Git Product home page Git Product logo

pipelines-dotnet-core's People

Contributors

adventworks avatar alexhomer1 avatar andyjlewis avatar mend-bolt-for-github[bot] avatar microsoftopensource avatar msftgits avatar pboramsft avatar sharkness avatar vijayma avatar vijaymatest1 avatar vinodjo avatar

pipelines-dotnet-core's Issues

CVE-2018-8292 (High) detected in system.net.http.4.3.0.nupkg

CVE-2018-8292 - High Severity Vulnerability

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that...

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.authentication.jwtbearer.2.2.0.nupkg (Root Library)
    • microsoft.identitymodel.protocols.openidconnect.5.3.0.nupkg
      • microsoft.identitymodel.protocols.5.3.0.nupkg
        • system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: dotnet/announcements#88

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1


Step up your Open Source Security Game with WhiteSource here

CVE-2019-0548 (High) detected in multiple libraries

CVE-2019-0548 - High Severity Vulnerability

Vulnerable Libraries - microsoft.netcore.dotnethostresolver.2.2.0.nupkg, microsoft.netcore.dotnethostpolicy.2.2.0.nupkg, microsoft.netcore.app.2.2.0.nupkg, microsoft.aspnetcore.2.2.0.nupkg, microsoft.aspnetcore.server.iisintegration.2.2.0.nupkg, microsoft.aspnetcore.diagnostics.entityframeworkcore.2.2.0.nupkg, microsoft.aspnetcore.server.iis.2.2.0.nupkg, microsoft.aspnetcore.server.kestrel.transport.sockets.2.2.0.nupkg, microsoft.aspnetcore.websockets.2.2.0.nupkg, microsoft.netcore.dotnetapphost.2.2.0.nupkg

microsoft.netcore.dotnethostresolver.2.2.0.nupkg

Provides an implementation of framework resolution strategy used by Microsoft.NETCore.DotNetHost 12...

Library home page: https://api.nuget.org/packages/microsoft.netcore.dotnethostresolver.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/microsoft.netcore.dotnethostresolver/2.2.0/microsoft.netcore.dotnethostresolver.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.2.0.nupkg (Root Library)
    • microsoft.netcore.dotnethostpolicy.2.2.0.nupkg
      • microsoft.netcore.dotnethostresolver.2.2.0.nupkg (Vulnerable Library)
microsoft.netcore.dotnethostpolicy.2.2.0.nupkg

Provides a CoreCLR hosting policy implementation -- configuration settings, assembly paths and assem...

Library home page: https://api.nuget.org/packages/microsoft.netcore.dotnethostpolicy.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/microsoft.netcore.dotnethostpolicy/2.2.0/microsoft.netcore.dotnethostpolicy.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.2.0.nupkg (Root Library)
    • microsoft.netcore.dotnethostpolicy.2.2.0.nupkg (Vulnerable Library)
microsoft.netcore.app.2.2.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. 1249f08feda72b116...

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: ckFolder/microsoft.netcore.app/2.2.0/microsoft.netcore.app.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.2.0.nupkg (Vulnerable Library)
microsoft.aspnetcore.2.2.0.nupkg

Microsoft.AspNetCore

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: ckFolder/microsoft.aspnetcore/2.2.0/microsoft.aspnetcore.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.2.0.nupkg (Vulnerable Library)
microsoft.aspnetcore.server.iisintegration.2.2.0.nupkg

ASP.NET Core components for working with the IIS AspNetCoreModule.

This package was built from the ...

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.iisintegration.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/microsoft.aspnetcore.server.iisintegration/2.2.0/microsoft.aspnetcore.server.iisintegration.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.2.0.nupkg (Root Library)
    • microsoft.aspnetcore.server.iisintegration.2.2.0.nupkg (Vulnerable Library)
microsoft.aspnetcore.diagnostics.entityframeworkcore.2.2.0.nupkg

ASP.NET Core middleware for Entity Framework Core error pages. Use this middleware to detect and dia...

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.diagnostics.entityframeworkcore.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: ckFolder/microsoft.aspnetcore.diagnostics.entityframeworkcore/2.2.0/microsoft.aspnetcore.diagnostics.entityframeworkcore.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.diagnostics.entityframeworkcore.2.2.0.nupkg (Vulnerable Library)
microsoft.aspnetcore.server.iis.2.2.0.nupkg

Provides support for hosting ASP.NET Core in IIS using the AspNetCoreModule.

This package was built...

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.iis.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/microsoft.aspnetcore.server.iis/2.2.0/microsoft.aspnetcore.server.iis.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.2.0.nupkg (Root Library)
    • microsoft.aspnetcore.server.iis.2.2.0.nupkg (Vulnerable Library)
microsoft.aspnetcore.server.kestrel.transport.sockets.2.2.0.nupkg

Managed socket transport for the ASP.NET Core Kestrel cross-platform web server.

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.kestrel.transport.sockets.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/microsoft.aspnetcore.server.kestrel.transport.sockets/2.2.0/microsoft.aspnetcore.server.kestrel.transport.sockets.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.2.0.nupkg (Root Library)
    • microsoft.aspnetcore.server.kestrel.2.2.0.nupkg
      • microsoft.aspnetcore.server.kestrel.transport.sockets.2.2.0.nupkg (Vulnerable Library)
microsoft.aspnetcore.websockets.2.2.0.nupkg

ASP.NET Core web socket middleware for use on top of opaque servers.

This package was built from th...

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.websockets.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/microsoft.aspnetcore.websockets/2.2.0/microsoft.aspnetcore.websockets.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.signalr.1.1.0.nupkg (Root Library)
    • microsoft.aspnetcore.http.connections.1.1.0.nupkg
      • microsoft.aspnetcore.websockets.2.2.0.nupkg (Vulnerable Library)
microsoft.netcore.dotnetapphost.2.2.0.nupkg

Provides the .NET Core app bootstrapper intended for use in the application directory 1249f08feda72...

Library home page: https://api.nuget.org/packages/microsoft.netcore.dotnetapphost.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/microsoft.netcore.dotnetapphost/2.2.0/microsoft.netcore.dotnetapphost.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.2.0.nupkg (Root Library)
    • microsoft.netcore.dotnethostpolicy.2.2.0.nupkg
      • microsoft.netcore.dotnethostresolver.2.2.0.nupkg
        • microsoft.netcore.dotnetapphost.2.2.0.nupkg (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.2, ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0564.

Publish Date: 2019-01-08

URL: CVE-2019-0548

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: aspnet/Announcements#335

Release Date: 2019-01-08

Fix Resolution: Microsoft.AspNetCore.SignalR - 1.1.0; Microsoft.AspNetCore.Server.Kestrel.Transport.Sockets - 2.2.1; Microsoft.AspNetCore.Server.IIS - 2.2.1; Microsoft.AspNetCore.Server.IISIntegration - 2.2.1;Microsoft.AspNetCore.Server.Kestrel.Core - 2.1.7


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1302 (High) detected in microsoft.aspnetcore.spaservices.2.2.0.nupkg, microsoft.netcore.app.2.2.0.nupkg

CVE-2019-1302 - High Severity Vulnerability

Vulnerable Libraries - microsoft.aspnetcore.spaservices.2.2.0.nupkg, microsoft.netcore.app.2.2.0.nupkg

microsoft.aspnetcore.spaservices.2.2.0.nupkg

Helpers for building single-page applications on ASP.NET MVC Core.

This package was built from the ...

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.spaservices.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/microsoft.aspnetcore.spaservices/2.2.0/microsoft.aspnetcore.spaservices.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.spaservices.extensions.2.2.0.nupkg (Root Library)
    • microsoft.aspnetcore.spaservices.2.2.0.nupkg (Vulnerable Library)
microsoft.netcore.app.2.2.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. 1249f08feda72b116...

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: ckFolder/microsoft.netcore.app/2.2.0/microsoft.netcore.app.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.2.0.nupkg (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

An elevation of privilege vulnerability exists when a ASP.NET Core web application, created using vulnerable project templates, fails to properly sanitize web requests, aka 'ASP.NET Core Elevation Of Privilege Vulnerability'.

Publish Date: 2019-09-11

URL: CVE-2019-1302

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: aspnet/Announcements#384

Release Date: 2019-09-11

Fix Resolution: Microsoft.AspNetCore.SpaServices - 2.2.1,2.1.2


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1075 (Medium) detected in microsoft.aspnetcore.server.httpsys.2.2.0.nupkg, microsoft.aspnetcore.server.iis.2.2.0.nupkg

CVE-2019-1075 - Medium Severity Vulnerability

Vulnerable Libraries - microsoft.aspnetcore.server.httpsys.2.2.0.nupkg, microsoft.aspnetcore.server.iis.2.2.0.nupkg

microsoft.aspnetcore.server.httpsys.2.2.0.nupkg

ASP.NET Core HTTP server that uses the Windows HTTP Server API.

This package was built from the sou...

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.httpsys.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: ckFolder/microsoft.aspnetcore.server.httpsys/2.2.0/microsoft.aspnetcore.server.httpsys.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.server.httpsys.2.2.0.nupkg (Vulnerable Library)
microsoft.aspnetcore.server.iis.2.2.0.nupkg

Provides support for hosting ASP.NET Core in IIS using the AspNetCoreModule.

This package was built...

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.server.iis.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/microsoft.aspnetcore.server.iis/2.2.0/microsoft.aspnetcore.server.iis.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.2.2.0.nupkg (Root Library)
    • microsoft.aspnetcore.server.iis.2.2.0.nupkg (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

A spoofing vulnerability exists in ASP.NET Core that could lead to an open redirect, aka 'ASP.NET Core Spoofing Vulnerability'.

Publish Date: 2019-07-15

URL: CVE-2019-1075

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-1075

Release Date: 2019-07-15

Fix Resolution: v2.1.12,v2.2.6


Step up your Open Source Security Game with WhiteSource here

CVE-2020-11022 (Medium) detected in jquery-3.3.1.min.js, jquery-3.3.1.js

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.3.1.min.js, jquery-3.3.1.js

jquery-3.3.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.min.js

Dependency Hierarchy:

  • jquery-3.3.1.min.js (Vulnerable Library)
jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.js

Dependency Hierarchy:

  • jquery-3.3.1.js (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-11358 (Medium) detected in jquery-3.3.1.js, jquery-3.3.1.min.js

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.3.1.js, jquery-3.3.1.min.js

jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.js

Dependency Hierarchy:

  • jquery-3.3.1.js (Vulnerable Library)
jquery-3.3.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.min.js

Dependency Hierarchy:

  • jquery-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0


Step up your Open Source Security Game with WhiteSource here

CVE-2020-11023 (Medium) detected in jquery-3.3.1.js, jquery-3.3.1.min.js

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.3.1.js, jquery-3.3.1.min.js

jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.js

Dependency Hierarchy:

  • jquery-3.3.1.js (Vulnerable Library)
jquery-3.3.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.min.js

Dependency Hierarchy:

  • jquery-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0


Step up your Open Source Security Game with WhiteSource here

CVE-2021-21252 (High) detected in jquery.validate-1.17.0.min.js, jquery.validate-1.17.0.js

CVE-2021-21252 - High Severity Vulnerability

Vulnerable Libraries - jquery.validate-1.17.0.min.js, jquery.validate-1.17.0.js

jquery.validate-1.17.0.min.js

Client-side form validation made easy

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/jquery.validate.min.js

Path to vulnerable library: /wwwroot/lib/jquery-validation/dist/jquery.validate.min.js

Dependency Hierarchy:

  • jquery.validate-1.17.0.min.js (Vulnerable Library)
jquery.validate-1.17.0.js

Client-side form validation made easy

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/jquery.validate.js

Path to vulnerable library: /wwwroot/lib/jquery-validation/dist/jquery.validate.js

Dependency Hierarchy:

  • jquery.validate-1.17.0.js (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.

Publish Date: 2021-01-13

URL: CVE-2021-21252

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jxwx-85vp-gvwm

Release Date: 2021-01-13

Fix Resolution: jquery-validation - 1.19.3


Step up your Open Source Security Game with WhiteSource here

CVE-2019-0820 (High) detected in system.text.regularexpressions.4.3.0.nupkg

CVE-2019-0820 - High Severity Vulnerability

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.authentication.jwtbearer.2.2.0.nupkg (Root Library)
    • microsoft.identitymodel.protocols.openidconnect.5.3.0.nupkg
      • microsoft.identitymodel.protocols.5.3.0.nupkg
        • microsoft.identitymodel.tokens.5.3.0.nupkg
          • system.runtime.serialization.xml.4.3.0.nupkg
            • system.private.datacontractserialization.4.3.0.nupkg
              • system.xml.xdocument.4.3.0.nupkg
                • system.xml.readerwriter.4.3.0.nupkg
                  • system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2020-08-24

Fix Resolution: System.Text.RegularExpressions - 4.3.1


Step up your Open Source Security Game with WhiteSource here

CVE-2019-0545 (High) detected in microsoft.netcore.app.2.2.0.nupkg

CVE-2019-0545 - High Severity Vulnerability

Vulnerable Library - microsoft.netcore.app.2.2.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. 1249f08feda72b116...

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: ckFolder/microsoft.netcore.app/2.2.0/microsoft.netcore.app.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.2.0.nupkg (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

An information disclosure vulnerability exists in .NET Framework and .NET Core which allows bypassing Cross-origin Resource Sharing (CORS) configurations, aka ".NET Framework Information Disclosure Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7/4.7.1/4.7.2, .NET Core 2.1, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, .NET Core 2.2, Microsoft .NET Framework 4.7.2.

Publish Date: 2019-01-08

URL: CVE-2019-0545

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: dotnet/announcements#94

Release Date: 2019-01-08

Fix Resolution: Microsoft.NETCore.App - 2.1.7,2.2.1


Step up your Open Source Security Game with WhiteSource here

CVE-2019-0564 (High) detected in multiple libraries

CVE-2019-0564 - High Severity Vulnerability

Vulnerable Libraries - system.net.websockets.websocketprotocol.4.5.1.nupkg, microsoft.aspnetcore.websockets.2.2.0.nupkg, microsoft.netcore.app.2.2.0.nupkg

system.net.websockets.websocketprotocol.4.5.1.nupkg

Provides the WebSocketProtocol class, which allows creating a websocket from a connected stream usin...

Library home page: https://api.nuget.org/packages/system.net.websockets.websocketprotocol.4.5.1.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.net.websockets.websocketprotocol/4.5.1/system.net.websockets.websocketprotocol.4.5.1.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.signalr.1.1.0.nupkg (Root Library)
    • microsoft.aspnetcore.http.connections.1.1.0.nupkg
      • microsoft.aspnetcore.websockets.2.2.0.nupkg
        • system.net.websockets.websocketprotocol.4.5.1.nupkg (Vulnerable Library)
microsoft.aspnetcore.websockets.2.2.0.nupkg

ASP.NET Core web socket middleware for use on top of opaque servers.

This package was built from th...

Library home page: https://api.nuget.org/packages/microsoft.aspnetcore.websockets.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/microsoft.aspnetcore.websockets/2.2.0/microsoft.aspnetcore.websockets.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.signalr.1.1.0.nupkg (Root Library)
    • microsoft.aspnetcore.http.connections.1.1.0.nupkg
      • microsoft.aspnetcore.websockets.2.2.0.nupkg (Vulnerable Library)
microsoft.netcore.app.2.2.0.nupkg

A set of .NET API's that are included in the default .NET Core application model. 1249f08feda72b116...

Library home page: https://api.nuget.org/packages/microsoft.netcore.app.2.2.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: ckFolder/microsoft.netcore.app/2.2.0/microsoft.netcore.app.2.2.0.nupkg

Dependency Hierarchy:

  • microsoft.netcore.app.2.2.0.nupkg (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

A denial of service vulnerability exists when ASP.NET Core improperly handles web requests, aka "ASP.NET Core Denial of Service Vulnerability." This affects ASP.NET Core 2.1. This CVE ID is unique from CVE-2019-0548.

Publish Date: 2019-01-08

URL: CVE-2019-0564

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: aspnet/Announcements#334

Release Date: 2019-01-08

Fix Resolution: Microsoft.AspNetCore.WebSockets - 2.1.7,2.2.1;Microsoft.AspNetCore.Server.Kestrel.Core - 2.1.7;System.Net.WebSockets.WebSocketProtocol - 4.5.3;Microsoft.NETCore.App - 2.1.7,2.2.1;Microsoft.AspNetCore.App - 2.1.7,2.2.1;Microsoft.AspNetCore.All - 2.1.7,2.2.1


Step up your Open Source Security Game with WhiteSource here

CVE-2021-26701 (High) detected in system.text.encodings.web.4.5.0.nupkg

CVE-2021-26701 - High Severity Vulnerability

Vulnerable Library - system.text.encodings.web.4.5.0.nupkg

Provides types for encoding and escaping strings for use in JavaScript, HyperText Markup Language (H...

Library home page: https://api.nuget.org/packages/system.text.encodings.web.4.5.0.nupkg

Path to dependency file: pipelines-dotnet-core/pipelines-dotnet-core.csproj

Path to vulnerable library: /usr/share/dotnet/sdk/NuGetFallbackFolder/system.text.encodings.web/4.5.0/system.text.encodings.web.4.5.0.nupkg

Dependency Hierarchy:

  • microsoft.aspnetcore.mvc.formatters.xml.2.2.0.nupkg (Root Library)
    • microsoft.aspnetcore.mvc.core.2.2.0.nupkg
      • microsoft.aspnetcore.authentication.core.2.2.0.nupkg
        • microsoft.aspnetcore.http.2.2.0.nupkg
          • microsoft.aspnetcore.webutilities.2.2.0.nupkg
            • system.text.encodings.web.4.5.0.nupkg (Vulnerable Library)

Found in HEAD commit: f990b168b8a5b0591b0571680d7cab3a42515e05

Found in base branch: main

Vulnerability Details

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-24112.

Publish Date: 2021-02-25

URL: CVE-2021-26701

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: dotnet/announcements#178

Release Date: 2021-02-25

Fix Resolution: System.Text.Encodings.Web - 4.5.1,4.7.2,5.0.1


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.