meliy-meyada/github-finder-app

React app to search GitHub profiles and see profile details.

• 👋 Hi, I’m Meya.
• 👀 I’m interested in Javascript & Python.
• 🌱 Now, I am very committed towards my projects Face and Voice Recognition.

github-finder-app's Issues

react-scripts-5.0.1.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - react-scripts-5.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/svgo/node_modules/nth-check/package.json

Found in HEAD commit: c5d1d35600d577f1fdd1caa90fd516ab61656142

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (react-scripts version)	Remediation Available
CVE-2021-3803	High	7.5	nth-check-1.0.2.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2021-3803

Vulnerable Library - nth-check-1.0.2.tgz

performant nth-check parser & compiler

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/svgo/node_modules/nth-check/package.json

Dependency Hierarchy:

• react-scripts-5.0.1.tgz (Root Library)
  • webpack-5.5.0.tgz
    • plugin-svgo-5.5.0.tgz
      • svgo-1.3.2.tgz
        • css-select-2.1.0.tgz
          • ❌ nth-check-1.0.2.tgz (Vulnerable Library)

Found in HEAD commit: c5d1d35600d577f1fdd1caa90fd516ab61656142

Found in base branch: main

Vulnerability Details

nth-check is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3803

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-17

Fix Resolution: nth-check - v2.0.1

Step up your Open Source Security Game with Mend here

jest-dom-5.16.4.tgz: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - jest-dom-5.16.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (jest-dom version)	Remediation Possible**
CVE-2022-38900	High	7.5	decode-uri-component-0.2.0.tgz	Transitive	5.16.5	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-38900

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Dependency Hierarchy:

• jest-dom-5.16.4.tgz (Root Library)
  • css-3.0.0.tgz
    • source-map-resolve-0.6.0.tgz
      • ❌ decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w573-4hg7-7wgq

Release Date: 2022-11-28

Fix Resolution (decode-uri-component): 0.2.1

Direct dependency fix Resolution (@testing-library/jest-dom): 5.16.5

Step up your Open Source Security Game with Mend here

axios-0.26.1.tgz: 1 vulnerabilities (highest severity is: 6.5)

Vulnerable Library - axios-0.26.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.26.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Found in HEAD commit: c5d1d35600d577f1fdd1caa90fd516ab61656142

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (axios version)	Remediation Possible**
CVE-2023-45857	Medium	6.5	axios-0.26.1.tgz	Direct	1.6.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-45857

Vulnerable Library - axios-0.26.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.26.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

• ❌ axios-0.26.1.tgz (Vulnerable Library)

Found in HEAD commit: c5d1d35600d577f1fdd1caa90fd516ab61656142

Found in base branch: main

Vulnerability Details

An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.

Publish Date: 2023-11-08

URL: CVE-2023-45857

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-11-08

Fix Resolution: 1.6.0

Step up your Open Source Security Game with Mend here

daisyui-2.14.0.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - daisyui-2.14.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/yaml/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (daisyui version)	Remediation Available
CVE-2023-2251	High	7.5	yaml-1.10.2.tgz	Transitive	2.14.1	❌

Details

CVE-2023-2251

Vulnerable Library - yaml-1.10.2.tgz

JavaScript parser and stringifier for YAML

Library home page: https://registry.npmjs.org/yaml/-/yaml-1.10.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/yaml/package.json

Dependency Hierarchy:

• daisyui-2.14.0.tgz (Root Library)
  • tailwindcss-3.0.24.tgz
    • postcss-load-config-3.1.4.tgz
      • ❌ yaml-1.10.2.tgz (Vulnerable Library)

Found in base branch: main

Vulnerability Details

Uncaught Exception in GitHub repository eemeli/yaml prior to 2.2.2.

Publish Date: 2023-04-24

URL: CVE-2023-2251

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-f9xv-q969-pqx4

Release Date: 2023-04-24

Fix Resolution (yaml): 2.0.0-0

Direct dependency fix Resolution (daisyui): 2.14.1

Step up your Open Source Security Game with Mend here

Fix 'The href attribute is required for an anchor to be keyboard accessible. Provide a valid, navigable address as the href value. If you cannot provide an href, but still need the element to resemble a link, use a button and change it with appropriate styles. Learn more: https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/HEAD/docs/rules/anchor-is-valid.md' issue in src\pages\About.jsx

CodeFactor found an issue: The href attribute is required for an anchor to be keyboard accessible. Provide a valid, navigable address as the href value. If you cannot provide an href, but still need the element to resemble a link, use a button and change it with appropriate styles. Learn more: https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/HEAD/docs/rules/anchor-is-valid.md

It's currently on:
src\pages\About.jsx:21
Commit 7bb7fe0

Fix 'The href attribute is required for an anchor to be keyboard accessible. Provide a valid, navigable address as the href value. If you cannot provide an href, but still need the element to resemble a link, use a button and change it with appropriate styles. Learn more: https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/HEAD/docs/rules/anchor-is-valid.md' issue in src\pages\About.jsx

CodeFactor found an issue: The href attribute is required for an anchor to be keyboard accessible. Provide a valid, navigable address as the href value. If you cannot provide an href, but still need the element to resemble a link, use a button and change it with appropriate styles. Learn more: https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/HEAD/docs/rules/anchor-is-valid.md

It's currently on:
src\pages\About.jsx:15
Commit 4bf062a

Fix 'The href attribute is required for an anchor to be keyboard accessible. Provide a valid, navigable address as the href value. If you cannot provide an href, but still need the element to resemble a link, use a button and change it with appropriate styles. Learn more: https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/HEAD/docs/rules/anchor-is-valid.md' issue in src\pages\About.jsx

CodeFactor found an issue: The href attribute is required for an anchor to be keyboard accessible. Provide a valid, navigable address as the href value. If you cannot provide an href, but still need the element to resemble a link, use a button and change it with appropriate styles. Learn more: https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/HEAD/docs/rules/anchor-is-valid.md

It's currently on:
src\pages\About.jsx:21
Commit 7bb7fe0

Fix 'The href attribute is required for an anchor to be keyboard accessible. Provide a valid, navigable address as the href value. If you cannot provide an href, but still need the element to resemble a link, use a button and change it with appropriate styles. Learn more: https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/HEAD/docs/rules/anchor-is-valid.md' issue in src\pages\About.jsx

CodeFactor found an issue: The href attribute is required for an anchor to be keyboard accessible. Provide a valid, navigable address as the href value. If you cannot provide an href, but still need the element to resemble a link, use a button and change it with appropriate styles. Learn more: https://github.com/jsx-eslint/eslint-plugin-jsx-a11y/blob/HEAD/docs/rules/anchor-is-valid.md

It's currently on:
src\pages\About.jsx:15
Commit 4bf062a