The website from cloudnetservice

CVE-2021-3801 (Medium) detected in prismjs-1.24.1.tgz

CVE-2021-3801 - Medium Severity Vulnerability

Vulnerable Library - prismjs-1.24.1.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.24.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/prismjs/package.json

Dependency Hierarchy:

preset-classic-2.0.0-beta.9.tgz (Root Library)
- theme-classic-2.0.0-beta.9.tgz
  - ❌ prismjs-1.24.1.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

prism is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-15

URL: CVE-2021-3801

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3801

Release Date: 2021-09-15

Fix Resolution (prismjs): 1.25.0

Direct dependency fix Resolution (@docusaurus/preset-classic): 2.0.0-beta.10

Step up your Open Source Security Game with Mend here

CVE-2021-3807 (High) detected in ansi-regex-4.1.0.tgz, ansi-regex-5.0.0.tgz

CVE-2021-3807 - High Severity Vulnerability

Vulnerable Libraries - ansi-regex-4.1.0.tgz, ansi-regex-5.0.0.tgz

ansi-regex-4.1.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ansi-regex/package.json

Dependency Hierarchy:

core-2.0.0-beta.9.tgz (Root Library)
- boxen-5.0.1.tgz
  - ansi-align-3.0.0.tgz
    - string-width-3.1.0.tgz
      - strip-ansi-5.2.0.tgz
        
        ❌ ansi-regex-4.1.0.tgz (Vulnerable Library)

ansi-regex-5.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ansi-regex/package.json

Dependency Hierarchy:

core-2.0.0-beta.9.tgz (Root Library)
- strip-ansi-6.0.0.tgz
  - ❌ ansi-regex-5.0.0.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution: ansi-regex - 5.0.1,6.0.1

Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.flow:3.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.flow:3.5.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.flow:3.5.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/preset-classic:2.0.0-alpha.74
        └─ @docusaurus/plugin-debug:2.0.0-alpha.74
              └─ react-json-view:1.21.3
                    └─ react-base16-styling:0.6.0
                          └─ lodash.flow:3.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:4.0.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:4.0.0 results in the following vulnerability(s):

(CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Occurrences

kind-of:4.0.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ webpack:4.46.0
              └─ micromatch:3.1.10
                    └─ snapdragon:0.8.2
                          └─ base:0.11.2
                                └─ cache-base:1.0.1
                                      └─ has-value:1.0.0
                                            └─ has-values:1.0.0
                                                  └─ kind-of:4.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.foreach:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.foreach:4.5.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.foreach:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @endiliey/static-site-generator-webpack-plugin:4.0.0
              └─ cheerio:0.22.0
                    └─ lodash.foreach:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.assignin:4.2.0

Vulnerabilities

DepShield reports that this application's usage of lodash.assignin:4.2.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
(CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.assignin:4.2.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @endiliey/static-site-generator-webpack-plugin:4.0.0
              └─ cheerio:0.22.0
                    └─ lodash.assignin:4.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.curry:4.1.1

Vulnerabilities

DepShield reports that this application's usage of lodash.curry:4.1.1 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.curry:4.1.1 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/preset-classic:2.0.0-alpha.74
        └─ @docusaurus/plugin-debug:2.0.0-alpha.74
              └─ react-json-view:1.21.3
                    └─ react-base16-styling:0.6.0
                          └─ lodash.curry:4.1.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

WS-2022-0007 (Medium) detected in node-forge-0.10.0.tgz - autoclosed

WS-2022-0007 - Medium Severity Vulnerability

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

core-2.0.0-beta.9.tgz (Root Library)
- webpack-dev-server-4.5.0.tgz
  - selfsigned-1.10.11.tgz
    - ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

In node-forge before 1.0.0 he regex used for the forge.util.parseUrl API would not properly parse certain inputs resulting in a parsed data structure that could lead to undesired behavior.

Publish Date: 2022-01-08

URL: WS-2022-0007

CVSS 3 Score Details (5.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-08

Fix Resolution: node-forge - 1.0.0

Step up your Open Source Security Game with WhiteSource here

WS-2022-0008 (Medium) detected in node-forge-0.10.0.tgz

WS-2022-0008 - Medium Severity Vulnerability

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

core-2.0.0-beta.9.tgz (Root Library)
- webpack-dev-server-4.5.0.tgz
  - selfsigned-1.10.11.tgz
    - ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

CVSS 3 Score Details (6.6)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution: node-forge - 1.0.0

Step up your Open Source Security Game with Mend here

CVE-2021-33587 (High) detected in css-what-3.4.2.tgz

CVE-2021-33587 - High Severity Vulnerability

Vulnerable Library - css-what-3.4.2.tgz

a CSS selector parser

Library home page: https://registry.npmjs.org/css-what/-/css-what-3.4.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/css-what/package.json

Dependency Hierarchy:

core-2.0.0-beta.9.tgz (Root Library)
- webpack-5.5.0.tgz
  - plugin-svgo-5.5.0.tgz
    - svgo-1.3.2.tgz
      - css-select-2.1.0.tgz
        
        ❌ css-what-3.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 3311ea7d24513020d38449a1169a68ad84daa95e

Found in base branch: development

Vulnerability Details

The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.

Publish Date: 2021-05-28

URL: CVE-2021-33587

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587

Release Date: 2021-05-28

Fix Resolution: css-what - 5.0.1

Step up your Open Source Security Game with Mend here

DepShield encountered errors while building your project

The project could not be analyzed because of build errors. Please review the error messages here. Another build will be scheduled when a change to a manifest file^* occurs. If the build is successful this issue will be closed, otherwise the error message will be updated.

_{This is an automated GitHub Issue created by Sonatype DepShield. GitHub Apps, including DepShield, can be managed from the Developer settings of the repository administrators.}

_{* Supported manifest files are: pom.xml, package.json, package-lock.json, npm-shrinkwrap.json, Cargo.lock, Cargo.toml, main.rs, lib.rs, build.gradle, build.gradle.kts, settings.gradle, settings.gradle.kts, gradle.properties, gradle-wrapper.properties, go.mod, go.sum}

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:5.1.0

Vulnerabilities

DepShield reports that this application's usage of kind-of:5.1.0 results in the following vulnerability(s):

(CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Occurrences

kind-of:5.1.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ webpack:4.46.0
              └─ micromatch:3.1.10
                    └─ snapdragon:0.8.2
                          └─ define-property:0.2.5
                                └─ is-descriptor:0.1.6
                                      └─ kind-of:5.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

CVE-2021-35065 (High) detected in glob-parent-6.0.0.tgz

CVE-2021-35065 - High Severity Vulnerability

Vulnerable Library - glob-parent-6.0.0.tgz

Extract the non-magic parent path from a glob string.

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-6.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

core-2.0.0-beta.9.tgz (Root Library)
- copy-webpack-plugin-9.0.1.tgz
  - ❌ glob-parent-6.0.0.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

The package glob-parent before 6.0.1 are vulnerable to Regular Expression Denial of Service (ReDoS)

Publish Date: 2021-06-22

URL: CVE-2021-35065

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-06-22

Fix Resolution: glob-parent - 6.0.1

Step up your Open Source Security Game with Mend here

CVE-2021-33502 (High) detected in normalize-url-4.5.0.tgz - autoclosed

CVE-2021-33502 - High Severity Vulnerability

Vulnerable Library - normalize-url-4.5.0.tgz

Normalize a URL

Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-4.5.0.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/normalize-url

Dependency Hierarchy:

core-2.0.0-beta.2.tgz (Root Library)
- update-notifier-5.1.0.tgz
  - latest-version-5.1.0.tgz
    - package-json-6.5.0.tgz
      - got-9.6.0.tgz
        
        cacheable-request-6.1.0.tgz
        
        ❌ normalize-url-4.5.0.tgz (Vulnerable Library)

Found in HEAD commit: 3311ea7d24513020d38449a1169a68ad84daa95e

Found in base branch: development

Vulnerability Details

The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.

Publish Date: 2021-05-24

URL: CVE-2021-33502

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502

Release Date: 2021-05-24

Fix Resolution: normalize-url - 4.5.1, 5.3.1, 6.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2021-3757 (High) detected in immer-8.0.1.tgz - autoclosed

CVE-2021-3757 - High Severity Vulnerability

Vulnerable Library - immer-8.0.1.tgz

Create your next immutable state by mutating the current one

Library home page: https://registry.npmjs.org/immer/-/immer-8.0.1.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/immer/package.json

Dependency Hierarchy:

plugin-client-redirects-2.0.0-beta.8.tgz (Root Library)
- core-2.0.0-beta.8.tgz
  - react-dev-utils-11.0.4.tgz
    - ❌ immer-8.0.1.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

immer is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-09-02

URL: CVE-2021-3757

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/23d38099-71cd-42ed-a77a-71e68094adfa/

Release Date: 2021-09-02

Fix Resolution: immer - 9.0.6

Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.flatten:4.4.0

Vulnerabilities

DepShield reports that this application's usage of lodash.flatten:4.4.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
(CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.flatten:4.4.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @endiliey/static-site-generator-webpack-plugin:4.0.0
              └─ cheerio:0.22.0
                    └─ lodash.flatten:4.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

CVE-2021-23436 (High) detected in immer-8.0.1.tgz - autoclosed

CVE-2021-23436 - High Severity Vulnerability

Vulnerable Library - immer-8.0.1.tgz

Create your next immutable state by mutating the current one

Library home page: https://registry.npmjs.org/immer/-/immer-8.0.1.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/immer/package.json

Dependency Hierarchy:

plugin-client-redirects-2.0.0-beta.8.tgz (Root Library)
- core-2.0.0-beta.8.tgz
  - react-dev-utils-11.0.4.tgz
    - ❌ immer-8.0.1.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

This affects the package immer before 9.0.6. A type confusion vulnerability can lead to a bypass of CVE-2020-28477 when the user-provided keys used in the path parameter are arrays. In particular, this bypass is possible because the condition (p === "proto" || p === "constructor") in applyPatches_ returns false if p is ['proto'] (or ['constructor']). The === operator (strict equality operator) returns false if the operands have different type.

Publish Date: 2021-09-01

URL: CVE-2021-23436

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23436

Release Date: 2021-09-01

Fix Resolution: immer - 9.0.6

Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.reject:4.6.0

Vulnerabilities

DepShield reports that this application's usage of lodash.reject:4.6.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.reject:4.6.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @endiliey/static-site-generator-webpack-plugin:4.0.0
              └─ cheerio:0.22.0
                    └─ lodash.reject:4.6.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

CVE-2021-23386 (Medium) detected in dns-packet-1.3.1.tgz - autoclosed

CVE-2021-23386 - Medium Severity Vulnerability

Vulnerable Library - dns-packet-1.3.1.tgz

An abstract-encoding compliant module for encoding / decoding DNS packets

Library home page: https://registry.npmjs.org/dns-packet/-/dns-packet-1.3.1.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/dns-packet

Dependency Hierarchy:

core-2.0.0-beta.2.tgz (Root Library)
- webpack-dev-server-3.11.2.tgz
  - bonjour-3.5.0.tgz
    - multicast-dns-6.2.3.tgz
      - ❌ dns-packet-1.3.1.tgz (Vulnerable Library)

Found in HEAD commit: 3311ea7d24513020d38449a1169a68ad84daa95e

Found in base branch: development

Vulnerability Details

This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.

Publish Date: 2021-05-20

URL: CVE-2021-23386

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23386

Release Date: 2021-05-20

Fix Resolution: dns-packet - 5.2.2

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23424 (High) detected in ansi-html-0.0.7.tgz - autoclosed

CVE-2021-23424 - High Severity Vulnerability

Vulnerable Library - ansi-html-0.0.7.tgz

An elegant lib that converts the chalked (ANSI) text to HTML.

Library home page: https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.7.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/ansi-html/package.json

Dependency Hierarchy:

plugin-client-redirects-2.0.0-beta.8.tgz (Root Library)
- core-2.0.0-beta.8.tgz
  - webpack-dev-server-3.11.2.tgz
    - ❌ ansi-html-0.0.7.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.

Publish Date: 2021-08-18

URL: CVE-2021-23424

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2021-23364 (Medium) detected in browserslist-4.14.2.tgz - autoclosed

CVE-2021-23364 - Medium Severity Vulnerability

Vulnerable Library - browserslist-4.14.2.tgz

Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset

Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.14.2.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/browserslist/package.json

Dependency Hierarchy:

plugin-client-redirects-2.0.0-beta.8.tgz (Root Library)
- core-2.0.0-beta.8.tgz
  - react-dev-utils-11.0.4.tgz
    - ❌ browserslist-4.14.2.tgz (Vulnerable Library)

Found in HEAD commit: 3311ea7d24513020d38449a1169a68ad84daa95e

Found in base branch: development

Vulnerability Details

The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.

Publish Date: 2021-04-28

URL: CVE-2021-23364

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364

Release Date: 2021-04-28

Fix Resolution: browserslist - 4.16.5

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7753 (High) detected in trim-0.0.1.tgz

CVE-2020-7753 - High Severity Vulnerability

Vulnerable Library - trim-0.0.1.tgz

Trim string whitespace

Library home page: https://registry.npmjs.org/trim/-/trim-0.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/trim/package.json

Dependency Hierarchy:

eslint-plugin-mdx-1.16.0.tgz (Root Library)
- eslint-mdx-1.16.0.tgz
  - remark-parse-8.0.3.tgz
    - ❌ trim-0.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 3311ea7d24513020d38449a1169a68ad84daa95e

Found in base branch: development

Vulnerability Details

All versions of package trim are vulnerable to Regular Expression Denial of Service (ReDoS) via trim().

Publish Date: 2020-10-27

URL: CVE-2020-7753

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-10-27

Fix Resolution (trim): 0.0.3

Direct dependency fix Resolution (eslint-plugin-mdx): 2.0.0-next.0

Step up your Open Source Security Game with Mend here

WS-2021-0154 (Medium) detected in glob-parent-3.1.0.tgz - autoclosed

WS-2021-0154 - Medium Severity Vulnerability

Vulnerable Library - glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/glob-parent

Dependency Hierarchy:

core-2.0.0-beta.3.tgz (Root Library)
- webpack-dev-server-3.11.2.tgz
  - chokidar-2.1.8.tgz
    - ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

Regular Expression Denial of Service (ReDoS) vulnerability was found in glob-parent before 5.1.2.

Publish Date: 2021-01-27

URL: WS-2021-0154

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/gulpjs/glob-parent/releases/tag/v5.1.2

Release Date: 2021-01-27

Fix Resolution: glob-parent - 5.1.2

Step up your Open Source Security Game with WhiteSource here

CVE-2020-28469 (High) detected in glob-parent-3.1.0.tgz - autoclosed

CVE-2020-28469 - High Severity Vulnerability

Vulnerable Library - glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/glob-parent/package.json

Dependency Hierarchy:

plugin-client-redirects-2.0.0-beta.8.tgz (Root Library)
- core-2.0.0-beta.8.tgz
  - webpack-dev-server-3.11.2.tgz
    - chokidar-2.1.8.tgz
      - ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 3311ea7d24513020d38449a1169a68ad84daa95e

Found in base branch: development

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution: glob-parent - 5.1.2

Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 5.3) Vulnerability due to usage of kind-of:3.2.2

Vulnerabilities

DepShield reports that this application's usage of kind-of:3.2.2 results in the following vulnerability(s):

(CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

Occurrences

kind-of:3.2.2 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ react-dev-utils:11.0.4
              └─ fork-ts-checker-webpack-plugin:4.1.6
                    └─ micromatch:3.1.10
                          └─ braces:2.3.2
                                └─ fill-range:4.0.0
                                      └─ is-number:3.0.0
                                            └─ kind-of:3.2.2
        └─ webpack:4.46.0
              └─ watchpack:1.7.5
                    └─ watchpack-chokidar2:2.0.1
                          └─ chokidar:2.1.8
                                └─ braces:2.3.2
                                      └─ fill-range:4.0.0
                                            └─ is-number:3.0.0
                                                  └─ kind-of:3.2.2
              └─ micromatch:3.1.10
                    └─ snapdragon:0.8.2
                          └─ base:0.11.2
                                └─ cache-base:1.0.1
                                      └─ has-value:1.0.0
                                            └─ has-values:1.0.0
                                                  └─ is-number:3.0.0
                                                        └─ kind-of:3.2.2
                                      └─ to-object-path:0.3.0
                                            └─ kind-of:3.2.2
                                └─ class-utils:0.3.6
                                      └─ static-extend:0.1.2
                                            └─ object-copy:0.1.0
                                                  └─ kind-of:3.2.2
                          └─ define-property:0.2.5
                                └─ is-descriptor:0.1.6
                                      └─ is-accessor-descriptor:0.1.6
                                            └─ kind-of:3.2.2
                                      └─ is-data-descriptor:0.1.4
                                            └─ kind-of:3.2.2
                    └─ braces:2.3.2
                          └─ snapdragon-node:2.1.1
                                └─ snapdragon-util:3.0.1
                                      └─ kind-of:3.2.2
                          └─ fill-range:4.0.0
                                └─ is-number:3.0.0
                                      └─ kind-of:3.2.2
        └─ webpack-dev-server:3.11.2
              └─ http-proxy-middleware:0.19.1
                    └─ micromatch:3.1.10
                          └─ braces:2.3.2
                                └─ fill-range:4.0.0
                                      └─ is-number:3.0.0
                                            └─ kind-of:3.2.2
              └─ chokidar:2.1.8
                    └─ braces:2.3.2
                          └─ fill-range:4.0.0
                                └─ is-number:3.0.0
                                      └─ kind-of:3.2.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

CVE-2022-0155 (Medium) detected in follow-redirects-1.14.1.tgz

CVE-2022-0155 - Medium Severity Vulnerability

Vulnerable Library - follow-redirects-1.14.1.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

core-2.0.0-beta.9.tgz (Root Library)
- wait-on-6.0.0.tgz
  - axios-0.21.1.tgz
    - ❌ follow-redirects-1.14.1.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution: follow-redirects - v1.14.7

Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.some:4.6.0

Vulnerabilities

DepShield reports that this application's usage of lodash.some:4.6.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.some:4.6.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @endiliey/static-site-generator-webpack-plugin:4.0.0
              └─ cheerio:0.22.0
                    └─ lodash.some:4.6.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of q:1.5.1

Vulnerabilities

DepShield reports that this application's usage of q:1.5.1 results in the following vulnerability(s):

(CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Occurrences

q:1.5.1 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @svgr/webpack:5.5.0
              └─ @svgr/plugin-svgo:5.5.0
                    └─ svgo:1.3.2
                          └─ coa:2.0.2
                                └─ q:1.5.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

CVE-2021-3664 (Medium) detected in url-parse-1.5.1.tgz - autoclosed

CVE-2021-3664 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.5.1.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.5.1.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/url-parse/package.json

Dependency Hierarchy:

plugin-client-redirects-2.0.0-beta.8.tgz (Root Library)
- core-2.0.0-beta.8.tgz
  - webpack-dev-server-3.11.2.tgz
    - sockjs-client-1.5.1.tgz
      - ❌ url-parse-1.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 2b2b277f6943a3d596606e9558b19fe6aaef3f58

Found in base branch: development

Vulnerability Details

url-parse is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2021-07-26

URL: CVE-2021-3664

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3664

Release Date: 2021-07-26

Fix Resolution: url-parse - 1.5.2

Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.memoize:4.1.2

Vulnerabilities

DepShield reports that this application's usage of lodash.memoize:4.1.2 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
(CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.memoize:4.1.2 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @docusaurus/cssnano-preset:2.0.0-alpha.74
              └─ cssnano-preset-advanced:4.0.8
                    └─ cssnano-preset-default:4.0.8
                          └─ postcss-merge-rules:4.0.3
                                └─ caniuse-api:3.0.0
                                      └─ lodash.memoize:4.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.defaults:4.2.0

Vulnerabilities

DepShield reports that this application's usage of lodash.defaults:4.2.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.defaults:4.2.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @endiliey/static-site-generator-webpack-plugin:4.0.0
              └─ cheerio:0.22.0
                    └─ lodash.defaults:4.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.toarray:4.4.0

Vulnerabilities

DepShield reports that this application's usage of lodash.toarray:4.4.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.toarray:4.4.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/preset-classic:2.0.0-alpha.74
        └─ @docusaurus/plugin-content-blog:2.0.0-alpha.74
              └─ @docusaurus/mdx-loader:2.0.0-alpha.74
                    └─ remark-emoji:2.2.0
                          └─ node-emoji:1.10.0
                                └─ lodash.toarray:4.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

CVE-2021-3803 (High) detected in nth-check-1.0.2.tgz, nth-check-2.0.0.tgz

CVE-2021-3803 - High Severity Vulnerability

Vulnerable Libraries - nth-check-1.0.2.tgz, nth-check-2.0.0.tgz

nth-check-1.0.2.tgz

performant nth-check parser & compiler

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-1.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nth-check/package.json

Dependency Hierarchy:

core-2.0.0-beta.9.tgz (Root Library)
- static-site-generator-webpack-plugin-4.0.1.tgz
  - cheerio-0.22.0.tgz
    - css-select-1.2.0.tgz
      - ❌ nth-check-1.0.2.tgz (Vulnerable Library)

nth-check-2.0.0.tgz

Parses and compiles CSS nth-checks to highly optimized functions.

Library home page: https://registry.npmjs.org/nth-check/-/nth-check-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nth-check/package.json

Dependency Hierarchy:

core-2.0.0-beta.9.tgz (Root Library)
- html-webpack-plugin-5.4.0.tgz
  - pretty-error-3.0.4.tgz
    - renderkid-2.0.7.tgz
      - css-select-4.1.3.tgz
        
        ❌ nth-check-2.0.0.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

nth-check is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3803

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-09-17

Fix Resolution: nth-check - v2.0.1

Step up your Open Source Security Game with Mend here

CVE-2021-3749 (High) detected in axios-0.21.1.tgz

CVE-2021-3749 - High Severity Vulnerability

Vulnerable Library - axios-0.21.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.21.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/axios/package.json

Dependency Hierarchy:

core-2.0.0-beta.9.tgz (Root Library)
- wait-on-6.0.0.tgz
  - ❌ axios-0.21.1.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

axios is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-08-31

URL: CVE-2021-3749

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/

Release Date: 2021-08-31

Fix Resolution: axios - 0.21.2

Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.filter:4.6.0

Vulnerabilities

DepShield reports that this application's usage of lodash.filter:4.6.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.filter:4.6.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @endiliey/static-site-generator-webpack-plugin:4.0.0
              └─ cheerio:0.22.0
                    └─ lodash.filter:4.6.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.bind:4.2.1

Vulnerabilities

DepShield reports that this application's usage of lodash.bind:4.2.1 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.bind:4.2.1 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @endiliey/static-site-generator-webpack-plugin:4.0.0
              └─ cheerio:0.22.0
                    └─ lodash.bind:4.2.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.reduce:4.6.0

Vulnerabilities

DepShield reports that this application's usage of lodash.reduce:4.6.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.reduce:4.6.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @endiliey/static-site-generator-webpack-plugin:4.0.0
              └─ cheerio:0.22.0
                    └─ lodash.reduce:4.6.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

CVE-2021-32640 (Medium) detected in ws-7.4.5.tgz, ws-6.2.1.tgz - autoclosed

CVE-2021-32640 - Medium Severity Vulnerability

Vulnerable Libraries - ws-7.4.5.tgz, ws-6.2.1.tgz

ws-7.4.5.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-7.4.5.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/ws

Dependency Hierarchy:

core-2.0.0-beta.2.tgz (Root Library)
- webpack-bundle-analyzer-4.4.2.tgz
  - ❌ ws-7.4.5.tgz (Vulnerable Library)

ws-6.2.1.tgz

Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js

Library home page: https://registry.npmjs.org/ws/-/ws-6.2.1.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/ws

Dependency Hierarchy:

core-2.0.0-beta.2.tgz (Root Library)
- webpack-dev-server-3.11.2.tgz
  - ❌ ws-6.2.1.tgz (Vulnerable Library)

Found in HEAD commit: 3311ea7d24513020d38449a1169a68ad84daa95e

Found in base branch: development

Vulnerability Details

ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (websockets/ws@00c425e). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options.

Publish Date: 2021-05-25

URL: CVE-2021-32640

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6fc8-4gx4-v693

Release Date: 2021-05-25

Fix Resolution: ws - 7.4.6

Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.4) Vulnerability due to usage of ini:1.3.8

Vulnerabilities

DepShield reports that this application's usage of ini:1.3.8 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

ini:1.3.8 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ react-dev-utils:11.0.4
              └─ global-modules:2.0.0
                    └─ global-prefix:3.0.0
                          └─ ini:1.3.8
        └─ update-notifier:5.1.0
              └─ latest-version:5.1.0
                    └─ package-json:6.5.0
                          └─ registry-auth-token:4.2.1
                                └─ rc:1.2.8
                                      └─ ini:1.3.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

CVE-2021-23343 (High) detected in path-parse-1.0.6.tgz - autoclosed

CVE-2021-23343 - High Severity Vulnerability

Vulnerable Library - path-parse-1.0.6.tgz

Node.js path.parse() ponyfill

Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/path-parse

Dependency Hierarchy:

core-2.0.0-beta.2.tgz (Root Library)
- shelljs-0.8.4.tgz
  - rechoir-0.6.2.tgz
    - resolve-1.20.0.tgz
      - ❌ path-parse-1.0.6.tgz (Vulnerable Library)

Found in HEAD commit: 3311ea7d24513020d38449a1169a68ad84daa95e

Found in base branch: development

Vulnerability Details

All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.

Publish Date: 2021-05-04

URL: CVE-2021-23343

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jbgutierrez/path-parse#8

Release Date: 2021-05-04

Fix Resolution: path-parse - 1.0.7

Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.uniq:4.5.0

Vulnerabilities

DepShield reports that this application's usage of lodash.uniq:4.5.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
(CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.uniq:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @docusaurus/cssnano-preset:2.0.0-alpha.74
              └─ cssnano-preset-advanced:4.0.8
                    └─ cssnano-preset-default:4.0.8
                          └─ postcss-merge-rules:4.0.3
                                └─ caniuse-api:3.0.0
                                      └─ lodash.uniq:4.5.0

• @docusaurus/preset-classic:2.0.0-alpha.74
        └─ @docusaurus/theme-classic:2.0.0-alpha.74
              └─ @mdx-js/mdx:1.6.22
                    └─ lodash.uniq:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of http-proxy:1.18.1

Vulnerabilities

DepShield reports that this application's usage of http-proxy:1.18.1 results in the following vulnerability(s):

(CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

http-proxy:1.18.1 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ webpack-dev-server:3.11.2
              └─ http-proxy-middleware:0.19.1
                    └─ http-proxy:1.18.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

CVE-2021-32723 (High) detected in prismjs-1.23.0.tgz - autoclosed

CVE-2021-32723 - High Severity Vulnerability

Vulnerable Library - prismjs-1.23.0.tgz

Lightweight, robust, elegant syntax highlighting. A spin-off project from Dabblet.

Library home page: https://registry.npmjs.org/prismjs/-/prismjs-1.23.0.tgz

Path to dependency file: website/package.json

Path to vulnerable library: website/node_modules/prismjs

Dependency Hierarchy:

preset-classic-2.0.0-beta.2.tgz (Root Library)
- theme-classic-2.0.0-beta.2.tgz
  - ❌ prismjs-1.23.0.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Prism is used to highlight untrusted (user-given) text, an attacker can craft a string that will take a very very long time to highlight. This problem has been fixed in Prism v1.24. As a workaround, do not use ASCIIDoc or ERB to highlight untrusted text. Other languages are not affected and can be used to highlight untrusted text.

Publish Date: 2021-06-28

URL: CVE-2021-32723

CVSS 3 Score Details (7.4)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gj77-59wh-66hg

Release Date: 2021-06-28

Fix Resolution: prismjs - 1.24.0

Step up your Open Source Security Game with WhiteSource here

[DepShield] (CVSS 7.5) Vulnerability due to usage of express:4.17.1

Vulnerabilities

DepShield reports that this application's usage of express:4.17.1 results in the following vulnerability(s):

(CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Occurrences

express:4.17.1 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ express:4.17.1
        └─ webpack-dev-server:3.11.2
              └─ express:4.17.1

• @docusaurus/plugin-client-redirects:2.0.0-alpha.75
└─ @docusaurus/core:2.0.0-alpha.75
└─ express:4.17.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.debounce:4.0.8

Vulnerabilities

DepShield reports that this application's usage of lodash.debounce:4.0.8 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
(CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

Occurrences

lodash.debounce:4.0.8 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @babel/plugin-transform-runtime:7.13.15
              └─ babel-plugin-polyfill-corejs2:0.2.0
                    └─ @babel/helper-define-polyfill-provider:0.2.0
                          └─ lodash.debounce:4.0.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.map:4.6.0

Vulnerabilities

DepShield reports that this application's usage of lodash.map:4.6.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.map:4.6.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @endiliey/static-site-generator-webpack-plugin:4.0.0
              └─ cheerio:0.22.0
                    └─ lodash.map:4.6.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Implement German Translations by CrowdIn

We want to finally implement translations of our English pages in German.
Therefore, the following steps are needed before we are able to use the CrowdIn integration:

Use the Translation API (e.g. for the main page)
Move MDX Code (e.g. the Dependencies into MDX Codeblocks)
Generate explicit heading ids
Add a CrowdIn Configuration customised for this project
Set custom Edit URLs for the pages translated by CrowdIn
Finally: Add CrowdIn to the Build process of the website

I hope I did not forget anything, I might edit this Issue in the future. It is mainly intended to keep a record how far we are, I will create the Branch to begin with the work as soon as possible.

CVE-2022-0122 (Medium) detected in node-forge-0.10.0.tgz

CVE-2022-0122 - Medium Severity Vulnerability

Vulnerable Library - node-forge-0.10.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

core-2.0.0-beta.9.tgz (Root Library)
- webpack-dev-server-4.5.0.tgz
  - selfsigned-1.10.11.tgz
    - ❌ node-forge-0.10.0.tgz (Vulnerable Library)

Found in base branch: development

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2022-01-06

URL: CVE-2022-0122

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution: node-forge - 1.0.0

Step up your Open Source Security Game with Mend here

[DepShield] (CVSS 7.4) Vulnerability due to usage of lodash.pick:4.4.0

Vulnerabilities

DepShield reports that this application's usage of lodash.pick:4.4.0 results in the following vulnerability(s):

(CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)

Occurrences

lodash.pick:4.4.0 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ @endiliey/static-site-generator-webpack-plugin:4.0.0
              └─ cheerio:0.22.0
                    └─ lodash.pick:4.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

[DepShield] (CVSS 7.5) Vulnerability due to usage of debug:2.6.9

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.9 results in the following vulnerability(s):

(CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

Occurrences

debug:2.6.9 is a transitive dependency introduced by the following direct dependency(s):

• @docusaurus/core:2.0.0-alpha.74
        └─ detect-port:1.3.0
              └─ debug:2.6.9
        └─ express:4.17.1
              └─ body-parser:1.19.0
                    └─ debug:2.6.9
              └─ debug:2.6.9
              └─ finalhandler:1.1.2
                    └─ debug:2.6.9
              └─ send:0.17.1
                    └─ debug:2.6.9
        └─ react-dev-utils:11.0.4
              └─ detect-port-alt:1.1.6
                    └─ debug:2.6.9
        └─ webpack:4.46.0
              └─ micromatch:3.1.10
                    └─ extglob:2.0.4
                          └─ expand-brackets:2.1.4
                                └─ debug:2.6.9
                    └─ snapdragon:0.8.2
                          └─ debug:2.6.9
        └─ webpack-dev-server:3.11.2
              └─ compression:1.7.4
                    └─ debug:2.6.9
              └─ serve-index:1.9.1
                    └─ debug:2.6.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

cloudnetservice / website Goto Github PK

website's Introduction

Website

Installation

Local Development

Build

Deployment

website's People

Contributors

Stargazers

Watchers

Forkers

website's Issues

CVE-2021-3801 - Medium Severity Vulnerability

CVE-2021-3807 - High Severity Vulnerability

WS-2022-0007 - Medium Severity Vulnerability

WS-2022-0008 - Medium Severity Vulnerability

CVE-2021-33587 - High Severity Vulnerability

CVE-2021-35065 - High Severity Vulnerability

CVE-2021-33502 - High Severity Vulnerability

CVE-2021-3757 - High Severity Vulnerability

CVE-2021-23436 - High Severity Vulnerability

CVE-2021-23386 - Medium Severity Vulnerability

CVE-2021-23424 - High Severity Vulnerability

CVE-2021-23364 - Medium Severity Vulnerability

CVE-2020-7753 - High Severity Vulnerability

WS-2021-0154 - Medium Severity Vulnerability

CVE-2020-28469 - High Severity Vulnerability

CVE-2022-0155 - Medium Severity Vulnerability

CVE-2021-3664 - Medium Severity Vulnerability

CVE-2021-3803 - High Severity Vulnerability

CVE-2021-3749 - High Severity Vulnerability

CVE-2021-32640 - Medium Severity Vulnerability

CVE-2021-23343 - High Severity Vulnerability

CVE-2021-32723 - High Severity Vulnerability

CVE-2022-0122 - Medium Severity Vulnerability

Recommend Projects

Recommend Topics

Recommend Org