severity Vulnerability

Vulnerable Library - SickRage9.4.197.dev2

Mirror of OFFICIAL SiCKRAGE

Library home page: https://github.com/SickRage/SickRage.git

Vulnerable Source Files (0)

Vulnerability Details

all versions of elliptic are vulnerable to Timing Attack through side-channels.

Publish Date: 2019-11-13

URL: WS-2019-0424

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2020-8908 (Medium) detected in multiple libraries

CVE-2020-8908 - Medium Severity Vulnerability

Vulnerable Libraries - guava-19.0.jar, guava-16.0.1.jar, guava-20.0.jar

guava-19.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: https://github.com/google/guava

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/19.0/6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9/guava-19.0.jar,/root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/19.0/6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9/guava-19.0.jar

Dependency Hierarchy:

  • checkstyle-7.7.jar (Root Library)
    • guava-19.0.jar (Vulnerable Library)
guava-16.0.1.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: http://code.google.com/p/guava-libraries

Path to vulnerable library: /tmp/ws-ua_20200424204542/downloadResource_1215251d-2eb2-4bd9-a5f4-7f2ee52626ee/20200424205133/guava-16.0.1.jar,/tmp/ws-ua_20200424204542/downloadResource_1215251d-2eb2-4bd9-a5f4-7f2ee52626ee/20200424205133/guava-16.0.1.jar

Dependency Hierarchy:

  • jimfs-1.0.jar (Root Library)
    • guava-16.0.1.jar (Vulnerable Library)
guava-20.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: https://github.com/google/guava

Path to dependency file: wire/wire-java-generator/build.gradle

Path to vulnerable library: le/caches/modules-2/files-2.1/com.google.guava/guava/20.0/89507701249388e1ed5ddcf8c41f4ce1be7831ef/guava-20.0.jar,le/caches/modules-2/files-2.1/com.google.guava/guava/20.0/89507701249388e1ed5ddcf8c41f4ce1be7831ef/guava-20.0.jar,/root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/20.0/89507701249388e1ed5ddcf8c41f4ce1be7831ef/guava-20.0.jar

Dependency Hierarchy:

  • jimfs-1.0.jar (Root Library)
    • guava-20.0.jar (Vulnerable Library)

Vulnerability Details

A temp directory creation vulnerability exist in Guava versions prior to 30.0 allowing an attacker with access to the machine to potentially access data in a temporary directory created by the Guava com.google.common.io.Files.createTempDir(). The permissions granted to the directory created default to the standard unix-like /tmp ones, leaving the files open. We recommend updating Guava to version 30.0 or later, or update to Java 7 or later, or to explicitly change the permissions after the creation of the directory if neither are possible.

Publish Date: 2020-12-10

URL: CVE-2020-8908

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8908

Release Date: 2020-12-10

Fix Resolution: v30.0

WS-2017-3734 (Medium) detected in httpclient-4.0.1.jar

WS-2017-3734 - Medium Severity Vulnerability

Vulnerable Library - httpclient-4.0.1.jar

HttpComponents Client (base module)

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.0.1/1d7d28fa738bdbfe4fbd895d9486308999bdf440/httpclient-4.0.1.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.0.1/1d7d28fa738bdbfe4fbd895d9486308999bdf440/httpclient-4.0.1.jar

Dependency Hierarchy:

  • android-4.1.1.4.jar (Root Library)
    • httpclient-4.0.1.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Apache httpclient before 4.5.3 are vulnerable to Directory Traversal. The user-provided path was able to override the specified host, resulting in giving network access to a sensitive environment.

Publish Date: 2019-05-30

URL: WS-2017-3734

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://issues.apache.org/jira/browse/HTTPCLIENT-1803

Release Date: 2019-05-30

Fix Resolution: 4.5.3

CVE-2011-1498 (Medium) detected in httpclient-4.0.1.jar

CVE-2011-1498 - Medium Severity Vulnerability

Vulnerable Library - httpclient-4.0.1.jar

HttpComponents Client (base module)

Path to dependency file: wire/wire-runtime/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.0.1/1d7d28fa738bdbfe4fbd895d9486308999bdf440/httpclient-4.0.1.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.0.1/1d7d28fa738bdbfe4fbd895d9486308999bdf440/httpclient-4.0.1.jar

Dependency Hierarchy:

  • android-4.1.1.4.jar (Root Library)
    • httpclient-4.0.1.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Apache HttpClient 4.x before 4.1.1 in Apache HttpComponents, when used with an authenticating proxy server, sends the Proxy-Authorization header to the origin server, which allows remote web servers to obtain sensitive information by logging this header.

Publish Date: 2011-07-07

URL: CVE-2011-1498

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-1498

Release Date: 2011-07-07

Fix Resolution: 4.1.1

CVE-2020-7598 (Medium) detected in opennmsopennms-source-22.0.3-1

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Library - opennmsopennms-source-22.0.3-1

A Java based fault and performance management system

Library home page: https://sourceforge.net/projects/opennms/

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerable Source Files (0)

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3

CVE-2019-9658 (Medium) detected in checkstyle-7.7.jar

CVE-2019-9658 - Medium Severity Vulnerability

Vulnerable Library - checkstyle-7.7.jar

Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard

Library home page: http://checkstyle.sourceforge.net/

Path to vulnerable library: le/caches/modules-2/files-2.1/com.puppycrawl.tools/checkstyle/7.7/a11888c8a12e5bada20cf1b02efc841aacd1e1d7/checkstyle-7.7.jar,le/caches/modules-2/files-2.1/com.puppycrawl.tools/checkstyle/7.7/a11888c8a12e5bada20cf1b02efc841aacd1e1d7/checkstyle-7.7.jar

Dependency Hierarchy:

  • checkstyle-7.7.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Checkstyle before 8.18 loads external DTDs by default.

Publish Date: 2019-03-11

URL: CVE-2019-9658

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: checkstyle/checkstyle#6474

Release Date: 2019-03-11

Fix Resolution: checkstyle-8.18


  • Check this box to open an automated fix PR

WS-2019-0379 (Medium) detected in commons-codec-1.9.jar

WS-2019-0379 - Medium Severity Vulnerability

Vulnerable Library - commons-codec-1.9.jar

Base64 and hexadecimal codecs, plus phonetic encoding utilities.

Library home page: https://commons.apache.org/codec/

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/commons-codec/commons-codec/1.9/9ce04e34240f674bc72680f8b843b1457383161a/commons-codec-1.9.jar,/root/.gradle/caches/modules-2/files-2.1/commons-codec/commons-codec/1.9/9ce04e34240f674bc72680f8b843b1457383161a/commons-codec-1.9.jar

Dependency Hierarchy:

  • kotlin-gradle-plugin-1.3.61.jar (Root Library)
    • gradle-download-task-3.4.3.jar
      • httpclient-4.5.3.jar
        • commons-codec-1.9.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Apache commons-codec before version “commons-codec-1.13-RC1” is vulnerable to information disclosure due to Improper Input validation.

Publish Date: 2019-05-20

URL: WS-2019-0379

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: apache/commons-codec@48b6157

Release Date: 2019-05-12

Fix Resolution: 1.13-RC1

CVE-2015-9251 (Medium) detected in jquery-1.7.1.min.js

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: wire/build/js/node_modules/sockjs/examples/express/index.html

Path to vulnerable library: wire/build/js/node_modules/sockjs/examples/express/index.html,wire/build/js/node_modules/sockjs/examples/echo/index.html,wire/build/js/node_modules/sockjs/examples/multiplex/index.html,wire/build/js/node_modules/sockjs/examples/hapi/html/index.html,wire/build/js/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

CVE-2020-11022 (Medium) detected in jquery-1.7.1.min.js

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: wire/build/js/node_modules/sockjs/examples/express/index.html

Path to vulnerable library: wire/build/js/node_modules/sockjs/examples/express/index.html,wire/build/js/node_modules/sockjs/examples/echo/index.html,wire/build/js/node_modules/sockjs/examples/multiplex/index.html,wire/build/js/node_modules/sockjs/examples/hapi/html/index.html,wire/build/js/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

CVE-2020-7608 (Medium) detected in arangodb174dcc2a4bd5b87bec4f771b0a30a0665a2af54e

CVE-2020-7608 - Medium Severity Vulnerability

Vulnerable Library - arangodb174dcc2a4bd5b87bec4f771b0a30a0665a2af54e

���� ArangoDB is a native multi-model database with flexible data models for documents, graphs, and key-values. Build high performance applications using a convenient SQL-like query language or JavaScript extensions.

Library home page: https://github.com/arangodb/arangodb.git

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerable Source Files (0)

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7608

Release Date: 2020-03-16

Fix Resolution: v18.1.1;13.1.2;15.0.1

CVE-2020-7660 (High) detected in null

CVE-2020-7660 - High Severity Vulnerability

Vulnerable Library - null

Unmatched Source Files

Vulnerable Source Files (0)

Vulnerability Details

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

Publish Date: 2020-06-01

URL: CVE-2020-7660

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660

Release Date: 2020-06-01

Fix Resolution: serialize-javascript - 3.1.0

WS-2010-0001 (Medium) detected in commons-codec-1.3.jar

WS-2010-0001 - Medium Severity Vulnerability

Vulnerable Library - commons-codec-1.3.jar

The codec package contains simple encoder and decoders for various formats such as Base64 and Hexadecimal. In addition to these widely used encoders and decoders, the codec package also maintains a collection of phonetic encoding utilities.

Library home page: http://jakarta.apache.org/commons/codec/

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/commons-codec/commons-codec/1.3/fd32786786e2adb664d5ecc965da47629dca14ba/commons-codec-1.3.jar,/root/.gradle/caches/modules-2/files-2.1/commons-codec/commons-codec/1.3/fd32786786e2adb664d5ecc965da47629dca14ba/commons-codec-1.3.jar

Dependency Hierarchy:

  • android-4.1.1.4.jar (Root Library)
    • httpclient-4.0.1.jar
      • commons-codec-1.3.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Base64 encode() method is no longer thread-safe in Apache Commons Codec before version 1.7, which might disclose the wrong data or allow an attacker to change non-private fields.

Publish Date: 2010-02-26

URL: WS-2010-0001

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=WS-2010-0001

Release Date: 2017-01-31

Fix Resolution: 1.7

CVE-2012-6708 (Medium) detected in jquery-1.7.1.min.js

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: wire/build/js/node_modules/sockjs/examples/express/index.html

Path to vulnerable library: wire/build/js/node_modules/sockjs/examples/express/index.html,wire/build/js/node_modules/sockjs/examples/echo/index.html,wire/build/js/node_modules/sockjs/examples/multiplex/index.html,wire/build/js/node_modules/sockjs/examples/hapi/html/index.html,wire/build/js/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

CVE-2015-5237 (High) detected in protobuf-java-3.0.0.jar

CVE-2015-5237 - High Severity Vulnerability

Vulnerable Library - protobuf-java-3.0.0.jar

Core Protocol Buffers library. Protocol Buffers are a way of encoding structured data in an efficient yet extensible format.

Library home page: https://developers.google.com/protocol-buffers/

Path to dependency file: wire/wire-protoc-compatibility-tests/build.gradle

Path to vulnerable library: le/caches/modules-2/files-2.1/com.google.protobuf/protobuf-java/3.0.0/6d325aa7c921661d84577c0a93d82da4df9fa4c8/protobuf-java-3.0.0.jar,le/caches/modules-2/files-2.1/com.google.protobuf/protobuf-java/3.0.0/6d325aa7c921661d84577c0a93d82da4df9fa4c8/protobuf-java-3.0.0.jar

Dependency Hierarchy:

  • protobuf-java-3.0.0.jar (Vulnerable Library)

Vulnerability Details

protobuf allows remote authenticated attackers to cause a heap-based buffer overflow.

Publish Date: 2017-09-25

URL: CVE-2015-5237

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/protocolbuffers/protobuf/releases/tag/v3.4.0

Release Date: 2017-09-25

Fix Resolution: 3.4.0


  • Check this box to open an automated fix PR

CVE-2014-3577 (Medium) detected in httpclient-4.0.1.jar

CVE-2014-3577 - Medium Severity Vulnerability

Vulnerable Library - httpclient-4.0.1.jar

HttpComponents Client (base module)

Path to dependency file: wire/wire-runtime/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.0.1/1d7d28fa738bdbfe4fbd895d9486308999bdf440/httpclient-4.0.1.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.0.1/1d7d28fa738bdbfe4fbd895d9486308999bdf440/httpclient-4.0.1.jar

Dependency Hierarchy:

  • android-4.1.1.4.jar (Root Library)
    • httpclient-4.0.1.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

org.apache.http.conn.ssl.AbstractVerifier in Apache HttpComponents HttpClient before 4.3.5 and HttpAsyncClient before 4.0.2 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a "CN=" string in a field in the distinguished name (DN) of a certificate, as demonstrated by the "foo,CN=www.apache.org" string in the O field.

Publish Date: 2014-08-21

URL: CVE-2014-3577

CVSS 2 Score Details (5.8)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-3577

Release Date: 2014-08-21

Fix Resolution: 4.3.5,4.0.2

CVE-2019-10782 (Medium) detected in checkstyle-7.7.jar

CVE-2019-10782 - Medium Severity Vulnerability

Vulnerable Library - checkstyle-7.7.jar

Checkstyle is a development tool to help programmers write Java code that adheres to a coding standard

Library home page: http://checkstyle.sourceforge.net/

Path to vulnerable library: le/caches/modules-2/files-2.1/com.puppycrawl.tools/checkstyle/7.7/a11888c8a12e5bada20cf1b02efc841aacd1e1d7/checkstyle-7.7.jar,le/caches/modules-2/files-2.1/com.puppycrawl.tools/checkstyle/7.7/a11888c8a12e5bada20cf1b02efc841aacd1e1d7/checkstyle-7.7.jar

Dependency Hierarchy:

  • checkstyle-7.7.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

All versions of com.puppycrawl.tools:checkstyle before 8.29 are vulnerable to XML External Entity (XXE) Injection due to an incomplete fix for CVE-2019-9658.

Publish Date: 2020-01-30

URL: CVE-2019-10782

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10782

Release Date: 2020-01-30

Fix Resolution: com.puppycrawl.tools:checkstyle:8.29


  • Check this box to open an automated fix PR

CVE-2013-4710 (High) detected in android-4.1.1.4.jar

CVE-2013-4710 - High Severity Vulnerability

Vulnerable Library - android-4.1.1.4.jar

A library jar that provides APIs for Applications written for the Google Android Platform.

Library home page: http://source.android.com/

Path to vulnerable library: le/caches/modules-2/files-2.1/com.google.android/android/4.1.1.4/3fb039385e71e9aa2ba547ea9ea8caa34a4ffac7/android-4.1.1.4.jar,le/caches/modules-2/files-2.1/com.google.android/android/4.1.1.4/3fb039385e71e9aa2ba547ea9ea8caa34a4ffac7/android-4.1.1.4.jar

Dependency Hierarchy:

  • android-4.1.1.4.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Android 3.0 through 4.1.x on Disney Mobile, eAccess, KDDI, NTT DOCOMO, SoftBank, and other devices does not properly implement the WebView class, which allows remote attackers to execute arbitrary methods of Java objects or cause a denial of service (reboot) via a crafted web page, as demonstrated by use of the WebView.addJavascriptInterface method, a related issue to CVE-2012-6636.

Publish Date: 2014-03-03

URL: CVE-2013-4710

CVSS 2 Score Details (9.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4710

Release Date: 2014-03-03

Fix Resolution: com.google.android:android:4.2.0


  • Check this box to open an automated fix PR

CVE-2012-6153 (Medium) detected in httpclient-4.0.1.jar

CVE-2012-6153 - Medium Severity Vulnerability

Vulnerable Library - httpclient-4.0.1.jar

HttpComponents Client (base module)

Path to dependency file: wire/wire-runtime/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.0.1/1d7d28fa738bdbfe4fbd895d9486308999bdf440/httpclient-4.0.1.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.0.1/1d7d28fa738bdbfe4fbd895d9486308999bdf440/httpclient-4.0.1.jar

Dependency Hierarchy:

  • android-4.1.1.4.jar (Root Library)
    • httpclient-4.0.1.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

http/conn/ssl/AbstractVerifier.java in Apache Commons HttpClient before 4.2.3 does not properly verify that the server hostname matches a domain name in the subject's Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via a certificate with a subject that specifies a common name in a field that is not the CN field. NOTE: this issue exists because of an incomplete fix for CVE-2012-5783.

Publish Date: 2014-09-04

URL: CVE-2012-6153

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6153

Release Date: 2014-09-04

Fix Resolution: org.apache.httpcomponents:httpclient:4.2.3

CVE-2019-10773 (High) detected in yarn-1.15.2.tgz

CVE-2019-10773 - High Severity Vulnerability

Vulnerable Library - yarn-1.15.2.tgz

?? Fast, reliable, and secure dependency management.

Library home page: https://registry.npmjs.org/yarn/-/yarn-1.15.2.tgz

Path to vulnerable library: wire/build/tmp/kotlinYarnSetup/yarn-v1.15.2.tar.gz

Dependency Hierarchy:

  • yarn-1.15.2.tgz (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

In Yarn before 1.21.1, the package install functionality can be abused to generate arbitrary symlinks on the host filesystem by using specially crafted "bin" keys. Existing files could be overwritten depending on the current user permission set.

Publish Date: 2019-12-16

URL: CVE-2019-10773

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-10773

Release Date: 2019-12-16

Fix Resolution: yarn - 1.21.1


  • Check this box to open an automated fix PR

CVE-2019-15608 (Medium) detected in yarn-1.15.2.tgz

CVE-2019-15608 - Medium Severity Vulnerability

Vulnerable Library - yarn-1.15.2.tgz

?? Fast, reliable, and secure dependency management.

Library home page: https://registry.npmjs.org/yarn/-/yarn-1.15.2.tgz

Path to vulnerable library: wire/build/tmp/kotlinYarnSetup/yarn-v1.15.2.tar.gz

Dependency Hierarchy:

  • yarn-1.15.2.tgz (Vulnerable Library)

Vulnerability Details

The package integrity validation in yarn < 1.19.0 contains a TOCTOU vulnerability where the hash is computed before writing a package to cache. It's not computed again when reading from the cache. This may lead to a cache pollution attack.

Publish Date: 2020-03-15

URL: CVE-2019-15608

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-15608#range-4528269

Release Date: 2020-03-15

Fix Resolution: 1.19.0


  • Check this box to open an automated fix PR

CVE-2019-10086 (High) detected in commons-beanutils-1.9.3.jar

CVE-2019-10086 - High Severity Vulnerability

Vulnerable Library - commons-beanutils-1.9.3.jar

Apache Commons BeanUtils provides an easy-to-use but flexible wrapper around reflection and introspection.

Library home page: https://commons.apache.org/proper/commons-beanutils/

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/commons-beanutils/commons-beanutils/1.9.3/c845703de334ddc6b4b3cd26835458cb1cba1f3d/commons-beanutils-1.9.3.jar,/root/.gradle/caches/modules-2/files-2.1/commons-beanutils/commons-beanutils/1.9.3/c845703de334ddc6b4b3cd26835458cb1cba1f3d/commons-beanutils-1.9.3.jar

Dependency Hierarchy:

  • checkstyle-7.7.jar (Root Library)
    • commons-beanutils-1.9.3.jar (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

In Apache Commons Beanutils 1.9.2, a special BeanIntrospector class was added which allows suppressing the ability for an attacker to access the classloader via the class property available on all Java objects. We, however were not using this by default characteristic of the PropertyUtilsBean.

Publish Date: 2019-08-20

URL: CVE-2019-10086

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: victims/victims-cve-db@16a669c

Release Date: 2019-08-20

Fix Resolution: commons-beanutils:commons-beanutils:1.9.4

CVE-2019-16775 (Medium) detected in yarn-1.15.2.tgz

CVE-2019-16775 - Medium Severity Vulnerability

Vulnerable Library - yarn-1.15.2.tgz

?? Fast, reliable, and secure dependency management.

Library home page: https://registry.npmjs.org/yarn/-/yarn-1.15.2.tgz

Path to vulnerable library: wire/build/tmp/kotlinYarnSetup/yarn-v1.15.2.tar.gz

Dependency Hierarchy:

  • yarn-1.15.2.tgz (Vulnerable Library)

Found in HEAD commit: 8e8ad4a0d7c8d3c10bab3b9336f097c4933f0904

Vulnerability Details

Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It is possible for packages to create symlinks to files outside of thenode_modules folder through the bin field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user's system when the package is installed. This behavior is still possible through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Publish Date: 2019-12-13

URL: CVE-2019-16775

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli

Release Date: 2019-12-13

Fix Resolution: npm - 6.13.3;yarn - 1.21.1

WS-2020-0091 (High) detected in node-http-proxy1.18.0

WS-2020-0091 - High Severity Vulnerability

Vulnerable Library - node-http-proxy1.18.0

A full-featured http proxy for node.js

Library home page: https://github.com/http-party/node-http-proxy.git

Vulnerable Source Files (2)

wire/build/js/node_modules/http-proxy/lib/http-proxy/passes/web-incoming.js
wire/build/js/node_modules/http-proxy/lib/http-proxy/passes/web-incoming.js

Vulnerability Details

Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.

Publish Date: 2020-05-14

URL: WS-2020-0091

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1486

Release Date: 2020-05-26

Fix Resolution: http-proxy - 1.18.1

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.