turkdevops / gitea Goto Github PK

This project forked from go-gitea/gitea

Git with a cup of tea, painless self-hosted git service

License: MIT License

Makefile 0.32% Go 70.27% Shell 4.25% Roff 6.78% Perl 0.49% Dockerfile 0.01% JavaScript 2.24% Vue 0.08% Less 1.90% CSS 0.01% Handlebars 13.65%

gitea's Introduction

Gitea - Git with a cup of tea

View the chinese version of this document

Purpose

The goal of this project is to make the easiest, fastest, and most painless way of setting up a self-hosted Git service. Using Go, this can be done with an independent binary distribution across all platforms which Go supports, including Linux, macOS, and Windows on x86, amd64, ARM and PowerPC architectures. Want to try it before doing anything else? Do it with the online demo! This project has been forked from Gogs since 2016.11 but changed a lot.

Building

From the root of the source tree, run:

TAGS="bindata" make build

or if sqlite support is required:

TAGS="bindata sqlite sqlite_unlock_notify" make build

The build target is split into two sub-targets:

make backend which requires Go 1.16 or greater.
make frontend which requires Node.js 12.17 or greater and Internet connectivity to download npm dependencies.

When building from the official source tarballs which include pre-built frontend files, the frontend target will not be triggered, making it possible to build without Node.js and Internet connectivity.

Parallelism (make -j <num>) is not supported.

More info: https://docs.gitea.io/en-us/install-from-source/

Using

./gitea web

NOTE: If you're interested in using our APIs, we have experimental support with documentation.

Contributing

Expected workflow is: Fork -> Patch -> Push -> Pull Request

NOTES:

YOU MUST READ THE CONTRIBUTORS GUIDE BEFORE STARTING TO WORK ON A PULL REQUEST.
If you have found a vulnerability in the project, please write privately to [email protected]. Thanks!

Translating

Translations are done through Crowdin. If you want to translate to a new language ask one of the managers in the Crowdin project to add a new language there.

You can also just create an issue for adding a language or ask on discord on the #translation channel. If you need context or find some translation issues, you can leave a comment on the string or ask on Discord. For general translation questions there is a section in the docs. Currently a bit empty but we hope fo fill it as questions pop up.

https://docs.gitea.io/en-us/translation-guidelines/

Further information

For more information and instructions about how to install Gitea, please look at our documentation. If you have questions that are not covered by the documentation, you can get in contact with us on our Discord server or create a post in the discourse forum.

We maintain a list of Gitea-related projects at gitea/awesome-gitea.
The hugo-based documentation theme is hosted at gitea/theme.
The official Gitea CLI is developed at gitea/tea.

Authors

Backers

Thank you to all our backers! 🙏 [Become a backer]

FAQ

How do you pronounce Gitea?

Gitea is pronounced /ɡɪ’ti:/ as in "gi-tea" with a hard g.

Why is this not hosted on a Gitea instance?

We're working on it.

License

This project is licensed under the MIT License. See the LICENSE file for the full license text.

Screenshots

Looking for an overview of the interface? Check it out!

gitea's People

Contributors

Watchers

gitea's Issues

CVE-2021-33587 (High) detected in css-what-4.0.0.tgz - autoclosed

CVE-2021-33587 - High Severity Vulnerability

Vulnerable Library - css-what-4.0.0.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-4.0.0.tgz

Path to dependency file: gitea/package.json

Path to vulnerable library: gitea/node_modules/css-what/package.json

Dependency Hierarchy:

svgo-2.3.0.tgz (Root Library)
- css-select-3.1.2.tgz
  - ❌ css-what-4.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution: css-what - 5.0.1

Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.5) Vulnerability due to usage of postcss:7.0.35

Vulnerabilities

DepShield reports that this application's usage of postcss:7.0.35 results in the following vulnerability(s):

(CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

postcss:7.0.35 is a transitive dependency introduced by the following direct dependency(s):

• stylelint:13.13.1
        └─ autoprefixer:9.8.6
              └─ postcss:7.0.35
        └─ postcss-less:3.1.4
              └─ postcss:7.0.35
        └─ postcss-safe-parser:4.0.2
              └─ postcss:7.0.35
        └─ postcss-sass:0.4.4
              └─ postcss:7.0.35
        └─ postcss-scss:2.1.1
              └─ postcss:7.0.35
        └─ postcss:7.0.35
        └─ sugarss:2.0.0
              └─ postcss:7.0.35

• vue-loader:15.9.7
└─ @vue/component-compiler-utils:3.2.0
└─ postcss:7.0.35

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

CVE-2019-11358 (Medium) detected in multiple libraries

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.9.1.min.js, jquery-1.11.1.min.js, jquery-1.10.2.min.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /web_src/fomantic/node_modules/fomantic-ui/examples/components/table.html

Path to vulnerable library: /web_src/fomantic/node_modules/fomantic-ui/examples/components/../assets/library/jquery.min.js,/web_src/fomantic/node_modules/fomantic-ui/examples/assets/library/jquery.min.js

Dependency Hierarchy:

❌ jquery-2.1.4.min.js (Vulnerable Library)

jquery-1.9.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js

Path to dependency file: /node_modules/dagre-d3/dist/demo/hover.html

Path to vulnerable library: /node_modules/dagre-d3/dist/demo/hover.html

Dependency Hierarchy:

❌ jquery-1.9.1.min.js (Vulnerable Library)

jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /public/vendor/plugins/codemirror/mode/slim/index.html

Path to vulnerable library: /public/vendor/plugins/codemirror/mode/slim/index.html

Dependency Hierarchy:

❌ jquery-1.11.1.min.js (Vulnerable Library)

jquery-1.10.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.2/jquery.min.js

Path to dependency file: /node_modules/@claviska/jquery-minicolors/without-bootstrap.html

Path to vulnerable library: /node_modules/@claviska/jquery-minicolors/without-bootstrap.html

Dependency Hierarchy:

❌ jquery-1.10.2.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0

Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 4.3) Vulnerability due to usage of bl:4.1.0

Vulnerabilities

DepShield reports that this application's usage of bl:4.1.0 results in the following vulnerability(s):

(CVSS 4.3) CWE-200: Information Exposure

Occurrences

bl:4.1.0 is a transitive dependency introduced by the following direct dependency(s):

• mermaid:8.11.5
        └─ @percy/migrate:0.10.0
              └─ inquirer:8.1.2
                    └─ ora:5.4.1
                          └─ bl:4.1.0

CVE-2020-11022 (Medium) detected in multiple libraries

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.9.1.min.js, jquery-1.11.1.min.js, jquery-1.10.2.min.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /web_src/fomantic/node_modules/fomantic-ui/examples/components/table.html

Dependency Hierarchy:

❌ jquery-2.1.4.min.js (Vulnerable Library)

jquery-1.9.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js

Path to dependency file: /node_modules/dagre-d3/dist/demo/hover.html

Path to vulnerable library: /node_modules/dagre-d3/dist/demo/hover.html

Dependency Hierarchy:

❌ jquery-1.9.1.min.js (Vulnerable Library)

jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /public/vendor/plugins/codemirror/mode/slim/index.html

Path to vulnerable library: /public/vendor/plugins/codemirror/mode/slim/index.html

Dependency Hierarchy:

❌ jquery-1.11.1.min.js (Vulnerable Library)

jquery-1.10.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.2/jquery.min.js

Path to dependency file: /node_modules/@claviska/jquery-minicolors/without-bootstrap.html

Path to vulnerable library: /node_modules/@claviska/jquery-minicolors/without-bootstrap.html

Dependency Hierarchy:

❌ jquery-1.10.2.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

Step up your Open Source Security Game with Mend here

CVE-2020-7760 (High) detected in javascript-5.51.0.js

CVE-2020-7760 - High Severity Vulnerability

Vulnerable Library - javascript-5.51.0.js

In-browser code editing made bearable

Library home page: https://cdnjs.cloudflare.com/ajax/libs/codemirror/5.51.0/mode/javascript/javascript.js

Path to dependency file: /public/vendor/plugins/codemirror/mode/pug/index.html

Path to vulnerable library: /public/vendor/plugins/codemirror/mode/pug/../javascript/javascript.js,/public/vendor/plugins/codemirror/mode/vue/../javascript/javascript.js,/public/vendor/plugins/codemirror/mode/ebnf/../javascript/javascript.js,/public/vendor/plugins/codemirror/mode/jsx/../javascript/javascript.js,/public/vendor/plugins/codemirror/mode/pegjs/../javascript/javascript.js,/public/vendor/plugins/codemirror/mode/slim/../javascript/javascript.js,/public/vendor/plugins/codemirror/mode/php/../javascript/javascript.js,/public/vendor/plugins/codemirror/mode/soy/../javascript/javascript.js,/public/vendor/plugins/codemirror/mode/javascript/javascript.js,/public/vendor/plugins/codemirror/mode/haml/../javascript/javascript.js,/public/vendor/plugins/codemirror/mode/gfm/../javascript/javascript.js,/public/vendor/plugins/codemirror/mode/htmlembedded/../javascript/javascript.js,/public/vendor/plugins/codemirror/mode/htmlmixed/../javascript/javascript.js

Dependency Hierarchy:

❌ javascript-5.51.0.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

This affects the package codemirror before 5.58.2; the package org.apache.marmotta.webjars:codemirror before 5.58.2. The vulnerable regular expression is located in https://github.com/codemirror/CodeMirror/blob/cdb228ac736369c685865b122b736cd0d397836c/mode/javascript/javascript.jsL129. The ReDOS vulnerability of the regex is mainly due to the sub-pattern (s|/.?/)

Publish Date: 2020-10-30

URL: CVE-2020-7760

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7760

Release Date: 2020-10-30

Fix Resolution: codemirror - 5.58.2

Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:5.1.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:5.1.0 results in the following vulnerability(s):

(CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Occurrences

kind-of:5.1.0 is a transitive dependency introduced by the following direct dependency(s):

• jest-extended:0.11.5
        └─ expect:24.9.0
              └─ jest-message-util:24.9.0
                    └─ micromatch:3.1.10
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ define-property:0.2.5
                                            └─ is-descriptor:0.1.6
                                                  └─ kind-of:5.1.0
                          └─ snapdragon:0.8.2
                                └─ base:0.11.2
                                      └─ class-utils:0.3.6
                                            └─ define-property:0.2.5
                                                  └─ is-descriptor:0.1.6
                                                        └─ kind-of:5.1.0
                                            └─ static-extend:0.1.2
                                                  └─ object-copy:0.1.0
                                                        └─ define-property:0.2.5
                                                              └─ is-descriptor:0.1.6
                                                                    └─ kind-of:5.1.0
                                                  └─ define-property:0.2.5
                                                        └─ is-descriptor:0.1.6
                                                              └─ kind-of:5.1.0
                                └─ define-property:0.2.5
                                      └─ is-descriptor:0.1.6
                                            └─ kind-of:5.1.0

CVE-2020-11023 (Medium) detected in multiple libraries

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.9.1.min.js, jquery-1.11.1.min.js, jquery-1.10.2.min.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /web_src/fomantic/node_modules/fomantic-ui/examples/components/table.html

Dependency Hierarchy:

❌ jquery-2.1.4.min.js (Vulnerable Library)

jquery-1.9.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js

Path to dependency file: /node_modules/dagre-d3/dist/demo/hover.html

Path to vulnerable library: /node_modules/dagre-d3/dist/demo/hover.html

Dependency Hierarchy:

❌ jquery-1.9.1.min.js (Vulnerable Library)

jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /public/vendor/plugins/codemirror/mode/slim/index.html

Path to vulnerable library: /public/vendor/plugins/codemirror/mode/slim/index.html

Dependency Hierarchy:

❌ jquery-1.11.1.min.js (Vulnerable Library)

jquery-1.10.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.2/jquery.min.js

Path to dependency file: /node_modules/@claviska/jquery-minicolors/without-bootstrap.html

Path to vulnerable library: /node_modules/@claviska/jquery-minicolors/without-bootstrap.html

Dependency Hierarchy:

❌ jquery-1.10.2.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

Step up your Open Source Security Game with Mend here

CVE-2021-37713 (High) detected in tar-6.1.8.tgz - autoclosed

CVE-2021-37713 - High Severity Vulnerability

Vulnerable Library - tar-6.1.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.1.8.tgz

Path to dependency file: gitea/package.json

Path to vulnerable library: gitea/node_modules/tar/package.json

Dependency Hierarchy:

editorconfig-checker-4.0.2.tgz (Root Library)
- ❌ tar-6.1.8.tgz (Vulnerable Library)

Found in HEAD commit: 431042ad5191339c65960ced6a7288ed26c46aab

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

Publish Date: 2021-08-31

URL: CVE-2021-37713

CVSS 3 Score Details (8.6)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5955-9wpr-37jh

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.18, 5.0.10, 6.1.9

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23382 (High) detected in postcss-6.0.23.tgz

CVE-2021-23382 - High Severity Vulnerability

Vulnerable Library - postcss-6.0.23.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-6.0.23.tgz

Path to dependency file: /web_src/fomantic/package.json

Path to vulnerable library: /web_src/fomantic/node_modules/rtlcss/node_modules/postcss/package.json

Dependency Hierarchy:

fomantic-ui-2.8.7.tgz (Root Library)
- gulp-rtlcss-1.4.2.tgz
  - rtlcss-2.6.2.tgz
    - ❌ postcss-6.0.23.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).

Publish Date: 2021-04-26

URL: CVE-2021-23382

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382

Release Date: 2021-04-26

Fix Resolution (postcss): 7.0.36

Direct dependency fix Resolution (fomantic-ui): 2.9.0

Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 7.4) Vulnerability due to usage of ini:1.3.8

Vulnerabilities

DepShield reports that this application's usage of ini:1.3.8 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

ini:1.3.8 is a transitive dependency introduced by the following direct dependency(s):

• stylelint:13.13.1
        └─ global-modules:2.0.0
              └─ global-prefix:3.0.0
                    └─ ini:1.3.8

[DepShield] (CVSS 7.5) Vulnerability due to usage of tar:6.1.8

Vulnerabilities

DepShield reports that this application's usage of tar:6.1.8 results in the following vulnerability(s):

(CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
(CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Occurrences

tar:6.1.8 is a transitive dependency introduced by the following direct dependency(s):

• editorconfig-checker:4.0.2
└─ tar:6.1.8

WS-2018-0590 (High) detected in diff-1.0.8.tgz

WS-2018-0590 - High Severity Vulnerability

Vulnerable Library - diff-1.0.8.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-1.0.8.tgz

Path to dependency file: /web_src/fomantic/package.json

Path to vulnerable library: /web_src/fomantic/node_modules/diff/package.json

Dependency Hierarchy:

fomantic-ui-2.8.7.tgz (Root Library)
- gulp-dedupe-0.0.2.tgz
  - ❌ diff-1.0.8.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2018-03-05

URL: WS-2018-0590

CVSS 3 Score Details (7.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-03-05

Fix Resolution: 3.5.0

Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 6.1) Vulnerability due to usage of swagger-ui-dist:3.48.0

Vulnerabilities

DepShield reports that this application's usage of swagger-ui-dist:3.48.0 results in the following vulnerability(s):

(CVSS 6.1) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVE-2018-20676 (Medium) detected in bootstrap-3.3.1.min.js

CVE-2018-20676 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.1/js/bootstrap.min.js

Path to dependency file: /node_modules/@claviska/jquery-minicolors/index.html

Path to vulnerable library: /node_modules/@claviska/jquery-minicolors/index.html

Dependency Hierarchy:

❌ bootstrap-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.

Publish Date: 2019-01-09

URL: CVE-2018-20676

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20676

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0

Step up your Open Source Security Game with Mend here

CVE-2019-8331 (Medium) detected in bootstrap-3.3.1.min.js

CVE-2019-8331 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.1/js/bootstrap.min.js

Path to dependency file: /node_modules/@claviska/jquery-minicolors/index.html

Path to vulnerable library: /node_modules/@claviska/jquery-minicolors/index.html

Dependency Hierarchy:

❌ bootstrap-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Publish Date: 2019-02-20

URL: CVE-2019-8331

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-02-20

Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1

Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:4.0.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:4.0.0 results in the following vulnerability(s):

(CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Occurrences

kind-of:4.0.0 is a transitive dependency introduced by the following direct dependency(s):

• jest-extended:0.11.5
        └─ expect:24.9.0
              └─ jest-message-util:24.9.0
                    └─ micromatch:3.1.10
                          └─ snapdragon:0.8.2
                                └─ base:0.11.2
                                      └─ cache-base:1.0.1
                                            └─ has-value:1.0.0
                                                  └─ has-values:1.0.0
                                                        └─ kind-of:4.0.0

CVE-2021-37712 (High) detected in tar-6.1.8.tgz - autoclosed

CVE-2021-37712 - High Severity Vulnerability

Vulnerable Library - tar-6.1.8.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-6.1.8.tgz

Path to dependency file: gitea/package.json

Path to vulnerable library: gitea/node_modules/tar/package.json

Dependency Hierarchy:

editorconfig-checker-4.0.2.tgz (Root Library)
- ❌ tar-6.1.8.tgz (Vulnerable Library)

Found in HEAD commit: 431042ad5191339c65960ced6a7288ed26c46aab

Found in base branch: main

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: 2021-08-31

URL: CVE-2021-37712

CVSS 3 Score Details (8.6)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq89-hq3f-393p

Release Date: 2021-08-31

Fix Resolution: tar - 4.4.18, 5.0.10, 6.1.9

Step up your Open Source Security Game with WhiteSource here

CVE-2016-10735 (Medium) detected in bootstrap-3.3.1.min.js

CVE-2016-10735 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.1/js/bootstrap.min.js

Path to dependency file: /node_modules/@claviska/jquery-minicolors/index.html

Path to vulnerable library: /node_modules/@claviska/jquery-minicolors/index.html

Dependency Hierarchy:

❌ bootstrap-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.
Mend Note: Converted from WS-2018-0021, on 2022-11-08.

Publish Date: 2019-01-09

URL: CVE-2016-10735

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10735

Release Date: 2019-01-09

Fix Resolution: bootstrap - 3.4.0, 4.0.0-beta.2

Step up your Open Source Security Game with Mend here

CVE-2021-32640 (Medium) detected in ws-7.4.5.tgz - autoclosed

CVE-2021-32640 - Medium Severity Vulnerability

Vulnerable Library - ws-7.4.5.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.4.5.tgz

Path to dependency file: gitea/package.json

Path to vulnerable library: gitea/node_modules/ws/package.json

Dependency Hierarchy:

jest-26.6.3.tgz (Root Library)
- core-26.6.3.tgz
  - jest-config-26.6.3.tgz
    - jest-environment-jsdom-26.6.2.tgz
      - jsdom-16.5.3.tgz
        
        ❌ ws-7.4.5.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (websockets/ws@00c425e). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Publish Date: 2021-05-25

URL: CVE-2021-32640

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6fc8-4gx4-v693

Release Date: 2021-05-25

Fix Resolution: ws - 7.4.6

Step up your Open Source Security Game with WhiteSource here

CVE-2016-7103 (Medium) detected in jquery-ui-1.11.0.min.js

CVE-2016-7103 - Medium Severity Vulnerability

Vulnerable Library - jquery-ui-1.11.0.min.js

A curated set of user interface interactions, effects, widgets, and themes built on top of the jQuery JavaScript Library.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jqueryui/1.11.0/jquery-ui.min.js

Path to dependency file: /public/vendor/plugins/codemirror/mode/slim/index.html

Path to vulnerable library: /public/vendor/plugins/codemirror/mode/slim/index.html

Dependency Hierarchy:

❌ jquery-ui-1.11.0.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

Cross-site scripting (XSS) vulnerability in jQuery UI before 1.12.0 might allow remote attackers to inject arbitrary web script or HTML via the closeText parameter of the dialog function.

Publish Date: 2017-03-15

URL: CVE-2016-7103

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2017-03-15

Fix Resolution: katello - 4.7.2

Step up your Open Source Security Game with Mend here

CVE-2021-35513 (Medium) detected in mermaid-8.10.1.tgz - autoclosed

CVE-2021-35513 - Medium Severity Vulnerability

Vulnerable Library - mermaid-8.10.1.tgz

Markdownish syntax for generating flowcharts, sequence diagrams, class diagrams, gantt charts and git graphs.

Library home page: https://registry.npmjs.org/mermaid/-/mermaid-8.10.1.tgz

Path to dependency file: gitea/package.json

Path to vulnerable library: /node_modules/mermaid/package.json

Dependency Hierarchy:

❌ mermaid-8.10.1.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

Mermaid before 8.11.0 allows XSS when the antiscript feature is used.

Publish Date: 2021-06-27

URL: CVE-2021-35513

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35513

Release Date: 2021-06-27

Fix Resolution: 8.11.0

Step up your Open Source Security Game with WhiteSource here

CVE-2012-6708 (Medium) detected in github.com/go-enry/go-enry/v2-v2.7.1, jquery-1.4.2.min.js

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Libraries - github.com/go-enry/go-enry/v2-v2.7.1, jquery-1.4.2.min.js

github.com/go-enry/go-enry/v2-v2.7.1

A faster file programming language detector

Library home page: https://proxy.golang.org/github.com/go-enry/go-enry/v2/@v/v2.7.1.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go.mod

Dependency Hierarchy:

❌ github.com/go-enry/go-enry/v2-v2.7.1 (Vulnerable Library)

jquery-1.4.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.4.2/jquery.min.js

Path to dependency file: /node_modules/jquery.are-you-sure/demo/are-you-sure-demo.html

Path to vulnerable library: /node_modules/jquery.are-you-sure/demo/are-you-sure-demo.html

Dependency Hierarchy:

❌ jquery-1.4.2.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

Step up your Open Source Security Game with Mend here

CVE-2021-3803 (High) detected in nth-check-2.0.0.tgz - autoclosed

CVE-2021-3803 - High Severity Vulnerability

Vulnerable Library - nth-check-2.0.0.tgz

Parses and compiles CSS nth-checks to highly optimized functions.

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-2.0.0.tgz

Path to dependency file: gitea/package.json

Path to vulnerable library: gitea/node_modules/nth-check/package.json

Dependency Hierarchy:

svgo-2.4.0.tgz (Root Library)
- css-select-4.1.3.tgz
  - ❌ nth-check-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 431042ad5191339c65960ced6a7288ed26c46aab

Found in base branch: main

Vulnerability Details

nth-check is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3803

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: fb55/nth-check@v2.0.0...v2.0.1

Release Date: 2021-09-17

Fix Resolution: nth-check - v2.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2022-0235 (Medium) detected in node-fetch-2.6.5.tgz

CVE-2022-0235 - Medium Severity Vulnerability

Vulnerable Library - node-fetch-2.6.5.tgz

A light-weight module that brings window.fetch to node.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-fetch/package.json,/web_src/fomantic/node_modules/node-fetch/package.json

Dependency Hierarchy:

editorconfig-checker-4.0.2.tgz (Root Library)
- ❌ node-fetch-2.6.5.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

Publish Date: 2022-01-16

URL: CVE-2022-0235

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r683-j2x4-v87g

Release Date: 2022-01-16

Fix Resolution (node-fetch): 2.6.7

Direct dependency fix Resolution (editorconfig-checker): 5.0.0

Step up your Open Source Security Game with Mend here

CVE-2015-9251 (Medium) detected in multiple libraries

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Libraries - github.com/go-enry/go-enry/v2-v2.7.1, jquery-1.4.2.min.js, jquery-2.1.4.min.js, jquery-1.9.1.min.js, jquery-1.11.1.min.js, jquery-1.10.2.min.js

github.com/go-enry/go-enry/v2-v2.7.1

A faster file programming language detector

Library home page: https://proxy.golang.org/github.com/go-enry/go-enry/v2/@v/v2.7.1.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go.mod

Dependency Hierarchy:

❌ github.com/go-enry/go-enry/v2-v2.7.1 (Vulnerable Library)

jquery-1.4.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.4.2/jquery.min.js

Path to dependency file: /node_modules/jquery.are-you-sure/demo/are-you-sure-demo.html

Path to vulnerable library: /node_modules/jquery.are-you-sure/demo/are-you-sure-demo.html

Dependency Hierarchy:

❌ jquery-1.4.2.min.js (Vulnerable Library)

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /web_src/fomantic/node_modules/fomantic-ui/examples/components/table.html

Dependency Hierarchy:

❌ jquery-2.1.4.min.js (Vulnerable Library)

jquery-1.9.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.min.js

Path to dependency file: /node_modules/dagre-d3/dist/demo/hover.html

Path to vulnerable library: /node_modules/dagre-d3/dist/demo/hover.html

Dependency Hierarchy:

❌ jquery-1.9.1.min.js (Vulnerable Library)

jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /public/vendor/plugins/codemirror/mode/slim/index.html

Path to vulnerable library: /public/vendor/plugins/codemirror/mode/slim/index.html

Dependency Hierarchy:

❌ jquery-1.11.1.min.js (Vulnerable Library)

jquery-1.10.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.10.2/jquery.min.js

Path to dependency file: /node_modules/@claviska/jquery-minicolors/without-bootstrap.html

Path to vulnerable library: /node_modules/@claviska/jquery-minicolors/without-bootstrap.html

Dependency Hierarchy:

❌ jquery-1.10.2.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - 3.0.0

Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 5.3) Vulnerability due to usage of ws:7.4.5

Vulnerabilities

DepShield reports that this application's usage of ws:7.4.5 results in the following vulnerability(s):

(CVSS 5.3) [CVE-2021-32640] ws is an open source WebSocket client and server library for Node.js. A speciall...

Occurrences

ws:7.4.5 is a transitive dependency introduced by the following direct dependency(s):

• jest:26.6.3
        └─ @jest/core:26.6.3
              └─ jest-config:26.6.3
                    └─ jest-environment-jsdom:26.6.2
                          └─ jsdom:16.5.3
                                └─ ws:7.4.5

CVE-2021-3807 (High) detected in ansi-regex-4.1.0.tgz, ansi-regex-3.0.0.tgz

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Libraries - ansi-regex-4.1.0.tgz, ansi-regex-3.0.0.tgz

ansi-regex-4.1.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz

Path to dependency file: /web_src/fomantic/package.json

Path to vulnerable library: /web_src/fomantic/node_modules/inquirer/node_modules/strip-ansi/node_modules/ansi-regex/package.json

Dependency Hierarchy:

fomantic-ui-2.8.7.tgz (Root Library)
- inquirer-6.5.2.tgz
  - strip-ansi-5.2.0.tgz
    - ❌ ansi-regex-4.1.0.tgz (Vulnerable Library)

ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /web_src/fomantic/package.json

Path to vulnerable library: /web_src/fomantic/node_modules/inquirer/node_modules/ansi-regex/package.json

Dependency Hierarchy:

fomantic-ui-2.8.7.tgz (Root Library)
- inquirer-6.5.2.tgz
  - string-width-2.1.1.tgz
    - strip-ansi-4.0.0.tgz
      - ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 4.1.1

Direct dependency fix Resolution (fomantic-ui): 2.8.8

Fix Resolution (ansi-regex): 4.1.1

Direct dependency fix Resolution (fomantic-ui): 2.8.8

Step up your Open Source Security Game with Mend here

CVE-2011-4969 (Low) detected in jquery-1.4.2.min.js

CVE-2011-4969 - Low Severity Vulnerability

Vulnerable Library - jquery-1.4.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.4.2/jquery.min.js

Path to dependency file: /node_modules/jquery.are-you-sure/demo/are-you-sure-demo.html

Path to vulnerable library: /node_modules/jquery.are-you-sure/demo/are-you-sure-demo.html

Dependency Hierarchy:

❌ jquery-1.4.2.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

Cross-site scripting (XSS) vulnerability in jQuery before 1.6.3, when using location.hash to select elements, allows remote attackers to inject arbitrary web script or HTML via a crafted tag.

Publish Date: 2013-03-08

URL: CVE-2011-4969

CVSS 3 Score Details (3.7)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2011-4969

Release Date: 2013-03-08

Fix Resolution: 1.6.3

Step up your Open Source Security Game with Mend here

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz - autoclosed

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: gitea/package.json

Path to vulnerable library: gitea/node_modules/path-parse/package.json

Dependency Hierarchy:

eslint-plugin-import-2.22.1.tgz (Root Library)
- resolve-1.20.0.tgz
  - ❌ path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jbgutierrez/path-parse#8

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7

Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.clonedeep:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.clonedeep:4.5.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
(CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.clonedeep:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• eslint:7.26.0
└─ table:6.7.0
└─ lodash.clonedeep:4.5.0

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:3.2.2

Vulnerabilities

DepShield reports that this application's usage of kind-of:3.2.2 results in the following vulnerability(s):

(CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Occurrences

kind-of:3.2.2 is a transitive dependency introduced by the following direct dependency(s):

• jest:26.6.3
        └─ @jest/core:26.6.3
              └─ jest-haste-map:26.6.2
                    └─ sane:4.1.0
                          └─ micromatch:3.1.10
                                └─ braces:2.3.2
                                      └─ fill-range:4.0.0
                                            └─ is-number:3.0.0
                                                  └─ kind-of:3.2.2

• jest-extended:0.11.5
        └─ expect:24.9.0
              └─ jest-message-util:24.9.0
                    └─ micromatch:3.1.10
                          └─ braces:2.3.2
                                └─ fill-range:4.0.0
                                      └─ is-number:3.0.0
                                            └─ kind-of:3.2.2
                                └─ snapdragon-node:2.1.1
                                      └─ snapdragon-util:3.0.1
                                            └─ kind-of:3.2.2
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ define-property:0.2.5
                                            └─ is-descriptor:0.1.6
                                                  └─ is-accessor-descriptor:0.1.6
                                                        └─ kind-of:3.2.2
                                                  └─ is-data-descriptor:0.1.4
                                                        └─ kind-of:3.2.2
                          └─ snapdragon:0.8.2
                                └─ base:0.11.2
                                      └─ cache-base:1.0.1
                                            └─ has-value:1.0.0
                                                  └─ has-values:1.0.0
                                                        └─ is-number:3.0.0
                                                              └─ kind-of:3.2.2
                                            └─ to-object-path:0.3.0
                                                  └─ kind-of:3.2.2
                                      └─ class-utils:0.3.6
                                            └─ define-property:0.2.5
                                                  └─ is-descriptor:0.1.6
                                                        └─ is-accessor-descriptor:0.1.6
                                                              └─ kind-of:3.2.2
                                                        └─ is-data-descriptor:0.1.4
                                                              └─ kind-of:3.2.2
                                            └─ static-extend:0.1.2
                                                  └─ object-copy:0.1.0
                                                        └─ define-property:0.2.5
                                                              └─ is-descriptor:0.1.6
                                                                    └─ is-accessor-descriptor:0.1.6
                                                                          └─ kind-of:3.2.2
                                                                    └─ is-data-descriptor:0.1.4
                                                                          └─ kind-of:3.2.2
                                                        └─ kind-of:3.2.2
                                                  └─ define-property:0.2.5
                                                        └─ is-descriptor:0.1.6
                                                              └─ is-accessor-descriptor:0.1.6
                                                                    └─ kind-of:3.2.2
                                                              └─ is-data-descriptor:0.1.4
                                                                    └─ kind-of:3.2.2
                                └─ define-property:0.2.5
                                      └─ is-descriptor:0.1.6
                                            └─ is-accessor-descriptor:0.1.6
                                                  └─ kind-of:3.2.2
                                            └─ is-data-descriptor:0.1.4
                                                  └─ kind-of:3.2.2

WS-2021-0461 (Medium) detected in swagger-ui-bundle-4.0.0-beta.4.js, swagger-ui-dist-4.0.0-beta.4.tgz - autoclosed

WS-2021-0461 - Medium Severity Vulnerability

Vulnerable Libraries - swagger-ui-bundle-4.0.0-beta.4.js, swagger-ui-dist-4.0.0-beta.4.tgz

swagger-ui-bundle-4.0.0-beta.4.js

Swagger UI is a dependency-free collection of HTML, JavaScript, and CSS assets that dynamically generate beautiful documentation from a Swagger-compliant API

Library home page: https://cdnjs.cloudflare.com/ajax/libs/swagger-ui/4.0.0-beta.4/swagger-ui-bundle.js

Path to dependency file: /node_modules/swagger-ui-dist/index.html

Path to vulnerable library: /node_modules/swagger-ui-dist/./swagger-ui-bundle.js

Dependency Hierarchy:

❌ swagger-ui-bundle-4.0.0-beta.4.js (Vulnerable Library)

swagger-ui-dist-4.0.0-beta.4.tgz

[![NPM version](https://badge.fury.io/js/swagger-ui-dist.svg)](http://badge.fury.io/js/swagger-ui-dist)

Library home page: https://registry.npmjs.org/swagger-ui-dist/-/swagger-ui-dist-4.0.0-beta.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/swagger-ui-dist/package.json

Dependency Hierarchy:

❌ swagger-ui-dist-4.0.0-beta.4.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

SwaggerUI supports displaying remote OpenAPI definitions through the ?url parameter. This enables robust demonstration capabilities on sites like petstore.swagger.io, editor.swagger.io, and similar sites, where users often want to see what their OpenAPI definitions would look like rendered.

However, this functionality may pose a risk for users who host their own SwaggerUI instances. In particular, including remote OpenAPI definitions opens a vector for phishing attacks by abusing the trusted names/domains of self-hosted instances.

Resolution:
We've made the decision to disable query parameters (go-gitea#4872) by default starting with SwaggerUI version 4.1.3. Please update to this version when it becomes available (ETA: 2021 December). Users will still be able to be re-enable the options at their discretion. We'll continue to enable query parameters on the Swagger demo sites.

Publish Date: 2021-12-09

URL: WS-2021-0461

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qrmm-w75w-3wpx

Release Date: 2021-12-09

Fix Resolution: 4.1.3

Step up your Open Source Security Game with Mend here

CVE-2018-20677 (Medium) detected in bootstrap-3.3.1.min.js

CVE-2018-20677 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.1/js/bootstrap.min.js

Path to dependency file: /node_modules/@claviska/jquery-minicolors/index.html

Path to vulnerable library: /node_modules/@claviska/jquery-minicolors/index.html

Dependency Hierarchy:

❌ bootstrap-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.

Publish Date: 2019-01-09

URL: CVE-2018-20677

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677

Release Date: 2019-01-09

Fix Resolution: Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0

Step up your Open Source Security Game with Mend here

WS-2021-0154 (Medium) detected in glob-parent-3.1.0.tgz - autoclosed

WS-2021-0154 - Medium Severity Vulnerability

Vulnerable Library - glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: gitea/web_src/fomantic/package.json

Path to vulnerable library: gitea/web_src/fomantic/node_modules/glob-parent/package.json

Dependency Hierarchy:

fomantic-ui-2.8.7.tgz (Root Library)
- gulp-4.0.2.tgz
  - glob-watcher-5.0.5.tgz
    - chokidar-2.1.8.tgz
      - ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

Regular Expression Denial of Service (ReDoS) vulnerability was found in glob-parent before 5.1.2.

Publish Date: 2021-01-27

URL: WS-2021-0154

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2

Release Date: 2021-01-27

Fix Resolution: glob-parent - 5.1.2

Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):

(CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

• eslint-plugin-import:2.22.1
        └─ eslint-import-resolver-node:0.3.4
              └─ debug:2.6.9
        └─ eslint-module-utils:2.6.0
              └─ debug:2.6.9
        └─ debug:2.6.9

• jest-extended:0.11.5
        └─ expect:24.9.0
              └─ jest-message-util:24.9.0
                    └─ micromatch:3.1.10
                          └─ extglob:2.0.4
                                └─ expand-brackets:2.1.4
                                      └─ debug:2.6.9
                          └─ snapdragon:0.8.2
                                └─ debug:2.6.9

CVE-2020-28469 (High) detected in glob-parent-3.1.0.tgz

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Library - glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /web_src/fomantic/package.json

Path to vulnerable library: /web_src/fomantic/node_modules/glob-parent/package.json

Dependency Hierarchy:

fomantic-ui-2.8.7.tgz (Root Library)
- gulp-4.0.2.tgz
  - glob-watcher-5.0.5.tgz
    - chokidar-2.1.8.tgz
      - ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2

Step up your Open Source Security Game with Mend here

CVE-2019-11840 (Medium) detected in github.com/keybase/go-crypto-v0.0.0-20200123153347-de78d2cb44f4 - autoclosed

CVE-2019-11840 - Medium Severity Vulnerability

Vulnerable Library - github.com/keybase/go-crypto-v0.0.0-20200123153347-de78d2cb44f4

[mirror] Go supplementary cryptography libraries

Library home page: https://proxy.golang.org/github.com/keybase/go-crypto/@v/v0.0.0-20200123153347-de78d2cb44f4.zip

Dependency Hierarchy:

❌ github.com/keybase/go-crypto-v0.0.0-20200123153347-de78d2cb44f4 (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

Publish Date: 2019-05-09

URL: CVE-2019-11840

CVSS 3 Score Details (5.9)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1691529

Fix Resolution: Upgrade to version golang.org/x/crypto v0.0.0-0.20190320223903-b7391e95e576 or greater

Step up your Open Source Security Game with Mend here

CVE-2020-26160 (High) detected in github.com/dgrijalva/jwt-go-v3.2.0 - autoclosed

CVE-2020-26160 - High Severity Vulnerability

Vulnerable Library - github.com/dgrijalva/jwt-go-v3.2.0

Golang implementation of JSON Web Tokens (JWT)

Dependency Hierarchy:

❌ github.com/dgrijalva/jwt-go-v3.2.0 (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

Publish Date: 2020-09-30

URL: CVE-2020-26160

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2021-3777 (High) detected in tmpl-1.0.4.tgz - autoclosed

CVE-2021-3777 - High Severity Vulnerability

Vulnerable Library - tmpl-1.0.4.tgz

JavaScript micro templates.

Library home page: https://registry.npmjs.org/tmpl/-/tmpl-1.0.4.tgz

Path to dependency file: gitea/package.json

Path to vulnerable library: gitea/node_modules/tmpl/package.json

Dependency Hierarchy:

jest-27.0.6.tgz (Root Library)
- core-27.0.6.tgz
  - jest-haste-map-27.0.6.tgz
    - walker-1.0.7.tgz
      - makeerror-1.0.11.tgz
        
        ❌ tmpl-1.0.4.tgz (Vulnerable Library)

Found in HEAD commit: 431042ad5191339c65960ced6a7288ed26c46aab

Found in base branch: main

Vulnerability Details

nodejs-tmpl is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-15

URL: CVE-2021-3777

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/daaku/nodejs-tmpl/releases/tag/v1.0.5

Release Date: 2021-09-15

Fix Resolution: tmpl - 1.0.5

Step up your Open Source Security Game with WhiteSource here

CVE-2021-33623 (High) detected in trim-newlines-3.0.0.tgz - autoclosed

CVE-2021-33623 - High Severity Vulnerability

Vulnerable Library - trim-newlines-3.0.0.tgz

Trim newlines from the start and/or end of a string

Library home page: https://registry.npmjs.org/trim-newlines/-/trim-newlines-3.0.0.tgz

Path to dependency file: gitea/package.json

Path to vulnerable library: gitea/node_modules/trim-newlines/package.json

Dependency Hierarchy:

stylelint-13.13.1.tgz (Root Library)
- meow-9.0.0.tgz
  - ❌ trim-newlines-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

The trim-newlines package before 3.0.1 and 4.x before 4.0.1 for Node.js has an issue related to regular expression denial-of-service (ReDoS) for the .end() method.

Publish Date: 2021-05-28

URL: CVE-2021-33623

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33623

Release Date: 2021-05-28

Fix Resolution: trim-newlines - 3.0.1, 4.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2018-14040 (Medium) detected in bootstrap-3.3.1.min.js

CVE-2018-14040 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.1/js/bootstrap.min.js

Path to dependency file: /node_modules/@claviska/jquery-minicolors/index.html

Path to vulnerable library: /node_modules/@claviska/jquery-minicolors/index.html

Dependency Hierarchy:

❌ bootstrap-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Publish Date: 2018-07-13

URL: CVE-2018-14040

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0

Step up your Open Source Security Game with Mend here

CVE-2020-7656 (Medium) detected in github.com/go-enry/go-enry/v2-v2.7.1, jquery-1.4.2.min.js

CVE-2020-7656 - Medium Severity Vulnerability

Vulnerable Libraries - github.com/go-enry/go-enry/v2-v2.7.1, jquery-1.4.2.min.js

github.com/go-enry/go-enry/v2-v2.7.1

A faster file programming language detector

Library home page: https://proxy.golang.org/github.com/go-enry/go-enry/v2/@v/v2.7.1.zip

Path to dependency file: /go.mod

Path to vulnerable library: /go.mod

Dependency Hierarchy:

❌ github.com/go-enry/go-enry/v2-v2.7.1 (Vulnerable Library)

jquery-1.4.2.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.4.2/jquery.min.js

Path to dependency file: /node_modules/jquery.are-you-sure/demo/are-you-sure-demo.html

Path to vulnerable library: /node_modules/jquery.are-you-sure/demo/are-you-sure-demo.html

Dependency Hierarchy:

❌ jquery-1.4.2.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Publish Date: 2020-05-19

URL: CVE-2020-7656

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q4m3-2j7h-f7xw

Release Date: 2020-05-19

Fix Resolution: jquery - 1.9.0

Step up your Open Source Security Game with Mend here

CVE-2021-23368 (Medium) detected in postcss-7.0.35.tgz - autoclosed

CVE-2021-23368 - Medium Severity Vulnerability

Vulnerable Library - postcss-7.0.35.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.35.tgz

Path to dependency file: gitea/package.json

Path to vulnerable library: gitea/node_modules/postcss-safe-parser/node_modules/postcss/package.json,gitea/node_modules/autoprefixer/node_modules/postcss/package.json,gitea/node_modules/stylelint/node_modules/postcss/package.json,gitea/node_modules/postcss-sass/node_modules/postcss/package.json,gitea/node_modules/@vue/component-compiler-utils/node_modules/postcss/package.json,gitea/node_modules/sugarss/node_modules/postcss/package.json,gitea/node_modules/postcss-scss/node_modules/postcss/package.json,gitea/node_modules/postcss-less/node_modules/postcss/package.json

Dependency Hierarchy:

stylelint-13.13.1.tgz (Root Library)
- sugarss-2.0.0.tgz
  - ❌ postcss-7.0.35.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.

Publish Date: 2021-04-12

URL: CVE-2021-23368

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23368

Release Date: 2021-04-12

Fix Resolution: postcss -8.2.10

Step up your Open Source Security Game with WhiteSource here

CVE-2018-14042 (Medium) detected in bootstrap-3.3.1.min.js

CVE-2018-14042 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-3.3.1.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.1/js/bootstrap.min.js

Path to dependency file: /node_modules/@claviska/jquery-minicolors/index.html

Path to vulnerable library: /node_modules/@claviska/jquery-minicolors/index.html

Dependency Hierarchy:

❌ bootstrap-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Publish Date: 2018-07-13

URL: CVE-2018-14042

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0

Step up your Open Source Security Game with Mend here

CVE-2021-43861 (Medium) detected in mermaid-8.13.3.js, mermaid-8.13.3.tgz

CVE-2021-43861 - Medium Severity Vulnerability

Vulnerable Libraries - mermaid-8.13.3.js, mermaid-8.13.3.tgz

mermaid-8.13.3.js

Markdownish syntax for generating flowcharts, sequence diagrams, class diagrams and gantt charts.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/mermaid/8.13.3/mermaid.js

Path to dependency file: /node_modules/mermaid/dist/flowchart.html

Path to vulnerable library: /node_modules/mermaid/dist/./mermaid.js

Dependency Hierarchy:

❌ mermaid-8.13.3.js (Vulnerable Library)

mermaid-8.13.3.tgz

Markdownish syntax for generating flowcharts, sequence diagrams, class diagrams, gantt charts and git graphs.

Library home page: https://registry.npmjs.org/mermaid/-/mermaid-8.13.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mermaid/package.json

Dependency Hierarchy:

❌ mermaid-8.13.3.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

Mermaid is a Javascript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. Prior to version 8.13.8, malicious diagrams can run javascript code at diagram readers' machines. Users should upgrade to version 8.13.8 to receive a patch. There are no known workarounds aside from upgrading.

Publish Date: 2021-12-30

URL: CVE-2021-43861

CVSS 3 Score Details (5.4)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43861

Release Date: 2021-12-30

Fix Resolution: mermaid - 8.13.8

Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 7.5) Vulnerability due to usage of postcss:7.0.36

Vulnerabilities

DepShield reports that this application's usage of postcss:7.0.36 results in the following vulnerability(s):

(CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

postcss:7.0.36 is a transitive dependency introduced by the following direct dependency(s):

• stylelint:13.13.1
        └─ autoprefixer:9.8.6
              └─ postcss:7.0.36
        └─ postcss-less:3.1.4
              └─ postcss:7.0.36
        └─ postcss-safe-parser:4.0.2
              └─ postcss:7.0.36
        └─ postcss-sass:0.4.4
              └─ postcss:7.0.36
        └─ postcss-scss:2.1.1
              └─ postcss:7.0.36
        └─ postcss:7.0.36
        └─ sugarss:2.0.0
              └─ postcss:7.0.36

• vue-loader:15.9.8
└─ @vue/component-compiler-utils:3.2.2
└─ postcss:7.0.36

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash._reinterpolate:3.0.0

Vulnerabilities

DepShield reports that this application's usage of lodash._reinterpolate:3.0.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash._reinterpolate:3.0.0 is a transitive dependency introduced by the following direct dependency(s):

• license-checker-webpack-plugin:0.2.1
        └─ lodash.template:4.5.0
              └─ lodash._reinterpolate:3.0.0
              └─ lodash.templatesettings:4.2.0
                    └─ lodash._reinterpolate:3.0.0

CVE-2020-7661 (High) detected in url-regex-3.2.0.tgz

CVE-2020-7661 - High Severity Vulnerability

Vulnerable Library - url-regex-3.2.0.tgz

Regular expression for matching URLs

Library home page: https://registry.npmjs.org/url-regex/-/url-regex-3.2.0.tgz

Path to dependency file: /web_src/fomantic/package.json

Path to vulnerable library: /web_src/fomantic/node_modules/url-regex/package.json

Dependency Hierarchy:

fomantic-ui-2.8.7.tgz (Root Library)
- gulp-concat-css-3.1.0.tgz
  - rework-import-2.1.0.tgz
    - ❌ url-regex-3.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

all versions of url-regex are vulnerable to Regular Expression Denial of Service. An attacker providing a very long string in String.test can cause a Denial of Service.

Publish Date: 2020-06-04

URL: CVE-2020-7661

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with Mend here

CVE-2019-10744 (Critical) detected in lodash.template-3.6.2.tgz

CVE-2019-10744 - Critical Severity Vulnerability

Vulnerable Library - lodash.template-3.6.2.tgz

The modern build of lodash’s `_.template` as a module.

Library home page: https://registry.npmjs.org/lodash.template/-/lodash.template-3.6.2.tgz

Path to dependency file: /web_src/fomantic/package.json

Path to vulnerable library: /web_src/fomantic/node_modules/lodash.template/package.json

Dependency Hierarchy:

fomantic-ui-2.8.7.tgz (Root Library)
- gulp-concat-filenames-1.2.0.tgz
  - gulp-util-3.0.8.tgz
    - ❌ lodash.template-3.6.2.tgz (Vulnerable Library)

Found in HEAD commit: 5a07ad71010693de12293f5ff1fadc890259b5e0

Found in base branch: main

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0

Step up your Open Source Security Game with Mend here

turkdevops / gitea Goto Github PK

gitea's Introduction

Gitea - Git with a cup of tea

Purpose

Building

Using

Contributing

Translating

Further information

Authors

Backers

Sponsors

FAQ

License

Screenshots

gitea's People

Contributors

Watchers

gitea's Issues

CVE-2021-33587 - High Severity Vulnerability

CVE-2019-11358 - Medium Severity Vulnerability

CVE-2020-11022 - Medium Severity Vulnerability

CVE-2020-7760 - High Severity Vulnerability

CVE-2020-11023 - Medium Severity Vulnerability

CVE-2021-37713 - High Severity Vulnerability

CVE-2021-23382 - High Severity Vulnerability

WS-2018-0590 - High Severity Vulnerability

CVE-2018-20676 - Medium Severity Vulnerability

CVE-2019-8331 - Medium Severity Vulnerability

CVE-2021-37712 - High Severity Vulnerability

CVE-2016-10735 - Medium Severity Vulnerability

CVE-2021-32640 - Medium Severity Vulnerability

CVE-2016-7103 - Medium Severity Vulnerability

CVE-2021-35513 - Medium Severity Vulnerability

CVE-2012-6708 - Medium Severity Vulnerability

CVE-2021-3803 - High Severity Vulnerability

CVE-2022-0235 - Medium Severity Vulnerability

CVE-2015-9251 - Medium Severity Vulnerability

CVE-2021-3807 - High Severity Vulnerability

CVE-2011-4969 - Low Severity Vulnerability

CVE-2021-23343 - High Severity Vulnerability

WS-2021-0461 - Medium Severity Vulnerability

CVE-2018-20677 - Medium Severity Vulnerability

WS-2021-0154 - Medium Severity Vulnerability

CVE-2020-28469 - High Severity Vulnerability

CVE-2019-11840 - Medium Severity Vulnerability

CVE-2020-26160 - High Severity Vulnerability

CVE-2021-3777 - High Severity Vulnerability

CVE-2021-33623 - High Severity Vulnerability

CVE-2018-14040 - Medium Severity Vulnerability

CVE-2020-7656 - Medium Severity Vulnerability

CVE-2021-23368 - Medium Severity Vulnerability

CVE-2018-14042 - Medium Severity Vulnerability

CVE-2021-43861 - Medium Severity Vulnerability

CVE-2020-7661 - High Severity Vulnerability

CVE-2019-10744 - Critical Severity Vulnerability

Recommend Projects

Recommend Topics

Recommend Org