nexmo-community / phone-number-pool-manager-node Goto Github PK
View Code? Open in Web Editor NEWThis application is a manager for Vonage API virtual phone numbers
License: MIT License
This application is a manager for Vonage API virtual phone numbers
License: MIT License
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/underscore/package.json
Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98
CVE | Severity | Dependency | Type | Fixed in (nedb-promises version) | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2021-23358 | 7.2 | underscore-1.4.4.tgz | Transitive | 5.0.0 | ||
CVE-2021-23395 | 5.3 | nedb-1.8.0.tgz | Transitive | N/A* |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
JavaScript's functional programming helper library.
Library home page: https://registry.npmjs.org/underscore/-/underscore-1.4.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/underscore/package.json
Dependency Hierarchy:
Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98
Found in base branch: main
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Publish Date: 2021-03-29
URL: CVE-2021-23358
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358
Release Date: 2021-03-29
Fix Resolution (underscore): 1.12.1
Direct dependency fix Resolution (nedb-promises): 5.0.0
File-based embedded data store for node.js
Library home page: https://registry.npmjs.org/nedb/-/nedb-1.8.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nedb/package.json
Dependency Hierarchy:
Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98
Found in base branch: main
This affects all versions of package nedb. The library could be tricked into adding or modifying properties of Object.prototype using a proto or constructor.prototype payload.
Publish Date: 2021-06-15
URL: CVE-2021-23395
Base Score Metrics:
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/axios/package.json
Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98
CVE | Severity | Dependency | Type | Fixed in (axios version) | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2021-3749 | 7.5 | axios-0.19.2.tgz | Direct | 0.20.0 | ||
CVE-2022-0155 | 6.5 | follow-redirects-1.5.10.tgz | Transitive | 0.20.0-0 | ||
CVE-2022-0536 | 5.9 | follow-redirects-1.5.10.tgz | Transitive | 0.20.0-0 | ||
CVE-2020-28168 | 5.9 | axios-0.19.2.tgz | Direct | 0.21.1 | ✅ |
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/axios/package.json
Dependency Hierarchy:
Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98
Found in base branch: main
axios is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-08-31
URL: CVE-2021-3749
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/
Release Date: 2021-08-31
Fix Resolution: 0.20.0
⛑️ Automatic Remediation is available for this issue
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Dependency Hierarchy:
Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98
Found in base branch: main
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
Publish Date: 2022-01-10
URL: CVE-2022-0155
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/
Release Date: 2022-01-10
Fix Resolution (follow-redirects): 1.14.7
Direct dependency fix Resolution (axios): 0.20.0-0
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.5.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Dependency Hierarchy:
Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98
Found in base branch: main
Exposure of Sensitive Information to an Unauthorized Actor in NPM follow-redirects prior to 1.14.8.
Publish Date: 2022-02-09
URL: CVE-2022-0536
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536
Release Date: 2022-02-09
Fix Resolution (follow-redirects): 1.14.8
Direct dependency fix Resolution (axios): 0.20.0-0
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/axios/package.json
Dependency Hierarchy:
Found in HEAD commit: 7aa742cf79633e383b8b8adfc730c5a72d355f98
Found in base branch: main
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
Publish Date: 2020-11-06
URL: CVE-2020-28168
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-11-06
Fix Resolution: 0.21.1
⛑️ Automatic Remediation is available for this issue.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.