occmundial/occ-atomic

Collection of shareable styled React components for OCC applications.

occ-atomic's Issues

WS-2020-0091 (High) detected in http-proxy-1.17.0.tgz - autoclosed

WS-2020-0091 - High Severity Vulnerability

Vulnerable Library - http-proxy-1.17.0.tgz

HTTP proxying for the masses

Library home page: https://registry.npmjs.org/http-proxy/-/http-proxy-1.17.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/http-proxy/package.json

Dependency Hierarchy:

• webpack-dev-server-3.8.0.tgz (Root Library)
  • http-proxy-middleware-0.19.1.tgz
    • ❌ http-proxy-1.17.0.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: develop

Vulnerability Details

Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.

Publish Date: 2020-05-14

URL: WS-2020-0091

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1486

Release Date: 2020-05-26

Fix Resolution: http-proxy - 1.18.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2019-16769 (Medium) detected in serialize-javascript-1.7.0.tgz - autoclosed

CVE-2019-16769 - Medium Severity Vulnerability

Vulnerable Library - serialize-javascript-1.7.0.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.7.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/serialize-javascript/package.json

Dependency Hierarchy:

• playroom-0.9.1.tgz (Root Library)
  • webpack-4.35.2.tgz
    • terser-webpack-plugin-1.3.0.tgz
      • ❌ serialize-javascript-1.7.0.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

Publish Date: 2019-12-05

URL: CVE-2019-16769

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16769

Release Date: 2019-12-05

Fix Resolution: v2.1.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7693 (Medium) detected in sockjs-0.3.19.tgz - autoclosed

CVE-2020-7693 - Medium Severity Vulnerability

Vulnerable Library - sockjs-0.3.19.tgz

SockJS-node is a server counterpart of SockJS-client a JavaScript library that provides a WebSocket-like object in the browser. SockJS gives you a coherent, cross-browser, Javascript API which creates a low latency, full duplex, cross-domain communication

Library home page: https://registry.npmjs.org/sockjs/-/sockjs-0.3.19.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/sockjs/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • ❌ sockjs-0.3.19.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.

Publish Date: 2020-07-09

URL: CVE-2020-7693

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: sockjs/sockjs-node#265

Release Date: 2020-07-09

Fix Resolution: sockjs - 0.3.20

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7598 (Medium) detected in minimist-0.0.8.tgz, minimist-1.2.0.tgz - autoclosed

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Libraries - minimist-0.0.8.tgz, minimist-1.2.0.tgz

minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Dependency Hierarchy:

• chokidar-2.1.5.tgz (Root Library)
  • fsevents-1.2.9.tgz
    • node-pre-gyp-0.12.0.tgz
      • mkdirp-0.5.1.tgz
        • ❌ minimist-0.0.8.tgz (Vulnerable Library)

minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/watch/node_modules/minimist/package.json,occ-atomic/node_modules/loader-utils/node_modules/minimist/package.json,occ-atomic/node_modules/buble/node_modules/minimist/package.json,occ-atomic/node_modules/sane/node_modules/minimist/package.json,occ-atomic/node_modules/json5/node_modules/minimist/package.json

Dependency Hierarchy:

• jest-22.4.4.tgz (Root Library)
  • jest-cli-22.4.4.tgz
    • jest-haste-map-22.4.3.tgz
      • sane-2.5.2.tgz
        • ❌ minimist-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: develop

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-32640 (Medium) detected in ws-5.2.2.tgz - autoclosed

CVE-2021-32640 - Medium Severity Vulnerability

Vulnerable Library - ws-5.2.2.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-5.2.2.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/ws/package.json

Dependency Hierarchy:

• jsdom-11.12.0.tgz (Root Library)
  • ❌ ws-5.2.2.tgz (Vulnerable Library)

Found in HEAD commit: c51f131b9b56cbe96b5e46d7f77338456cce1693

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (websockets/ws@00c425e). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Publish Date: 2021-05-25

URL: CVE-2021-32640

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6fc8-4gx4-v693

Release Date: 2021-05-25

Fix Resolution: ws - 7.4.6

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23386 (Medium) detected in dns-packet-1.3.1.tgz - autoclosed

CVE-2021-23386 - Medium Severity Vulnerability

Vulnerable Library - dns-packet-1.3.1.tgz

An abstract-encoding compliant module for encoding / decoding DNS packets

Library home page: https://registry.npmjs.org/dns-packet/-/dns-packet-1.3.1.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/dns-packet/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • bonjour-3.5.0.tgz
    • multicast-dns-6.2.3.tgz
      • ❌ dns-packet-1.3.1.tgz (Vulnerable Library)

Found in HEAD commit: c51f131b9b56cbe96b5e46d7f77338456cce1693

Found in base branch: main

Vulnerability Details

This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

Publish Date: 2021-05-20

URL: CVE-2021-23386

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23386

Release Date: 2021-05-20

Fix Resolution: dns-packet - 5.2.2

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23382 (Medium) detected in postcss-6.0.23.tgz - autoclosed

CVE-2021-23382 - Medium Severity Vulnerability

Vulnerable Library - postcss-6.0.23.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/postcss/package.json

Dependency Hierarchy:

• css-loader-1.0.1.tgz (Root Library)
  • ❌ postcss-6.0.23.tgz (Vulnerable Library)

Found in HEAD commit: c51f131b9b56cbe96b5e46d7f77338456cce1693

Found in base branch: main

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution: postcss - 8.2.13

---

Step up your Open Source Security Game with WhiteSource here

WS-2019-0307 (Medium) detected in mem-1.1.0.tgz - autoclosed

WS-2019-0307 - Medium Severity Vulnerability

Vulnerable Library - mem-1.1.0.tgz

Memoize functions - An optimization used to speed up consecutive function calls by caching the result of calls with identical input

Library home page: https://registry.npmjs.org/mem/-/mem-1.1.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/mem/package.json

Dependency Hierarchy:

• jest-22.4.4.tgz (Root Library)
  • jest-cli-22.4.4.tgz
    • yargs-10.1.2.tgz
      • os-locale-2.1.0.tgz
        • ❌ mem-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

In 'mem' before v4.0.0 there is a Denial of Service (DoS) vulnerability as a result of a failure in removal old values from the cache.

Publish Date: 2018-08-27

URL: WS-2019-0307

CVSS 3 Score Details (5.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1084

Release Date: 2019-12-01

Fix Resolution: mem - 4.0.0

---

Step up your Open Source Security Game with WhiteSource here

El fullSize del modal no funciona

Se confirma que está deplegado el fullSize para modal

Se confirma que en occ-atomic no existe la propiedad de fullSize

Se solicita ayuda para deployar esa propiedad o ver que fue lo que paso

CVE-2020-7788 (High) detected in ini-1.3.5.tgz - autoclosed

CVE-2020-7788 - High Severity Vulnerability

Vulnerable Library - ini-1.3.5.tgz

An ini encoder/decoder for node

Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz

Dependency Hierarchy:

• chokidar-2.1.5.tgz (Root Library)
  • fsevents-1.2.9.tgz
    • node-pre-gyp-0.12.0.tgz
      • rc-1.2.8.tgz
        • ❌ ini-1.3.5.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: develop

Vulnerability Details

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2020-12-11

URL: CVE-2020-7788

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788

Release Date: 2020-12-11

Fix Resolution: v1.3.6

---

Step up your Open Source Security Game with WhiteSource here

CVE-2019-20149 (High) detected in kind-of-6.0.2.tgz - autoclosed

CVE-2019-20149 - High Severity Vulnerability

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/kind-of/package.json

Dependency Hierarchy:

• webpack-cli-4.8.0.tgz (Root Library)
  • webpack-merge-5.8.0.tgz
    • clone-deep-4.0.1.tgz
      • ❌ kind-of-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149

Release Date: 2019-12-30

Fix Resolution: 6.0.3

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-11022 (Medium) detected in jquery-1.8.1.min.js - autoclosed

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: occ-atomic/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

• ❌ jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-32804 (High) detected in tar-4.4.8.tgz - autoclosed

CVE-2021-32804 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/tar/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • chokidar-2.1.6.tgz
    • fsevents-1.2.9.tgz
      • node-pre-gyp-0.12.0.tgz
        • ❌ tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: fb992651a71bf0cb567f3ce25dfe9e36d69b88eb

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Publish Date: 2021-08-03

URL: CVE-2021-32804

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3jfq-g458-7qm9

Release Date: 2021-08-03

Fix Resolution: tar - 3.2.2, 4.4.14, 5.0.6, 6.1.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7789 (Medium) detected in node-notifier-5.3.0.tgz - autoclosed

CVE-2020-7789 - Medium Severity Vulnerability

Vulnerable Library - node-notifier-5.3.0.tgz

A Node.js module for sending notifications on native Mac, Windows (post and pre 8) and Linux (or Growl as fallback)

Library home page: https://registry.npmjs.org/node-notifier/-/node-notifier-5.3.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/node-notifier/package.json

Dependency Hierarchy:

• jest-22.4.4.tgz (Root Library)
  • jest-cli-22.4.4.tgz
    • ❌ node-notifier-5.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Publish Date: 2020-12-11

URL: CVE-2020-7789

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7789

Release Date: 2020-12-11

Fix Resolution: 9.0.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-37701 (High) detected in tar-4.4.8.tgz - autoclosed

CVE-2021-37701 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/tar/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • chokidar-2.1.6.tgz
    • fsevents-1.2.9.tgz
      • node-pre-gyp-0.12.0.tgz
        • ❌ tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: 31fdd81a799b8f96cdae09899abd668af1b3ef09

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Publish Date: 2021-08-31

URL: CVE-2021-37701

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9r2w-394v-53qc

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.16, 5.0.8, 6.1.7

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-27290 (High) detected in ssri-6.0.1.tgz - autoclosed

CVE-2021-27290 - High Severity Vulnerability

Vulnerable Library - ssri-6.0.1.tgz

Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.

Library home page: https://registry.npmjs.org/ssri/-/ssri-6.0.1.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/ssri/package.json

Dependency Hierarchy:

• uglifyjs-webpack-plugin-2.2.0.tgz (Root Library)
  • cacache-12.0.2.tgz
    • ❌ ssri-6.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: develop

Vulnerability Details

ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.

Publish Date: 2021-03-12

URL: CVE-2021-27290

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27290

Release Date: 2021-03-12

Fix Resolution: v8.0.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-28500 (Medium) detected in lodash-4.17.19.tgz - autoclosed

CVE-2020-28500 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.19.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/node_modules/lodash/package.json

Dependency Hierarchy:

• react-docgen-2.21.0.tgz (Root Library)
  • async-2.6.1.tgz
    • ❌ lodash-4.17.19.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (react-docgen): 3.0.0-beta1

---

Step up your Open Source Security Game with WhiteSource here

WS-2020-0208 (Medium) detected in highlight.js-9.15.6.tgz - autoclosed

WS-2020-0208 - Medium Severity Vulnerability

Vulnerable Library - highlight.js-9.15.6.tgz

Syntax highlighting with language autodetection.

Library home page: https://registry.npmjs.org/highlight.js/-/highlight.js-9.15.6.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/highlight.js/package.json

Dependency Hierarchy:

• ❌ highlight.js-9.15.6.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: develop

Vulnerability Details

If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable. On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service). This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable. If you are using highlightAuto to detect the language (and have any of these grammars registered) you are vulnerable.

Publish Date: 2020-12-04

URL: WS-2020-0208

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/highlightjs/highlight.js/tree/10.4.1

Release Date: 2020-12-04

Fix Resolution: 10.4.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-33502 (High) detected in normalize-url-1.9.1.tgz - autoclosed

CVE-2021-33502 - High Severity Vulnerability

Vulnerable Library - normalize-url-1.9.1.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-1.9.1.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/normalize-url/package.json

Dependency Hierarchy:

• gh-pages-1.2.0.tgz (Root Library)
  • filenamify-url-1.0.0.tgz
    • humanize-url-1.0.1.tgz
      • ❌ normalize-url-1.9.1.tgz (Vulnerable Library)

Found in HEAD commit: c51f131b9b56cbe96b5e46d7f77338456cce1693

Found in base branch: main

Vulnerability Details

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Publish Date: 2021-05-24

URL: CVE-2021-33502

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502

Release Date: 2021-05-24

Fix Resolution: normalize-url - 4.5.1, 5.3.1, 6.0.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-15366 (Medium) detected in ajv-6.10.0.tgz, ajv-5.5.2.tgz - autoclosed

CVE-2020-15366 - Medium Severity Vulnerability

Vulnerable Libraries - ajv-6.10.0.tgz, ajv-5.5.2.tgz

ajv-6.10.0.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-6.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/har-validator/node_modules/ajv/package.json

Dependency Hierarchy:

• jsdom-11.12.0.tgz (Root Library)
  • request-2.88.0.tgz
    • har-validator-5.1.3.tgz
      • ❌ ajv-6.10.0.tgz (Vulnerable Library)

ajv-5.5.2.tgz

Another JSON Schema Validator

Library home page: https://registry.npmjs.org/ajv/-/ajv-5.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/eslint/node_modules/ajv/package.json

Dependency Hierarchy:

• eslint-4.19.1.tgz (Root Library)
  • ❌ ajv-5.5.2.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

Publish Date: 2020-07-15

URL: CVE-2020-15366

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-15

Fix Resolution (ajv): 6.12.3

Direct dependency fix Resolution (jsdom): 12.0.0

Fix Resolution (ajv): 6.12.3

Direct dependency fix Resolution (eslint): 5.0.0

---

Step up your Open Source Security Game with Mend here

CVE-2015-9251 (Medium) detected in jquery-1.8.1.min.js - autoclosed

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: occ-atomic/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

• ❌ jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-27292 (High) detected in ua-parser-js-0.7.20.tgz - autoclosed

CVE-2021-27292 - High Severity Vulnerability

Vulnerable Library - ua-parser-js-0.7.20.tgz

Lightweight JavaScript-based user-agent string parser

Library home page: https://registry.npmjs.org/ua-parser-js/-/ua-parser-js-0.7.20.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/ua-parser-js/package.json

Dependency Hierarchy:

• playroom-0.9.1.tgz (Root Library)
  • react-codemirror-1.0.0.tgz
    • create-react-class-15.6.3.tgz
      • fbjs-0.8.17.tgz
        • ❌ ua-parser-js-0.7.20.tgz (Vulnerable Library)

Found in HEAD commit: c0bab5cb049fd3e17ceb2f5d6cccf05cd763cfd2

Found in base branch: main

Vulnerability Details

ua-parser-js >= 0.7.14, fixed in 0.7.24, uses a regular expression which is vulnerable to denial of service. If an attacker sends a malicious User-Agent header, ua-parser-js will get stuck processing it for an extended period of time.

Publish Date: 2021-03-17

URL: CVE-2021-27292

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/faisalman/ua-parser-js/releases/tag/0.7.24

Release Date: 2021-03-17

Fix Resolution: ua-parser-js - 0.7.24

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7656 (Medium) detected in jquery-1.8.1.min.js - autoclosed

CVE-2020-7656 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: occ-atomic/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

• ❌ jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Publish Date: 2020-05-19

URL: CVE-2020-7656

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q4m3-2j7h-f7xw

Release Date: 2020-05-28

Fix Resolution: jquery - 1.9.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz - autoclosed

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/path-parse/package.json

Dependency Hierarchy:

• eslint-plugin-react-7.13.0.tgz (Root Library)
  • resolve-1.20.0.tgz
    • ❌ path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: c51f131b9b56cbe96b5e46d7f77338456cce1693

Found in base branch: main

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jbgutierrez/path-parse#8

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23364 (Medium) detected in browserslist-4.6.3.tgz, browserslist-4.16.4.tgz - autoclosed

CVE-2021-23364 - Medium Severity Vulnerability

Vulnerable Libraries - browserslist-4.6.3.tgz, browserslist-4.16.4.tgz

browserslist-4.6.3.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.6.3.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/browserslist/package.json

Dependency Hierarchy:

• preset-env-7.4.5.tgz (Root Library)
  • ❌ browserslist-4.6.3.tgz (Vulnerable Library)

browserslist-4.16.4.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.16.4.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/browserslist/package.json

Dependency Hierarchy:

• webpack-5.32.0.tgz (Root Library)
  • ❌ browserslist-4.16.4.tgz (Vulnerable Library)

Found in HEAD commit: c51f131b9b56cbe96b5e46d7f77338456cce1693

Found in base branch: main

Vulnerability Details

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Publish Date: 2021-04-28

URL: CVE-2021-23364

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364

Release Date: 2021-04-28

Fix Resolution: browserslist - 4.16.5

---

Step up your Open Source Security Game with WhiteSource here

CVE-2019-10747 (High) detected in set-value-2.0.0.tgz, set-value-0.4.3.tgz - autoclosed

CVE-2019-10747 - High Severity Vulnerability

Vulnerable Libraries - set-value-2.0.0.tgz, set-value-0.4.3.tgz

set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/set-value/package.json

Dependency Hierarchy:

• chokidar-2.1.5.tgz (Root Library)
  • braces-2.3.2.tgz
    • snapdragon-0.8.2.tgz
      • base-0.11.2.tgz
        • cache-base-1.0.1.tgz
          • ❌ set-value-2.0.0.tgz (Vulnerable Library)

set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/union-value/node_modules/set-value/package.json

Dependency Hierarchy:

• chokidar-2.1.5.tgz (Root Library)
  • braces-2.3.2.tgz
    • snapdragon-0.8.2.tgz
      • base-0.11.2.tgz
        • cache-base-1.0.1.tgz
          • union-value-1.0.0.tgz
            • ❌ set-value-0.4.3.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: develop

Vulnerability Details

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Publish Date: 2019-08-23

URL: CVE-2019-10747

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jonschlinkert/set-value@95e9d99

Release Date: 2019-07-24

Fix Resolution: 2.0.1,3.0.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-37712 (High) detected in tar-4.4.8.tgz - autoclosed

CVE-2021-37712 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/tar/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • chokidar-2.1.6.tgz
    • fsevents-1.2.9.tgz
      • node-pre-gyp-0.12.0.tgz
        • ❌ tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: 31fdd81a799b8f96cdae09899abd668af1b3ef09

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: 2021-08-31

URL: CVE-2021-37712

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq89-hq3f-393p

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.18, 5.0.10, 6.1.9

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7660 (High) detected in serialize-javascript-1.7.0.tgz - autoclosed

CVE-2020-7660 - High Severity Vulnerability

Vulnerable Library - serialize-javascript-1.7.0.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.7.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/serialize-javascript/package.json

Dependency Hierarchy:

• playroom-0.9.1.tgz (Root Library)
  • webpack-4.35.2.tgz
    • terser-webpack-plugin-1.3.0.tgz
      • ❌ serialize-javascript-1.7.0.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

Publish Date: 2020-06-01

URL: CVE-2020-7660

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660

Release Date: 2020-06-01

Fix Resolution: serialize-javascript - 3.1.0

---

Step up your Open Source Security Game with WhiteSource here

WS-2020-0042 (High) detected in multiple libraries - autoclosed

WS-2020-0042 - High Severity Vulnerability

Vulnerable Libraries - acorn-6.0.4.tgz, acorn-5.7.3.tgz, acorn-6.1.1.tgz

acorn-6.0.4.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-6.0.4.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/acorn/package.json

Dependency Hierarchy:

• jsdom-11.12.0.tgz (Root Library)
  • acorn-globals-4.3.0.tgz
    • ❌ acorn-6.0.4.tgz (Vulnerable Library)

acorn-5.7.3.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-5.7.3.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/acorn/package.json

Dependency Hierarchy:

• jsdom-11.12.0.tgz (Root Library)
  • ❌ acorn-5.7.3.tgz (Vulnerable Library)

acorn-6.1.1.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-6.1.1.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/acorn-globals/node_modules/acorn/package.json,occ-atomic/node_modules/acorn/package.json

Dependency Hierarchy:

• playroom-0.9.1.tgz (Root Library)
  • webpack-4.35.2.tgz
    • ❌ acorn-6.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.

Publish Date: 2020-03-01

URL: WS-2020-0042

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1488

Release Date: 2020-03-08

Fix Resolution: 7.1.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-28499 (High) detected in merge-1.2.1.tgz - autoclosed

CVE-2020-28499 - High Severity Vulnerability

Vulnerable Library - merge-1.2.1.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

Library home page: https://registry.npmjs.org/merge/-/merge-1.2.1.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/merge/package.json

Dependency Hierarchy:

• jest-22.4.4.tgz (Root Library)
  • jest-cli-22.4.4.tgz
    • jest-haste-map-22.4.3.tgz
      • sane-2.5.2.tgz
        • exec-sh-0.2.2.tgz
          • ❌ merge-1.2.1.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

Publish Date: 2021-02-18

URL: CVE-2020-28499

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: swordev/merge#38

Release Date: 2021-02-18

Fix Resolution: merge - 2.1.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2012-6708 (Medium) detected in jquery-1.8.1.min.js - autoclosed

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: occ-atomic/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

• ❌ jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23369 (High) detected in handlebars-4.7.6.tgz - autoclosed

CVE-2021-23369 - High Severity Vulnerability

Vulnerable Library - handlebars-4.7.6.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.7.6.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/handlebars/package.json

Dependency Hierarchy:

• jest-22.4.4.tgz (Root Library)
  • jest-cli-22.4.4.tgz
    • istanbul-api-1.3.7.tgz
      • istanbul-reports-1.5.1.tgz
        • ❌ handlebars-4.7.6.tgz (Vulnerable Library)

Found in HEAD commit: c51f131b9b56cbe96b5e46d7f77338456cce1693

Found in base branch: main

Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-04-12

URL: CVE-2021-23369

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23369

Release Date: 2021-04-12

Fix Resolution: handlebars - 4.7.7

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23424 (High) detected in ansi-html-0.0.7.tgz - autoclosed

CVE-2021-23424 - High Severity Vulnerability

Vulnerable Library - ansi-html-0.0.7.tgz

An elegant lib that converts the chalked (ANSI) text to HTML.

Library home page: https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.7.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/ansi-html/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • ❌ ansi-html-0.0.7.tgz (Vulnerable Library)

Found in HEAD commit: fb992651a71bf0cb567f3ce25dfe9e36d69b88eb

Found in base branch: main

Vulnerability Details

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.

Publish Date: 2021-08-18

URL: CVE-2021-23424

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-3664 (Medium) detected in url-parse-1.4.4.tgz - autoclosed

CVE-2021-3664 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.4.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.4.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/url-parse/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • sockjs-client-1.3.0.tgz
    • ❌ url-parse-1.4.4.tgz (Vulnerable Library)

Found in HEAD commit: fb992651a71bf0cb567f3ce25dfe9e36d69b88eb

Found in base branch: main

Vulnerability Details

url-parse is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2021-07-26

URL: CVE-2021-3664

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3664

Release Date: 2021-07-26

Fix Resolution: url-parse - 1.5.2

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-28469 (High) detected in glob-parent-2.0.0.tgz, glob-parent-3.1.0.tgz - autoclosed

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Libraries - glob-parent-2.0.0.tgz, glob-parent-3.1.0.tgz

glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/glob-parent/package.json

Dependency Hierarchy:

• jest-22.4.4.tgz (Root Library)
  • jest-cli-22.4.4.tgz
    • micromatch-2.3.11.tgz
      • parse-glob-3.0.4.tgz
        • glob-base-0.3.0.tgz
          • ❌ glob-parent-2.0.0.tgz (Vulnerable Library)

glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/chokidar/node_modules/glob-parent/package.json,occ-atomic/node_modules/watchpack-chokidar2/node_modules/glob-parent/package.json,occ-atomic/node_modules/fast-glob/node_modules/glob-parent/package.json,occ-atomic/node_modules/webpack-dev-server/node_modules/glob-parent/package.json,occ-atomic/node_modules/glob-parent/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • chokidar-2.1.6.tgz
    • ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: c51f131b9b56cbe96b5e46d7f77338456cce1693

Found in base branch: main

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2

---

Step up your Open Source Security Game with WhiteSource here

WS-2021-0154 (Medium) detected in glob-parent-2.0.0.tgz, glob-parent-3.1.0.tgz - autoclosed

WS-2021-0154 - Medium Severity Vulnerability

Vulnerable Libraries - glob-parent-2.0.0.tgz, glob-parent-3.1.0.tgz

glob-parent-2.0.0.tgz

Strips glob magic from a string to provide the parent path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/glob-parent/package.json

Dependency Hierarchy:

• jest-22.4.4.tgz (Root Library)
  • jest-cli-22.4.4.tgz
    • micromatch-2.3.11.tgz
      • parse-glob-3.0.4.tgz
        • glob-base-0.3.0.tgz
          • ❌ glob-parent-2.0.0.tgz (Vulnerable Library)

glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/chokidar/node_modules/glob-parent/package.json,occ-atomic/node_modules/watchpack-chokidar2/node_modules/glob-parent/package.json,occ-atomic/node_modules/fast-glob/node_modules/glob-parent/package.json,occ-atomic/node_modules/webpack-dev-server/node_modules/glob-parent/package.json

Dependency Hierarchy:

• chokidar-2.1.5.tgz (Root Library)
  • ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: c51f131b9b56cbe96b5e46d7f77338456cce1693

Found in base branch: develop

Vulnerability Details

Regular Expression Denial of Service (ReDoS) vulnerability was found in glob-parent before 5.1.2.

Publish Date: 2021-01-27

URL: WS-2021-0154

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2

Release Date: 2021-01-27

Fix Resolution: glob-parent - 5.1.2

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7760 (Medium) detected in codemirror-5.48.0.js, codemirror-5.48.0.tgz - autoclosed

CVE-2020-7760 - Medium Severity Vulnerability

Vulnerable Libraries - codemirror-5.48.0.js, codemirror-5.48.0.tgz

codemirror-5.48.0.js

In-browser code editing made bearable

Library home page: https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.48.0/codemirror.js

Path to dependency file: occ-atomic/node_modules/codemirror/mode/rpm/changes/index.html

Path to vulnerable library: /node_modules/codemirror/mode/rpm/changes/../../../lib/codemirror.js

Dependency Hierarchy:

• ❌ codemirror-5.48.0.js (Vulnerable Library)

codemirror-5.48.0.tgz

Full-featured in-browser code editor

Library home page: https://registry.npmjs.org/codemirror/-/codemirror-5.48.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/codemirror/package.json

Dependency Hierarchy:

• playroom-0.9.1.tgz (Root Library)
  • ❌ codemirror-5.48.0.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/.?/)

Publish Date: 2020-10-30

URL: CVE-2020-7760

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7760

Release Date: 2020-07-21

Fix Resolution: codemirror - 5.58.2

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23383 (High) detected in handlebars-4.7.6.tgz - autoclosed

CVE-2021-23383 - High Severity Vulnerability

Vulnerable Library - handlebars-4.7.6.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.7.6.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/handlebars/package.json

Dependency Hierarchy:

• jest-22.4.4.tgz (Root Library)
  • jest-cli-22.4.4.tgz
    • istanbul-api-1.3.7.tgz
      • istanbul-reports-1.5.1.tgz
        • ❌ handlebars-4.7.6.tgz (Vulnerable Library)

Found in HEAD commit: c51f131b9b56cbe96b5e46d7f77338456cce1693

Found in base branch: main

Vulnerability Details

The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

Publish Date: 2021-05-04

URL: CVE-2021-23383

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23383

Release Date: 2021-05-04

Fix Resolution: handlebars - 4.7.7

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-33587 (High) detected in css-what-2.1.3.tgz - autoclosed

CVE-2021-33587 - High Severity Vulnerability

Vulnerable Library - css-what-2.1.3.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-2.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/css-what/package.json

Dependency Hierarchy:

• enzyme-3.9.0.tgz (Root Library)
  • cheerio-1.0.0-rc.3.tgz
    • css-select-1.2.0.tgz
      • ❌ css-what-2.1.3.tgz (Vulnerable Library)

Found in HEAD commit: c51f131b9b56cbe96b5e46d7f77338456cce1693

Found in base branch: main

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution (css-what): 5.0.1

Direct dependency fix Resolution (enzyme): 3.10.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-27515 (Medium) detected in url-parse-1.4.4.tgz - autoclosed

CVE-2021-27515 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.4.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.4.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/url-parse/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • sockjs-client-1.3.0.tgz
    • ❌ url-parse-1.4.4.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path.

Publish Date: 2021-02-22

URL: CVE-2021-27515

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27515

Release Date: 2021-02-22

Fix Resolution: 1.5.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-11023 (Medium) detected in jquery-1.8.1.min.js - autoclosed

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: occ-atomic/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: /node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

• ❌ jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-32803 (High) detected in tar-4.4.8.tgz - autoclosed

CVE-2021-32803 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/tar/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • chokidar-2.1.6.tgz
    • fsevents-1.2.9.tgz
      • node-pre-gyp-0.12.0.tgz
        • ❌ tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: fb992651a71bf0cb567f3ce25dfe9e36d69b88eb

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

Publish Date: 2021-08-03

URL: CVE-2021-32803

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r628-mhmh-qjhw

Release Date: 2021-08-03

Fix Resolution: tar - 3.2.3, 4.4.15, 5.0.7, 6.1.2

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-28498 (Medium) detected in elliptic-6.5.3.tgz - autoclosed

CVE-2020-28498 - Medium Severity Vulnerability

Vulnerable Library - elliptic-6.5.3.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.3.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/elliptic/package.json

Dependency Hierarchy:

• webpack-4.39.1.tgz (Root Library)
  • node-libs-browser-2.2.1.tgz
    • crypto-browserify-3.12.0.tgz
      • browserify-sign-4.0.4.tgz
        • ❌ elliptic-6.5.3.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: develop

Vulnerability Details

The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.

Publish Date: 2021-02-02

URL: CVE-2020-28498

CVSS 3 Score Details (6.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28498

Release Date: 2021-02-02

Fix Resolution: v6.5.4

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7720 (High) detected in node-forge-0.7.5.tgz - autoclosed

CVE-2020-7720 - High Severity Vulnerability

Vulnerable Library - node-forge-0.7.5.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/node-forge/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • selfsigned-1.10.4.tgz
    • ❌ node-forge-0.7.5.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

Publish Date: 2020-09-01

URL: CVE-2020-7720

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md

Release Date: 2020-09-04

Fix Resolution: node-forge - 0.10.0

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7608 (Medium) detected in yargs-parser-8.1.0.tgz, yargs-parser-11.1.1.tgz - autoclosed

CVE-2020-7608 - Medium Severity Vulnerability

Vulnerable Libraries - yargs-parser-8.1.0.tgz, yargs-parser-11.1.1.tgz

yargs-parser-8.1.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-8.1.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/yargs-parser/package.json

Dependency Hierarchy:

• jest-22.4.4.tgz (Root Library)
  • jest-cli-22.4.4.tgz
    • yargs-10.1.2.tgz
      • ❌ yargs-parser-8.1.0.tgz (Vulnerable Library)

yargs-parser-11.1.1.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-11.1.1.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/webpack-dev-server/node_modules/yargs-parser/package.json,occ-atomic/node_modules/yargs-parser/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • yargs-12.0.5.tgz
    • ❌ yargs-parser-11.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: yargs/yargs-parser@63810ca

Release Date: 2020-06-05

Fix Resolution: 5.0.1;13.1.2;15.0.1;18.1.1

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-37713 (High) detected in tar-4.4.8.tgz - autoclosed

CVE-2021-37713 - High Severity Vulnerability

Vulnerable Library - tar-4.4.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/tar/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • chokidar-2.1.6.tgz
    • fsevents-1.2.9.tgz
      • node-pre-gyp-0.12.0.tgz
        • ❌ tar-4.4.8.tgz (Vulnerable Library)

Found in HEAD commit: 31fdd81a799b8f96cdae09899abd668af1b3ef09

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

Publish Date: 2021-08-31

URL: CVE-2021-37713

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5955-9wpr-37jh

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.18, 5.0.10, 6.1.9

---

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7774 (High) detected in y18n-4.0.0.tgz - autoclosed

CVE-2020-7774 - High Severity Vulnerability

Vulnerable Library - y18n-4.0.0.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/y18n/package.json

Dependency Hierarchy:

• webpack-dev-server-3.7.2.tgz (Root Library)
  • yargs-12.0.5.tgz
    • ❌ y18n-4.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('proto'); y18n.updateLocale({polluted: true}); console.log(polluted); // true

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution: 3.2.2, 4.0.1, 5.0.5

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-4.17.19.tgz - autoclosed

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.19.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/node_modules/lodash/package.json

Dependency Hierarchy:

• react-docgen-2.21.0.tgz (Root Library)
  • async-2.6.1.tgz
    • ❌ lodash-4.17.19.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@3469357

Release Date: 2021-02-15

Fix Resolution: lodash - 4.17.21

---

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23362 (Medium) detected in hosted-git-info-2.7.1.tgz - autoclosed

CVE-2021-23362 - Medium Severity Vulnerability

Vulnerable Library - hosted-git-info-2.7.1.tgz

Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab

Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.7.1.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/hosted-git-info/package.json

Dependency Hierarchy:

• playroom-0.9.1.tgz (Root Library)
  • read-pkg-up-5.0.0.tgz
    • read-pkg-5.1.1.tgz
      • normalize-package-data-2.5.0.tgz
        • ❌ hosted-git-info-2.7.1.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: main

Vulnerability Details

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Publish Date: 2021-03-23

URL: CVE-2021-23362

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-43f8-2h32-f4cj

Release Date: 2021-03-23

Fix Resolution: hosted-git-info - 2.8.9,3.0.8

---

Step up your Open Source Security Game with WhiteSource here

WS-2020-0218 (High) detected in merge-1.2.1.tgz - autoclosed

WS-2020-0218 - High Severity Vulnerability

Vulnerable Library - merge-1.2.1.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

Library home page: https://registry.npmjs.org/merge/-/merge-1.2.1.tgz

Path to dependency file: occ-atomic/package.json

Path to vulnerable library: occ-atomic/node_modules/merge/package.json

Dependency Hierarchy:

• jest-22.4.4.tgz (Root Library)
  • jest-cli-22.4.4.tgz
    • jest-haste-map-22.4.3.tgz
      • sane-2.5.2.tgz
        • exec-sh-0.2.2.tgz
          • ❌ merge-1.2.1.tgz (Vulnerable Library)

Found in HEAD commit: 974392d6d4c4f898f918b85898ffa84da5def955

Found in base branch: develop

Vulnerability Details

A Prototype Pollution vulnerability was found in merge before 2.1.0 via the merge.recursive function. It can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.

Publish Date: 2020-10-09

URL: WS-2020-0218

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: swordev/merge#38

Release Date: 2020-10-09

Fix Resolution: merge - 2.1.0

---

Step up your Open Source Security Game with WhiteSource here