liquefy7822/notesuniverse

Hi My name is Emmanuel Yee

Student and coder

I am a Student in Singapore. Currently studying in the School of Science and Technology, Singapore. Just a normal guy, with a normal life. Codes and games in free time, and tries to make viruses.

• 🌍  I'm based in Singapore
• 🖥️  See my portfolio at MyPortfolio
• ✉️  You can contact me at [email protected]
• 🚀  I'm currently working on New portfolio in markdown
• 🧠  I'm learning javascript

Skills

Socials

Badges

My GitHub Stats

notesuniverse's Issues

core-8.4.7.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - core-8.4.7.tgz

Nest - modern, fast, powerful node.js web framework (@core)

Library home page: https://registry.npmjs.org/@nestjs/core/-/core-8.4.7.tgz

Path to dependency file: /apps/notes-universe/package.json

Path to vulnerable library: /apps/notes-universe/node_modules/@nestjs/core/package.json

Found in HEAD commit: f2fabaf9c7bb30ac81377d309efe50aee1b28e7c

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (core version)	Remediation Possible**
CVE-2023-26108	Medium	5.3	core-8.4.7.tgz	Direct	9.0.5	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-26108

Vulnerable Library - core-8.4.7.tgz

Nest - modern, fast, powerful node.js web framework (@core)

Library home page: https://registry.npmjs.org/@nestjs/core/-/core-8.4.7.tgz

Path to dependency file: /apps/notes-universe/package.json

Path to vulnerable library: /apps/notes-universe/node_modules/@nestjs/core/package.json

Dependency Hierarchy:

• ❌ core-8.4.7.tgz (Vulnerable Library)

Found in HEAD commit: f2fabaf9c7bb30ac81377d309efe50aee1b28e7c

Found in base branch: main

Vulnerability Details

Versions of the package @nestjs/core before 9.0.5 are vulnerable to Information Exposure via the StreamableFile pipe. Exploiting this vulnerability is possible when the client cancels a request while it is streaming a StreamableFile, the stream wrapped by the StreamableFile will be kept open.

Publish Date: 2023-03-06

URL: CVE-2023-26108

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26108

Release Date: 2023-03-06

Fix Resolution: 9.0.5

Step up your Open Source Security Game with Mend here

common-8.4.7.tgz: 1 vulnerabilities (highest severity is: 6.5)

Vulnerable Library - common-8.4.7.tgz

Path to dependency file: /apps/notes-universe/package.json

Path to vulnerable library: /apps/notes-universe/node_modules/axios/package.json

Found in HEAD commit: f2fabaf9c7bb30ac81377d309efe50aee1b28e7c

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (common version)	Remediation Possible**
CVE-2023-45857	Medium	6.5	axios-0.27.2.tgz	Transitive	9.0.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-45857

Vulnerable Library - axios-0.27.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.27.2.tgz

Path to dependency file: /apps/notes-universe/package.json

Path to vulnerable library: /apps/notes-universe/node_modules/axios/package.json

Dependency Hierarchy:

• common-8.4.7.tgz (Root Library)
  • ❌ axios-0.27.2.tgz (Vulnerable Library)

Found in HEAD commit: f2fabaf9c7bb30ac81377d309efe50aee1b28e7c

Found in base branch: main

Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Publish Date: 2023-11-08

URL: CVE-2023-45857

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-11-08

Fix Resolution (axios): 1.6.0

Direct dependency fix Resolution (@nestjs/common): 9.0.0

Step up your Open Source Security Game with Mend here

react-scripts-5.0.0.tgz: 1 vulnerabilities (highest severity is: 8.8)

Vulnerable Library - react-scripts-5.0.0.tgz

Path to dependency file: /apps/notes-universe-admin/package.json

Path to vulnerable library: /apps/notes-universe-admin/node_modules/@babel/traverse/package.json

Found in HEAD commit: f2fabaf9c7bb30ac81377d309efe50aee1b28e7c

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (react-scripts version)	Remediation Possible**
CVE-2023-45133	High	8.8	traverse-7.23.0.tgz	Transitive	5.0.1	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-45133

Vulnerable Library - traverse-7.23.0.tgz

Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.23.0.tgz

Path to dependency file: /apps/notes-universe-admin/package.json

Path to vulnerable library: /apps/notes-universe-admin/node_modules/@babel/traverse/package.json

Dependency Hierarchy:

• react-scripts-5.0.0.tgz (Root Library)
  • core-7.23.0.tgz
    • ❌ traverse-7.23.0.tgz (Vulnerable Library)

Found in HEAD commit: f2fabaf9c7bb30ac81377d309efe50aee1b28e7c

Found in base branch: main

Vulnerability Details

Babel is a compiler for writingJavaScript. In @babel/traverse prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of babel-traverse, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the path.evaluate()or path.evaluateTruthy() internal Babel methods. Known affected plugins are @babel/plugin-transform-runtime; @babel/preset-env when using its useBuiltIns option; and any "polyfill provider" plugin that depends on @babel/helper-define-polyfill-provider, such as babel-plugin-polyfill-corejs3, babel-plugin-polyfill-corejs2, babel-plugin-polyfill-es-shims, babel-plugin-polyfill-regenerator. No other plugins under the @babel/ namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in @babel/[email protected] and @babel/[email protected]. Those who cannot upgrade @babel/traverse and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected @babel/traverse versions: @babel/plugin-transform-runtime v7.23.2, @babel/preset-env v7.23.2, @babel/helper-define-polyfill-provider v0.4.3, babel-plugin-polyfill-corejs2 v0.4.6, babel-plugin-polyfill-corejs3 v0.8.5, babel-plugin-polyfill-es-shims v0.10.0, babel-plugin-polyfill-regenerator v0.5.3.

Publish Date: 2023-10-12

URL: CVE-2023-45133

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-67hx-6x53-jw92

Release Date: 2023-10-12

Fix Resolution (@babel/traverse): 7.23.2

Direct dependency fix Resolution (react-scripts): 5.0.1

Step up your Open Source Security Game with Mend here