rgordon95 / confusionang Goto Github PK
View Code? Open in Web Editor NEWAngular Confusion Project
Angular Confusion Project
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in base branch: assn4
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-07-26
URL: CVE-2019-10744
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-jf85-cpcp-j695
Release Date: 2019-07-26
Fix Resolution (lodash): 4.17.12
Direct dependency fix Resolution (@angular/cli): 1.7.0
Step up your Open Source Security Game with Mend here
node.js realtime framework server
Library home page: https://registry.npmjs.org/socket.io/-/socket.io-2.0.4.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/socket.io/package.json
Dependency Hierarchy:
Found in base branch: assn4
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
Publish Date: 2021-01-19
URL: CVE-2020-28481
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28481
Release Date: 2021-01-19
Fix Resolution (socket.io): 2.4.0
Direct dependency fix Resolution (karma): 5.0.8
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693.
Publish Date: 2019-01-14
URL: CVE-2019-6286
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-07-23
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.
Library home page: https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/mixin-deep/package.json
Dependency Hierarchy:
Found in base branch: assn4
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-08-23
URL: CVE-2019-10746
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-08-23
Fix Resolution (mixin-deep): 1.3.2
Direct dependency fix Resolution (@angular/cli): 1.7.0
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: conFusionAng/node_modules/handlebars/package.json
Dependency Hierarchy:
Arbitrary Code Execution vulnerability found in handlebars before 4.5.3. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.It is due to an incomplete fix for a WS-2019-0331.
Publish Date: 2019-11-17
URL: WS-2019-0332
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1324
Release Date: 2019-11-17
Fix Resolution: handlebars - 4.5.3
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.
Publish Date: 2019-01-14
URL: CVE-2019-6284
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-6284
Release Date: 2019-01-14
Fix Resolution (node-sass): 5.0.0
Direct dependency fix Resolution (@angular/cli): 6.0.0
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp).
Publish Date: 2019-04-23
URL: CVE-2018-20822
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-04-23
Fix Resolution (node-sass): 4.13.1
Direct dependency fix Resolution (@angular/cli): 1.7.0
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly() which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
Publish Date: 2018-06-04
URL: CVE-2018-11697
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-06-04
Fix Resolution (node-sass): 4.14.0
Direct dependency fix Resolution (@angular/cli): 1.7.0
Step up your Open Source Security Game with Mend here
Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.
Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /tmp/git/conFusionAng/node_modules/braces/package.json
Dependency Hierarchy:
Fastest brace expansion lib. Typically used with file paths, but can be used with any string. Expands comma-separated values (e.g. `foo/{a,b,c}/bar`) and alphabetical or numerical ranges (e.g. `{1..9}`)
Library home page: https://registry.npmjs.org/braces/-/braces-0.1.5.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /tmp/git/conFusionAng/node_modules/expand-braces/node_modules/braces/package.json
Dependency Hierarchy:
Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.
Publish Date: 2019-03-25
URL: WS-2019-0019
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/786
Release Date: 2019-02-21
Fix Resolution: 2.3.1
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.
Publish Date: 2018-12-03
URL: CVE-2018-19827
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-12-03
Fix Resolution: GR.PageRender.Razor - 1.8.0;Fable.Template.Elmish.React - 0.1.6
Step up your Open Source Security Game with Mend here
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-2.2.1.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /tmp/git/conFusionAng/node_modules/tar/package.json
Dependency Hierarchy:
Versions of node-tar prior to 4.4.2 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.
Publish Date: 2019-04-05
URL: WS-2019-0047
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/803
Release Date: 2019-04-05
Fix Resolution: 4.4.2
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().
Publish Date: 2018-12-04
URL: CVE-2018-19838
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-12-04
Fix Resolution (node-sass): 4.14.0
Direct dependency fix Resolution (@angular/cli): 1.7.0
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/handlebars/package.json
Dependency Hierarchy:
Found in base branch: assn4
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Mend Note: Converted from WS-2019-0368, on 2022-11-08.
Publish Date: 2019-12-20
URL: CVE-2019-19919
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-w457-6q6x-cgp9
Release Date: 2019-12-20
Fix Resolution (handlebars): 4.3.0
Direct dependency fix Resolution (karma-coverage-istanbul-reporter): 2.0.0
Step up your Open Source Security Game with Mend here
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.7.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/serialize-javascript/package.json
Dependency Hierarchy:
Found in base branch: assn4
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Publish Date: 2020-06-01
URL: CVE-2020-7660
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660
Release Date: 2020-06-08
Fix Resolution (serialize-javascript): 3.1.0
Direct dependency fix Resolution (@angular/cli): 6.0.0
Step up your Open Source Security Game with Mend here
General purpose node utilities
Library home page: https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/hoek/package.json
Dependency Hierarchy:
Found in base branch: assn4
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Publish Date: 2018-03-30
URL: CVE-2018-3728
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16082
Release Date: 2018-03-30
Fix Resolution (hoek): 4.2.0
Direct dependency fix Resolution (@angular/cli): 6.0.0
Step up your Open Source Security Game with Mend here
ECMAScript parser
Library home page: https://registry.npmjs.org/acorn/-/acorn-5.7.3.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/acorn/package.json
Dependency Hierarchy:
Found in base branch: assn4
acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.
Publish Date: 2020-03-01
URL: WS-2020-0042
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-6chw-6frg-f759
Release Date: 2020-03-01
Fix Resolution (acorn): 5.7.4
Direct dependency fix Resolution (@angular/cli): 1.7.0
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.
Publish Date: 2018-06-04
URL: CVE-2018-11694
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-06-04
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
An HTTP(s) proxy `http.Agent` implementation for HTTPS
Library home page: https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-1.0.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/saucelabs/node_modules/https-proxy-agent/package.json
Dependency Hierarchy:
Found in base branch: assn4
https-proxy-agent before 2.1.1 passes auth option to the Buffer constructor without proper sanitization, resulting in DoS and uninitialized memory leak in setups where an attacker could submit typed input to the 'auth' parameter (e.g. JSON).
Publish Date: 2018-06-07
URL: CVE-2018-3739
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3739
Release Date: 2018-04-26
Fix Resolution (https-proxy-agent): 2.2.0
Direct dependency fix Resolution (protractor): 5.3.2
Step up your Open Source Security Game with Mend here
🌈 Node.js bindings to libsass
Library home page: https://github.com/sass/node-sass.git
* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skip_over_scopes which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
Publish Date: 2018-06-04
URL: CVE-2018-11693
Base Score Metrics:
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.
Publish Date: 2018-12-04
URL: CVE-2018-19839
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-12-04
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.
Publish Date: 2018-12-03
URL: CVE-2018-19797
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-12-03
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
SockJS-node is a server counterpart of SockJS-client a JavaScript library that provides a WebSocket-like object in the browser. SockJS gives you a coherent, cross-browser, Javascript API which creates a low latency, full duplex, cross-domain communication
Library home page: https://registry.npmjs.org/sockjs/-/sockjs-0.3.19.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/sockjs/package.json
Dependency Hierarchy:
Found in base branch: assn4
Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.
Publish Date: 2020-07-09
URL: CVE-2020-7693
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-07-14
Fix Resolution (sockjs): 0.3.20
Direct dependency fix Resolution (@angular/cli): 6.0.0
Step up your Open Source Security Game with Mend here
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/union-value/node_modules/set-value/package.json
Dependency Hierarchy:
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/set-value/package.json
Dependency Hierarchy:
Found in base branch: assn4
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.
Publish Date: 2019-08-23
URL: CVE-2019-10747
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-08-23
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (@angular/cli): 1.7.0
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (@angular/cli): 1.7.0
Step up your Open Source Security Game with Mend here
🌈 Node.js bindings to libsass
Library home page: https://github.com/sass/node-sass.git
* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.
An issue was discovered in LibSass through 3.5.2. A NULL pointer dereference was found in the function Sass::Expand::operator which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.
Publish Date: 2018-06-04
URL: CVE-2018-11695
Base Score Metrics:
Step up your Open Source Security Game with WhiteSource here
An HTTP(s) proxy `http.Agent` implementation for HTTPS
Library home page: https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-1.0.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: conFusionAng/node_modules/saucelabs/node_modules/https-proxy-agent/package.json
Dependency Hierarchy:
Versions of https-proxy-agent before 2.2.0 are vulnerable to a denial of service. This is due to unsanitized options (proxy.auth) being passed to Buffer().
Publish Date: 2018-02-28
URL: WS-2018-0072
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/593
Release Date: 2018-02-28
Fix Resolution: 2.2.0
Step up your Open Source Security Game with WhiteSource here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: conFusionAng/node_modules/handlebars/package.json
Dependency Hierarchy:
handlebars before 3.0.8 and 4.x before 4.5.2 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.
Publish Date: 2019-11-14
URL: WS-2019-0493
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1316
Release Date: 2019-11-14
Fix Resolution: handlebars - 3.0.8,4.5.2
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp).
Publish Date: 2019-04-23
URL: CVE-2018-20821
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-04-23
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp.
Publish Date: 2019-11-06
URL: CVE-2019-18797
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-18797
Release Date: 2019-11-06
Fix Resolution (node-sass): 4.14.0
Direct dependency fix Resolution (@angular/cli): 1.7.0
Step up your Open Source Security Game with Mend here
🌈 Node.js bindings to libsass
Library home page: https://github.com/sass/node-sass.git
Found in base branch: assn4
** DISPUTED ** In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::String_Quoted*) stack frame) may cause a Denial of Service via crafted sass input files with stray '&' or '/' characters. NOTE: Upstream comments indicate this issue is closed as "won't fix" and "works as intended" by design.
Publish Date: 2018-12-03
URL: CVE-2018-19826
Base Score Metrics:
Step up your Open Source Security Game with Mend here
A querystring parser that supports nesting and arrays, with a depth limit
Library home page: https://registry.npmjs.org/qs/-/qs-6.2.3.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /tmp/git/conFusionAng/node_modules/loggly/node_modules/qs/package.json
Dependency Hierarchy:
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.
Publish Date: 2017-07-17
URL: CVE-2017-1000048
Base Score Metrics:
Type: Change files
Origin: ljharb/qs@c709f6e
Release Date: 2017-03-06
Fix Resolution: Replace or update the following files: parse.js, parse.js, utils.js
Step up your Open Source Security Game with WhiteSource here
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.15.3.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/axios/package.json
Dependency Hierarchy:
Found in base branch: assn4
Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.
Publish Date: 2019-05-07
URL: CVE-2019-10742
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-42xw-2xvc-qx8m
Release Date: 2019-05-07
Fix Resolution (axios): 0.18.1
Direct dependency fix Resolution (karma): 3.0.0
Step up your Open Source Security Game with Mend here
A Javascript implementation of zip for nodejs. Allows user to create or extract zip files both in memory or to/from disk
Library home page: https://registry.npmjs.org/adm-zip/-/adm-zip-0.4.4.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/webdriver-js-extender/node_modules/adm-zip/package.json
Dependency Hierarchy:
Found in base branch: assn4
adm-zip npm library before 0.4.9 is vulnerable to directory traversal, allowing attackers to write to arbitrary files via a ../ (dot dot slash) in a Zip archive entry that is mishandled during extraction. This vulnerability is also known as 'Zip-Slip'.
Mend Note: Converted from WS-2019-0231, on 2021-08-17.
Publish Date: 2018-07-25
URL: CVE-2018-1002204
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-1002204
Release Date: 2018-07-25
Fix Resolution (adm-zip): 0.4.9
Direct dependency fix Resolution (protractor): 5.4.0
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: conFusionAng/node_modules/handlebars/package.json
Dependency Hierarchy:
In "showdownjs/showdown", versions prior to v4.4.5 are vulnerable against Regular expression Denial of Service (ReDOS) once receiving specially-crafted templates.
Publish Date: 2019-10-20
URL: WS-2019-0318
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1300
Release Date: 2019-10-20
Fix Resolution: handlebars - 4.4.5
Step up your Open Source Security Game with WhiteSource here
HTTP proxy tunneling agent. Formerly part of mikeal/request, now a standalone module.
Library home page: https://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.4.3.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/loggly/node_modules/tunnel-agent/package.json
Dependency Hierarchy:
Found in base branch: assn4
Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure. This is exploitable if user supplied input is provided to the auth value and is a number.
Publish Date: 2017-03-05
URL: WS-2018-0076
Base Score Metrics:
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/598
Release Date: 2017-03-05
Fix Resolution (tunnel-agent): 0.6.0
Direct dependency fix Resolution (karma): 3.0.0
Step up your Open Source Security Game with Mend here
YAML 1.2 parser and serializer
Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.7.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/js-yaml/package.json
Dependency Hierarchy:
Found in base branch: assn4
Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.
Publish Date: 2019-03-20
URL: WS-2019-0032
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/788/versions
Release Date: 2019-03-20
Fix Resolution (js-yaml): 3.13.0
Direct dependency fix Resolution (tslint): 5.10.0
Step up your Open Source Security Game with Mend here
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-1.1.5.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: conFusionAng/node_modules/webdriver-js-extender/node_modules/ws/package.json
Dependency Hierarchy:
Affected version of ws (0.2.6 through 3.3.0 excluding 0.3.4-2, 0.3.5-2, 0.3.5-3, 0.3.5-4, 1.1.5, 2.0.0-beta.0, 2.0.0-beta.1 and 2.0.0-beta.2) are vulnerable to A specially crafted value of the Sec-WebSocket-Extensions header that used Object.prototype property names as extension or parameter names could be used to make a ws server crash.
Publish Date: 2017-11-08
URL: WS-2017-0421
Base Score Metrics:
Type: Upgrade version
Origin: websockets/ws@c4fe466
Release Date: 2017-11-08
Fix Resolution: ws - 3.3.1
Step up your Open Source Security Game with WhiteSource here
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.15.3.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/axios/package.json
Dependency Hierarchy:
Found in base branch: assn4
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
Publish Date: 2020-11-06
URL: CVE-2020-28168
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-11-06
Fix Resolution (axios): 0.21.1
Direct dependency fix Resolution (karma): 3.0.0
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.
Publish Date: 2018-05-26
URL: CVE-2018-11499
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-05-26
Fix Resolution (node-sass): 4.14.0
Direct dependency fix Resolution (@angular/cli): 1.7.0
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: conFusionAng/node_modules/handlebars/package.json
Dependency Hierarchy:
Arbitrary Code Execution vulnerability found in handlebars before 4.5.2. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.
Publish Date: 2019-11-13
URL: WS-2019-0331
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1316
Release Date: 2019-12-05
Fix Resolution: handlebars - 4.5.2
Step up your Open Source Security Game with WhiteSource here
A JavaScript TimeSpan library for node.js (and soon the browser)
Library home page: https://registry.npmjs.org/timespan/-/timespan-2.3.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/timespan/package.json
Dependency Hierarchy:
Found in base branch: assn4
The timespan module is vulnerable to regular expression denial of service. Given 50k characters of untrusted user input it will block the event loop for around 10 seconds.
Publish Date: 2018-06-07
URL: CVE-2017-16115
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: conFusionAng/node_modules/handlebars/package.json
Dependency Hierarchy:
handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.
Publish Date: 2019-11-19
URL: WS-2019-0492
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1324
Release Date: 2019-11-19
Fix Resolution: handlebars - 3.0.8,4.5.3
Step up your Open Source Security Game with WhiteSource here
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.7.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/serialize-javascript/package.json
Dependency Hierarchy:
Found in base branch: assn4
The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.
Publish Date: 2019-12-05
URL: CVE-2019-16769
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16769
Release Date: 2019-12-05
Fix Resolution (serialize-javascript): 2.1.1
Direct dependency fix Resolution (@angular/cli): 6.0.0
Step up your Open Source Security Game with Mend here
Get the native type of a value.
Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/randomatic/node_modules/kind-of/package.json
Dependency Hierarchy:
Found in base branch: assn4
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Publish Date: 2019-12-30
URL: CVE-2019-20149
Base Score Metrics:
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149
Release Date: 2019-12-30
Fix Resolution (kind-of): 6.0.3
Direct dependency fix Resolution (@angular/cli): 1.7.0
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.
Publish Date: 2019-01-14
URL: CVE-2019-6283
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-01-14
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
YAML 1.2 parser and serializer
Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.7.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/js-yaml/package.json
Dependency Hierarchy:
Found in base branch: assn4
Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.
Publish Date: 2019-04-05
URL: WS-2019-0063
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/813
Release Date: 2019-04-05
Fix Resolution (js-yaml): 3.13.1
Direct dependency fix Resolution (tslint): 5.10.0
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.12.0.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in base branch: assn4
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.
Publish Date: 2018-12-17
URL: CVE-2018-20190
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-12-17
Fix Resolution: GR.PageRender.Razor - 1.8.0;Fable.Template.Elmish.React - 0.1.6
Step up your Open Source Security Game with Mend here
General purpose crypto utilities
Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-2.0.5.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/cryptiles/package.json
Dependency Hierarchy:
Found in base branch: assn4
Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.
Publish Date: 2018-07-09
URL: CVE-2018-1000620
Base Score Metrics:
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620
Release Date: 2018-07-09
Fix Resolution (cryptiles): 4.1.2
Direct dependency fix Resolution (@angular/cli): 6.0.0
Step up your Open Source Security Game with Mend here
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in base branch: assn4
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Publish Date: 2021-02-15
URL: CVE-2021-23337
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-35jh-r3h4-6jhm
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (@angular/cli): 1.7.0
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz
Path to dependency file: /conFusionAng/package.json
Path to vulnerable library: conFusionAng/node_modules/handlebars/package.json
Dependency Hierarchy:
In handlebars, versions prior to v4.5.3 are vulnerable to prototype pollution. Using a malicious template it's possbile to add or modify properties to the Object prototype. This can also lead to DOS and RCE in certain conditions.
Publish Date: 2019-11-18
URL: WS-2019-0333
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1325
Release Date: 2019-11-18
Fix Resolution: handlebars - 4.5.3
Step up your Open Source Security Game with WhiteSource here
🌈 Node.js bindings to libsass
Library home page: https://github.com/sass/node-sass.git
Found in base branch: assn4
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
Publish Date: 2018-06-04
URL: CVE-2018-11698
Base Score Metrics:
Step up your Open Source Security Game with Mend here
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.