Git Product home page Git Product logo

phone-number-pool-manager-node's Introduction

Vonage

Virtual Phone Number Pool Manager

This application is a manager for Vonage API virtual phone numbers. With it, users can create, edit and cancel numbers.

A full blog post on how this project was built can be found on the Vonage Developer Blog

Vonage

Set up

Local Set Up

  1. Run the following terminal commands to download the repo and oinstall dependencies
git clone https://github.com/nexmo-community/phone-number-pool-manager-node
cd phone-number-pool-manager-node
npm install
  1. Populate the .env file with your credentials
  2. In server.js, change the CORS URL and server port on the last line
  3. Run node server.js

Glitch Set Up

  1. Click this button to create a new Glitch project based on this application
    Remix on Glitch
  2. Populate the .env file with your credentials
  3. Click Show at the top of your Glitch editor and open your working application

Code of Conduct

In the interest of fostering an open and welcoming environment, we strive to make participation in our project and our community a harassment-free experience for everyone. Please check out our Code of Conduct in full.

Contributing

We ❤️ contributions from everyone! Check out the Contributing Guidelines for more information.

contributions welcome

License

This project is subject to the MIT License

phone-number-pool-manager-node's People

Stargazers

avatar

Watchers

avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar avatar

phone-number-pool-manager-node's Issues

axios-0.19.2.tgz: 4 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (axios version) Remediation Available
CVE-2021-3749 High 7.5 axios-0.19.2.tgz Direct 0.20.0 ✅
CVE-2022-0155 Medium 6.5 follow-redirects-1.5.10.tgz Transitive 0.20.0-0 ✅
CVE-2022-0536 Medium 5.9 follow-redirects-1.5.10.tgz Transitive 0.20.0-0 ✅
CVE-2020-28168 Medium 5.9 axios-0.19.2.tgz Direct 0.21.1 ✅

Details

CVE-2021-3749

Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • ❌ axios-0.19.2.tgz (Vulnerable Library)

Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98

Found in base branch: main

Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/

Release Date: 2021-08-31

Fix Resolution: 0.20.0

⛑️ Automatic Remediation is available for this issue

CVE-2022-0155

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • axios-0.19.2.tgz (Root Library)
    • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98

Found in base branch: main

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (axios): 0.20.0-0

⛑️ Automatic Remediation is available for this issue

CVE-2022-0536

Vulnerable Library - follow-redirects-1.5.10.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • axios-0.19.2.tgz (Root Library)
    • ❌ follow-redirects-1.5.10.tgz (Vulnerable Library)

Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98

Found in base branch: main

Vulnerability Details

Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.

Publish Date: 2022-02-09

URL: CVE-2022-0536

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536

Release Date: 2022-02-09

Fix Resolution (follow-redirects): 1.14.8

Direct dependency fix Resolution (axios): 0.20.0-0

⛑️ Automatic Remediation is available for this issue

CVE-2020-28168

Vulnerable Library - axios-0.19.2.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

  • ❌ axios-0.19.2.tgz (Vulnerable Library)

Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98

Found in base branch: main

Vulnerability Details

Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.

Publish Date: 2020-11-06

URL: CVE-2020-28168

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-11-06

Fix Resolution: 0.21.1

⛑️ Automatic Remediation is available for this issue

⛑️ Automatic Remediation is available for this issue.

nedb-promises-4.1.5.tgz: 2 vulnerabilities (highest severity is: 7.2)

Vulnerable Library - nedb-promises-4.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/underscore/package.json

Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (nedb-promises version) Remediation Available
CVE-2021-23358 High 7.2 underscore-1.4.4.tgz Transitive 5.0.0 ✅
CVE-2021-23395 Medium 5.3 nedb-1.8.0.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2021-23358

Vulnerable Library - underscore-1.4.4.tgz

JavaScript's functional programming helper library.

Library home page: https://registry.npmjs.org/underscore/-/underscore-1.4.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/underscore/package.json

Dependency Hierarchy:

  • nedb-promises-4.1.5.tgz (Root Library)
    • nedb-1.8.0.tgz
      • ❌ underscore-1.4.4.tgz (Vulnerable Library)

Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98

Found in base branch: main

Vulnerability Details

The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.

Publish Date: 2021-03-29

URL: CVE-2021-23358

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358

Release Date: 2021-03-29

Fix Resolution (underscore): 1.12.1

Direct dependency fix Resolution (nedb-promises): 5.0.0

⛑️ Automatic Remediation is available for this issue

CVE-2021-23395

Vulnerable Library - nedb-1.8.0.tgz

File-based embedded data store for node.js

Library home page: https://registry.npmjs.org/nedb/-/nedb-1.8.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nedb/package.json

Dependency Hierarchy:

  • nedb-promises-4.1.5.tgz (Root Library)
    • ❌ nedb-1.8.0.tgz (Vulnerable Library)

Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98

Found in base branch: main

Vulnerability Details

This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a proto or constructor.prototype payload.

Publish Date: 2021-06-15

URL: CVE-2021-23395

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

⛑️ Automatic Remediation is available for this issue.

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.