turkdevops / bit Goto Github PK
View Code? Open in Web Editor NEWThis project forked from teambit/bit
A tool for component-driven application development.
Home Page: https://bit.dev
License: Other
This project forked from teambit/bit
A tool for component-driven application development.
Home Page: https://bit.dev
License: Other
AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.0.5/angular.min.js
Path to dependency file: /node_modules/package-json-validator/index.html
Path to vulnerable library: /node_modules/package-json-validator/index.html
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one. Wrapping "" elements in "" ones changes parsing behavior, leading to possibly unsanitizing code. Publish Date: 2020-06-08 URL: CVE-2020-7676 CVSS 3 Score Details (5.4) Base Score Metrics: Exploitability Metrics: Attack Vector: Network Attack Complexity: Low Privileges Required: Low User Interaction: Required Scope: Changed Impact Metrics: Confidentiality Impact: Low Integrity Impact: Low Availability Impact: None For more information on CVSS3 Scores, click here. Suggested Fix Type: Upgrade version Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7676 Release Date: 2020-10-09 Fix Resolution: 1.8.0 Step up your Open Source Security Game with Mend here
Strips glob magic from a string to provide the parent directory path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/glob-parent/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Publish Date: 2021-06-03
URL: CVE-2020-28469
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
Release Date: 2021-06-03
Fix Resolution (glob-parent): 5.1.2
Direct dependency fix Resolution (@babel/cli): 7.13.0
Step up your Open Source Security Game with Mend here
Vulnerabilities
DepShield reports that this application's usage of handlebars:4.7.6 results in the following vulnerability(s):
Occurrences
handlebars:4.7.6 is a transitive dependency introduced by the following direct dependency(s):
• verdaccio:4.11.0
└─ handlebars:4.7.6
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of glob-parent:3.1.0 results in the following vulnerability(s):
Occurrences
glob-parent:3.1.0 is a transitive dependency introduced by the following direct dependency(s):
• @babel/cli:7.12.17
└─ @nicolo-ribaudo/chokidar-2:2.1.8-no-fsevents
└─ glob-parent:3.1.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of lodash.groupby:4.6.0 results in the following vulnerability(s):
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of acorn:3.3.0 results in the following vulnerability(s):
Occurrences
acorn:3.3.0 is a transitive dependency introduced by the following direct dependency(s):
• rewire:4.0.1
└─ eslint:4.19.1
└─ espree:3.5.4
└─ acorn-jsx:3.0.1
└─ acorn:3.3.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.min.js
Path to dependency file: /node_modules/jmespath/index.html
Path to vulnerable library: /node_modules/jmespath/index.html
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
Publish Date: 2020-05-19
URL: CVE-2020-7656
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-q4m3-2j7h-f7xw
Release Date: 2020-05-19
Fix Resolution: jquery - 1.9.0
Step up your Open Source Security Game with Mend here
AngularJS is an MVC framework for building web applications. The core features include HTML enhanced with custom component and data-binding capabilities, dependency injection and strong focus on simplicity, testability, maintainability and boiler-plate reduction.
Library home page: https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.0.5/angular.min.js
Path to dependency file: /node_modules/package-json-validator/index.html
Path to vulnerable library: /node_modules/package-json-validator/index.html
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
In AngularJS before 1.7.9 the function merge()
could be tricked into adding or modifying properties of Object.prototype
using a __proto__
payload.
Mend Note: After conducting further research, Mend has determined that versions 1.4.0-beta.6 before 1.7.9 of angular are vulnerable to CVE-2019-10768.
Publish Date: 2019-11-19
URL: CVE-2019-10768
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Vulnerabilities
DepShield reports that this application's usage of ini:1.3.8 results in the following vulnerability(s):
Occurrences
ini:1.3.8 is a transitive dependency introduced by the following direct dependency(s):
• gh-release:3.5.0
└─ update-notifier:2.5.0
└─ is-installed-globally:0.1.0
└─ global-dirs:0.1.1
└─ ini:1.3.8
└─ latest-version:3.1.0
└─ package-json:4.0.1
└─ registry-auth-token:3.4.0
└─ rc:1.2.8
└─ ini:1.3.8
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of acorn:5.7.4 results in the following vulnerability(s):
Occurrences
acorn:5.7.4 is a transitive dependency introduced by the following direct dependency(s):
• rewire:4.0.1
└─ eslint:4.19.1
└─ espree:3.5.4
└─ acorn:5.7.4
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.min.js
Path to dependency file: /node_modules/jmespath/index.html
Path to vulnerable library: /node_modules/jmespath/index.html
Dependency Hierarchy:
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.0/jquery.min.js
Path to dependency file: /node_modules/chai-string/test/index.html
Path to vulnerable library: /node_modules/chai-string/test/index.html
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11022
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022
Release Date: 2020-04-29
Fix Resolution: jQuery - 3.5.0
Step up your Open Source Security Game with Mend here
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz
Path to dependency file: bit/package.json
Path to vulnerable library: /node_modules/tar/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.
Publish Date: 2021-08-31
URL: CVE-2021-37712
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-qq89-hq3f-393p
Release Date: 2021-08-31
Fix Resolution: tar - 4.4.18, 5.0.10, 6.1.9
Step up your Open Source Security Game with WhiteSource here
Vulnerabilities
DepShield reports that this application's usage of lodash.get:4.4.2 results in the following vulnerability(s):
Occurrences
lodash.get:4.4.2 is a transitive dependency introduced by the following direct dependency(s):
• eslint-plugin-unicorn:12.1.0
└─ eslint-ast-utils:1.1.0
└─ lodash.get:4.4.2
• gitconfig:2.0.8
└─ lodash.get:4.4.2
• sinon:5.1.1
└─ lodash.get:4.4.2
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz
Dependency Hierarchy:
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3807
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/
Release Date: 2021-09-17
Fix Resolution (ansi-regex): 4.1.1
Direct dependency fix Resolution (inquirer): 7.0.0
Step up your Open Source Security Game with Mend here
Vulnerabilities
DepShield reports that this application's usage of lodash.isstring:4.0.1 results in the following vulnerability(s):
Occurrences
lodash.isstring:4.0.1 is a transitive dependency introduced by the following direct dependency(s):
• verdaccio:4.11.0
└─ jsonwebtoken:8.5.1
└─ lodash.isstring:4.0.1
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.min.js
Path to dependency file: /node_modules/jmespath/index.html
Path to vulnerable library: /node_modules/jmespath/index.html
Dependency Hierarchy:
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.0/jquery.min.js
Path to dependency file: /node_modules/chai-string/test/index.html
Path to vulnerable library: /node_modules/chai-string/test/index.html
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Publish Date: 2018-01-18
URL: CVE-2015-9251
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251
Release Date: 2018-01-18
Fix Resolution: jQuery - 3.0.0
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.7.6.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
Publish Date: 2021-05-04
URL: CVE-2021-23383
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23383
Release Date: 2021-05-04
Fix Resolution (handlebars): 4.7.7
Direct dependency fix Resolution (verdaccio): 4.11.2
Step up your Open Source Security Game with Mend here
Vulnerabilities
DepShield reports that this application's usage of lodash.sortby:4.7.0 results in the following vulnerability(s):
Occurrences
lodash.sortby:4.7.0 is a transitive dependency introduced by the following direct dependency(s):
• verdaccio:4.11.0
└─ @verdaccio/readme:9.7.3
└─ jsdom:15.2.1
└─ whatwg-url:7.1.0
└─ lodash.sortby:4.7.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of kind-of:5.1.0 results in the following vulnerability(s):
Occurrences
kind-of:5.1.0 is a transitive dependency introduced by the following direct dependency(s):
• @babel/cli:7.12.17
└─ @nicolo-ribaudo/chokidar-2:2.1.8-no-fsevents
└─ braces:2.3.2
└─ snapdragon:0.8.2
└─ define-property:0.2.5
└─ is-descriptor:0.1.6
└─ kind-of:5.1.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.min.js
Path to dependency file: /node_modules/jmespath/index.html
Path to vulnerable library: /node_modules/jmespath/index.html
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.
Publish Date: 2018-01-18
URL: CVE-2012-6708
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708
Release Date: 2018-01-18
Fix Resolution: jQuery - v1.9.0
Step up your Open Source Security Game with Mend here
Vulnerabilities
DepShield reports that this application's usage of lodash.once:4.1.1 results in the following vulnerability(s):
Occurrences
lodash.once:4.1.1 is a transitive dependency introduced by the following direct dependency(s):
• verdaccio:4.11.0
└─ jsonwebtoken:8.5.1
└─ lodash.once:4.1.1
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.
Publish Date: 2021-02-15
URL: CVE-2020-28500
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (verdaccio): 4.11.3
Step up your Open Source Security Game with Mend here
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz
Path to dependency file: bit/package.json
Path to vulnerable library: /node_modules/tar/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar
aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat
calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar
directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar
checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar
symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.
Publish Date: 2021-08-03
URL: CVE-2021-32803
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-r628-mhmh-qjhw
Release Date: 2021-08-03
Fix Resolution: tar - 3.2.3, 4.4.15, 5.0.7, 6.1.2
Step up your Open Source Security Game with WhiteSource here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.7.6.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
Publish Date: 2021-04-12
URL: CVE-2021-23369
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23369
Release Date: 2021-04-12
Fix Resolution (handlebars): 4.7.7
Direct dependency fix Resolution (verdaccio): 4.11.2
Step up your Open Source Security Game with Mend here
Vulnerabilities
DepShield reports that this application's usage of lodash:4.17.20 results in the following vulnerability(s):
Occurrences
lodash:4.17.20 is a transitive dependency introduced by the following direct dependency(s):
• verdaccio:4.11.0
└─ @verdaccio/local-storage:9.7.4
└─ lodash:4.17.20
└─ lodash:4.17.20
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of bl:4.1.0 results in the following vulnerability(s):
Occurrences
bl:4.1.0 is a transitive dependency introduced by the following direct dependency(s):
• tar-stream:2.2.0
└─ bl:4.1.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.2/jquery.min.js
Path to dependency file: /node_modules/jmespath/index.html
Path to vulnerable library: /node_modules/jmespath/index.html
Dependency Hierarchy:
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.0/jquery.min.js
Path to dependency file: /node_modules/chai-string/test/index.html
Path to vulnerable library: /node_modules/chai-string/test/index.html
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11023
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-04-29
Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0
Step up your Open Source Security Game with Mend here
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-1.2.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/marked/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can affect anyone who runs user generated code through marked. This vulnerability is fixed in version 2.0.0.
Publish Date: 2021-02-08
URL: CVE-2021-21306
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-4r62-v4vq-hr96
Release Date: 2021-02-08
Fix Resolution (marked): 2.0.0
Direct dependency fix Resolution (verdaccio): 4.11.3
Step up your Open Source Security Game with Mend here
Vulnerabilities
DepShield reports that this application's usage of minimist:0.0.8 results in the following vulnerability(s):
Occurrences
minimist:0.0.8 is a transitive dependency introduced by the following direct dependency(s):
• mocha:5.2.0
└─ mkdirp:0.5.1
└─ minimist:0.0.8
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz
Path to dependency file: bit/package.json
Path to vulnerable library: /node_modules/tar/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \
and /
characters as path separators, however \
is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO
, followed by a symbolic link named foo
, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO
directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.
Publish Date: 2021-08-31
URL: CVE-2021-37701
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-9r2w-394v-53qc
Release Date: 2021-08-31
Fix Resolution: tar - 4.4.16, 5.0.8, 6.1.7
Step up your Open Source Security Game with WhiteSource here
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-3.0.2.tgz
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
Mend Note: After conducting further research, Mend has determined that all versions of set-value before versions 2.0.1, 4.0.1 are vulnerable to CVE-2021-23440.
Publish Date: 2021-09-12
URL: CVE-2021-23440
Base Score Metrics:
Type: Upgrade version
Origin: https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/
Release Date: 2021-09-12
Fix Resolution: set-value - 2.0.1,4.0.1
Step up your Open Source Security Game with Mend here
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz
Path to dependency file: bit/package.json
Path to vulnerable library: /node_modules/tar/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths
flag is not set to true
. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc
would turn into home/user/.bashrc
. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc
. node-tar
would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc
) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry
method which sanitizes the entry.path
or a filter
method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.
Publish Date: 2021-08-03
URL: CVE-2021-32804
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-3jfq-g458-7qm9
Release Date: 2021-08-03
Fix Resolution: tar - 3.2.2, 4.4.14, 5.0.6, 6.1.1
Step up your Open Source Security Game with WhiteSource here
Vulnerabilities
DepShield reports that this application's usage of lodash.camelcase:4.3.0 results in the following vulnerability(s):
Occurrences
lodash.camelcase:4.3.0 is a transitive dependency introduced by the following direct dependency(s):
• eslint-plugin-unicorn:12.1.0
└─ lodash.camelcase:4.3.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of lodash.isinteger:4.0.4 results in the following vulnerability(s):
Occurrences
lodash.isinteger:4.0.4 is a transitive dependency introduced by the following direct dependency(s):
• verdaccio:4.11.0
└─ jsonwebtoken:8.5.1
└─ lodash.isinteger:4.0.4
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of lodash.toarray:4.4.0 results in the following vulnerability(s):
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of lodash.isnumber:3.0.3 results in the following vulnerability(s):
Occurrences
lodash.isnumber:3.0.3 is a transitive dependency introduced by the following direct dependency(s):
• verdaccio:4.11.0
└─ jsonwebtoken:8.5.1
└─ lodash.isnumber:3.0.3
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of bl:1.1.2 results in the following vulnerability(s):
Occurrences
bl:1.1.2 is a transitive dependency introduced by the following direct dependency(s):
• gh-release:3.5.0
└─ ghauth:3.2.1
└─ bl:1.1.2
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of minimist:0.0.10 results in the following vulnerability(s):
Occurrences
minimist:0.0.10 is a transitive dependency introduced by the following direct dependency(s):
• package-json-validator:0.6.3
└─ optimist:0.6.1
└─ minimist:0.0.10
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Publish Date: 2021-02-15
URL: CVE-2021-23337
Base Score Metrics:
Type: Upgrade version
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (verdaccio): 4.11.3
Step up your Open Source Security Game with Mend here
Vulnerabilities
DepShield reports that this application's usage of lodash.set:4.3.2 results in the following vulnerability(s):
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
simple, flexible, fun test framework
Library home page: https://registry.npmjs.org/mocha/-/mocha-5.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mocha/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
Mocha is vulnerable to ReDoS attack. If the stack trace in utils.js begins with a large error message, and full-trace is not enabled, utils.stackTraceFilter() will take exponential run time.
Publish Date: 2019-01-24
URL: WS-2019-0425
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Vulnerabilities
DepShield reports that this application's usage of github-url-to-object:3.1.0 results in the following vulnerability(s):
Occurrences
github-url-to-object:3.1.0 is a transitive dependency introduced by the following direct dependency(s):
• gh-release:3.5.0
└─ github-url-to-object:3.1.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of lodash.clonedeep:4.5.0 results in the following vulnerability(s):
Occurrences
lodash.clonedeep:4.5.0 is a transitive dependency introduced by the following direct dependency(s):
• eslint:7.20.0
└─ table:6.7.2
└─ lodash.clonedeep:4.5.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
Vulnerabilities
DepShield reports that this application's usage of mocha:5.2.0 results in the following vulnerability(s):
Occurrences
mocha:5.2.0 is a transitive dependency introduced by the following direct dependency(s):
• mocha-circleci-reporter:0.0.3
└─ mocha:5.2.0
This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.
DOMPurify is a DOM-only, super-fast, uber-tolerant XSS sanitizer for HTML, MathML and SVG. It's written in JavaScript and works in all modern browsers (Safari, Opera (15+), Internet Explorer (10+), Firefox and Chrome - as well as almost anything else usin
Library home page: https://registry.npmjs.org/dompurify/-/dompurify-2.0.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/dompurify/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
Cure53 DOMPurify before 2.0.17 allows mutation XSS. This occurs because a serialize-parse roundtrip does not necessarily return the original DOM tree, and a namespace can change from HTML to MathML, as demonstrated by nesting of FORM elements.
Publish Date: 2020-10-07
URL: CVE-2020-26870
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-26870
Release Date: 2020-10-07
Fix Resolution (dompurify): 2.0.17
Direct dependency fix Resolution (verdaccio): 4.11.3
Step up your Open Source Security Game with Mend here
Another JSON Schema Validator
Library home page: https://registry.npmjs.org/ajv/-/ajv-5.5.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ajv/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Publish Date: 2020-07-15
URL: CVE-2020-15366
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-07-15
Fix Resolution (ajv): 6.12.3
Direct dependency fix Resolution (rewire): 5.0.0
Step up your Open Source Security Game with Mend here
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz
Path to dependency file: bit/package.json
Path to vulnerable library: /node_modules/tar/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain ..
path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path
. If the drive letter does not match the extraction target, for example D:\extraction\dir
, then the result of path.resolve(extractionDirectory, entryPath)
would resolve against the current working directory on the C:
drive, rather than the extraction target directory. Additionally, a ..
portion of the path could occur immediately after the drive letter, such as C:../foo
, and was not properly sanitized by the logic that checked for ..
within the normalized and split portions of the path. This only affects users of node-tar
on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.
Publish Date: 2021-08-31
URL: CVE-2021-37713
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-5955-9wpr-37jh
Release Date: 2021-08-31
Fix Resolution: tar - 4.4.18, 5.0.10, 6.1.9
Step up your Open Source Security Game with WhiteSource here
Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!
Library home page: https://registry.npmjs.org/bl/-/bl-1.1.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/bl/package.json
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Publish Date: 2020-08-30
URL: CVE-2020-8244
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-pp7h-53gx-mx7r
Release Date: 2020-08-30
Fix Resolution (bl): 1.2.3
Direct dependency fix Resolution (gh-release): 4.0.0
Step up your Open Source Security Game with Mend here
A drop-in replacement for `util` with some additional advantageous functions
Library home page: https://registry.npmjs.org/utile/-/utile-0.3.0.tgz
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
The utile
npm module, version 0.3.0, allows to extract sensitive data from uninitialized memory or to cause a DoS by passing in a large number, in setups where typed user input can be passed (e.g. from JSON).
Publish Date: 2018-07-16
URL: WS-2018-0148
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/WS-2018-0148
Release Date: 2018-01-16
Fix Resolution: JetBrains.Rider.Frontend5 - 213.0.20211008.154703-eap03
Step up your Open Source Security Game with Mend here
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz
Dependency Hierarchy:
Found in HEAD commit: 2d5ba447ad6b7168a8a152ec95ebf4c142d6441e
Found in base branch: app-generator
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.
Publish Date: 2020-03-11
URL: CVE-2020-7598
Base Score Metrics:
Step up your Open Source Security Game with Mend here
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.