Giter Site home page Giter Site logo

loomio's Introduction

loomio

loomio's People

Contributors

dependabot[bot] avatar mause avatar mend-bolt-for-github[bot] avatar pre-commit-ci[bot] avatar renovate-bot avatar renovate[bot] avatar

loomio's Issues

platform-1.0.0.tgz: 4 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - platform-1.0.0.tgz

Found in HEAD commit: 21626b76ba61352ab72179602ffab74a0de31082

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2021-3749 High 7.5 axios-0.19.2.tgz Transitive N/A ❌
CVE-2022-0155 Medium 6.5 follow-redirects-1.5.10.tgz Transitive N/A ❌
CVE-2022-0536 Medium 5.9 follow-redirects-1.5.10.tgz Transitive N/A ❌
CVE-2020-28168 Medium 5.9 axios-0.19.2.tgz Transitive N/A ❌

Details

CVE-2021-3749

Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Dependency Hierarchy:

  • platform-1.0.0.tgz (Root Library)
    • ❌ axios-0.19.2.tgz (Vulnerable Library)

Found in HEAD commit: 21626b76ba61352ab72179602ffab74a0de31082

Found in base branch: main

Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/

Release Date: 2021-08-31

Fix Resolution: axios - 0.21.2

Step up your Open Source Security Game with Mend here

CVE-2022-0155

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Dependency Hierarchy:

  • platform-1.0.0.tgz (Root Library)
    • axios-0.19.2.tgz
      • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: 21626b76ba61352ab72179602ffab74a0de31082

Found in base branch: main

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution: follow-redirects - v1.14.7

Step up your Open Source Security Game with Mend here

CVE-2022-0536

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Dependency Hierarchy:

  • platform-1.0.0.tgz (Root Library)
    • axios-0.19.2.tgz
      • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: 21626b76ba61352ab72179602ffab74a0de31082

Found in base branch: main

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution: follow-redirects - 1.14.8

Step up your Open Source Security Game with Mend here

CVE-2020-28168

Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Dependency Hierarchy:

  • platform-1.0.0.tgz (Root Library)
    • ❌ axios-0.19.2.tgz (Vulnerable Library)

Found in HEAD commit: 21626b76ba61352ab72179602ffab74a0de31082

Found in base branch: main

Vulnerability Details

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Publish Date: 2020-11-06

URL: CVE-2020-28168

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-11-06

Fix Resolution: axios - 0.21.1

Step up your Open Source Security Game with Mend here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

Detected dependencies

github-actions
.github/workflows/generate.yml
  • actions/checkout v3
  • technote-space/create-pr-action v2
.github/workflows/node.js.yml
  • actions/checkout v3
  • actions/setup-node v3
  • actions/checkout v3
  • actions/setup-node v3
npm
package.json
  • @pipedream/platform ^1.0.0
  • @types/lodash ^4.14.182
  • axios 0.27.2
  • ironpipe ^0.0.9
  • isomorphic-fetch ^3.0.0
  • lodash ^4.17.21
  • luxon ^3.0.0
  • typescript ^5.0.0
  • @types/jest ^29.0.0
  • @types/luxon ^3.0.0
  • @types/moxios ^0.4.15
  • @types/node ~18.16.0
  • @typescript-eslint/eslint-plugin ^5.19.0
  • @typescript-eslint/parser ^5.26.0
  • @urql/core ^2.4.4
  • apollo ^2.29.0-alpha.0
  • dotenv ^16.0.1
  • eslint ^8.13.0
  • eslint-plugin-jest ^27.0.0
  • husky >=8
  • jest ^29.0.0
  • lint-staged >=10
  • moxios ^0.4.0
  • prettier ^2.6.2
  • ts-jest ^29.0.0
  • ts-morph ^18.0.0
  • ts-node ^10.7.0
  • Check this box to trigger a request for Renovate to run again on this repository

platform-0.10.0.tgz: 4 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - platform-0.10.0.tgz

Found in HEAD commit: c8fe69e8e580fb66031444859061ee988c83acd3

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2021-3749 High 7.5 axios-0.19.2.tgz Transitive N/A ❌
CVE-2022-0155 Medium 6.5 follow-redirects-1.5.10.tgz Transitive N/A ❌
CVE-2022-0536 Medium 5.9 follow-redirects-1.5.10.tgz Transitive N/A ❌
CVE-2020-28168 Medium 5.9 axios-0.19.2.tgz Transitive N/A ❌

Details

CVE-2021-3749

Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Dependency Hierarchy:

  • platform-0.10.0.tgz (Root Library)
    • ❌ axios-0.19.2.tgz (Vulnerable Library)

Found in HEAD commit: c8fe69e8e580fb66031444859061ee988c83acd3

Found in base branch: main

Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/

Release Date: 2021-08-31

Fix Resolution: axios - 0.21.2

Step up your Open Source Security Game with Mend here

CVE-2022-0155

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Dependency Hierarchy:

  • platform-0.10.0.tgz (Root Library)
    • axios-0.19.2.tgz
      • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: c8fe69e8e580fb66031444859061ee988c83acd3

Found in base branch: main

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution: follow-redirects - v1.14.7

Step up your Open Source Security Game with Mend here

CVE-2022-0536

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Dependency Hierarchy:

  • platform-0.10.0.tgz (Root Library)
    • axios-0.19.2.tgz
      • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: c8fe69e8e580fb66031444859061ee988c83acd3

Found in base branch: main

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution: follow-redirects - 1.14.8

Step up your Open Source Security Game with Mend here

CVE-2020-28168

Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Dependency Hierarchy:

  • platform-0.10.0.tgz (Root Library)
    • ❌ axios-0.19.2.tgz (Vulnerable Library)

Found in HEAD commit: c8fe69e8e580fb66031444859061ee988c83acd3

Found in base branch: main

Vulnerability Details

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Publish Date: 2020-11-06

URL: CVE-2020-28168

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: axios/axios@c7329fe

Release Date: 2020-11-06

Fix Resolution: axios - 0.21.1

Step up your Open Source Security Game with Mend here

@pipedream/platform-1.0.0.tgz: 4 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - @pipedream/platform-1.0.0.tgz

Found in HEAD commit: 32ecbc9f12c4bbe9b962c6c4b58ba3ce66ba05b1

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2021-3749 High 7.5 axios-0.19.2.tgz Transitive N/A ❌
CVE-2022-0155 Medium 6.5 follow-redirects-1.5.10.tgz Transitive N/A ❌
CVE-2022-0536 Medium 5.9 follow-redirects-1.5.10.tgz Transitive N/A ❌
CVE-2020-28168 Medium 5.9 axios-0.19.2.tgz Transitive N/A ❌

Details

CVE-2021-3749

Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Dependency Hierarchy:

  • @pipedream/platform-1.0.0.tgz (Root Library)
    • ❌ axios-0.19.2.tgz (Vulnerable Library)

Found in HEAD commit: 32ecbc9f12c4bbe9b962c6c4b58ba3ce66ba05b1

Found in base branch: main

Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/

Release Date: 2021-08-31

Fix Resolution: axios - 0.21.2

Step up your Open Source Security Game with Mend here

CVE-2022-0155

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Dependency Hierarchy:

  • @pipedream/platform-1.0.0.tgz (Root Library)
    • axios-0.19.2.tgz
      • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: 32ecbc9f12c4bbe9b962c6c4b58ba3ce66ba05b1

Found in base branch: main

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution: follow-redirects - v1.14.7

Step up your Open Source Security Game with Mend here

CVE-2022-0536

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Dependency Hierarchy:

  • @pipedream/platform-1.0.0.tgz (Root Library)
    • axios-0.19.2.tgz
      • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: 32ecbc9f12c4bbe9b962c6c4b58ba3ce66ba05b1

Found in base branch: main

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution: follow-redirects - 1.14.8

Step up your Open Source Security Game with Mend here

CVE-2020-28168

Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Dependency Hierarchy:

  • @pipedream/platform-1.0.0.tgz (Root Library)
    • ❌ axios-0.19.2.tgz (Vulnerable Library)

Found in HEAD commit: 32ecbc9f12c4bbe9b962c6c4b58ba3ce66ba05b1

Found in base branch: main

Vulnerability Details

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Publish Date: 2020-11-06

URL: CVE-2020-28168

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-11-06

Fix Resolution: axios - 0.21.1

Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.