ecommeasy / ecommeasy-store Goto Github PK
View Code? Open in Web Editor NEWLicense: MIT License
License: MIT License
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.
Publish Date: 2018-12-03
URL: CVE-2018-19827
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-12-03
Fix Resolution: GR.PageRender.Razor - 1.8.0;Fable.Template.Elmish.React - 0.1.6
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.
Publish Date: 2019-01-30
URL: WS-2019-0064
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/755/
Release Date: 2019-01-30
Fix Resolution: 4.1.2-0
Step up your Open Source Security Game with Mend here
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.6.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/serialize-javascript/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Publish Date: 2020-06-01
URL: CVE-2020-7660
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660
Release Date: 2020-06-08
Fix Resolution (serialize-javascript): 3.1.0
Direct dependency fix Resolution (webpack): 4.30.0
Step up your Open Source Security Game with Mend here
YAML 1.2 parser and serializer
Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.13.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/js-yaml/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.
Publish Date: 2019-04-05
URL: WS-2019-0063
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/813
Release Date: 2019-04-05
Fix Resolution (js-yaml): 3.13.1
Direct dependency fix Resolution (eslint): 5.16.0
Step up your Open Source Security Game with Mend here
Advanced file system stream things
Library home page: https://registry.npmjs.org/fstream/-/fstream-1.0.11.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /tmp/git/EcommEasy-Store/node_modules/fstream/package.json
Dependency Hierarchy:
Versions of fstream prior to 1.0.12 are vulnerable to Arbitrary File Overwrite.
Publish Date: 2019-05-23
URL: WS-2019-0100
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/886
Release Date: 2019-05-23
Fix Resolution: 1.0.12
Step up your Open Source Security Game with WhiteSource here
Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.
Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /tmp/git/EcommEasy-Store/node_modules/braces/package.json
Dependency Hierarchy:
Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.
Publish Date: 2019-03-25
URL: WS-2019-0019
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/786
Release Date: 2019-02-21
Fix Resolution: 2.3.1
Step up your Open Source Security Game with WhiteSource here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: EcommEasy-Store/node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: 5741eb749a071020b9cbfaa9d02e738a630ee181
Arbitrary Code Execution vulnerability found in handlebars before 4.5.3. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.It is due to an incomplete fix for a WS-2019-0331.
Publish Date: 2019-11-17
URL: WS-2019-0332
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1324
Release Date: 2019-12-05
Fix Resolution: handlebars - 4.5.3
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp.
Publish Date: 2019-11-06
URL: CVE-2019-18797
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-18797
Release Date: 2019-11-06
Fix Resolution: 4.14.0
Step up your Open Source Security Game with Mend here
Get the native type of a value.
Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/watchpack/node_modules/kind-of/package.json
Dependency Hierarchy:
Found in base branch: master
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Publish Date: 2019-12-30
URL: CVE-2019-20149
Base Score Metrics:
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149
Release Date: 2019-12-30
Fix Resolution (kind-of): 6.0.3
Direct dependency fix Resolution (webpack): 4.30.0
Step up your Open Source Security Game with Mend here
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js
Path to dependency file: /tmp/ws-scm/EcommEasy-Store/node_modules/vm-browserify/example/run/index.html
Path to vulnerable library: /EcommEasy-Store/node_modules/vm-browserify/example/run/index.html
Dependency Hierarchy:
Found in HEAD commit: c9304d73ea89e8b5a86f81db18ead1dc2561174b
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.
Publish Date: 2018-01-18
URL: CVE-2012-6708
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708
Release Date: 2018-01-18
Fix Resolution: jQuery - v1.9.0
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().
Publish Date: 2018-12-04
URL: CVE-2018-19838
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: EcommEasy-Store/node_modules/node-sass/package.json
Dependency Hierarchy:
An issue was discovered in LibSass <3.5.3. A NULL pointer dereference was found in the function Sass::Expand::operator which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.
Publish Date: 2018-06-04
URL: CVE-2018-11695
Base Score Metrics:
Type: Upgrade version
Origin: sass/libsass#2664
Release Date: 2018-06-04
Fix Resolution: Libsass:3.5.3, Node-sass:4.9.0
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.
Publish Date: 2018-12-04
URL: CVE-2018-19839
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-12-04
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
Utilities for ESLint plugins.
Library home page: https://registry.npmjs.org/eslint-utils/-/eslint-utils-1.3.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/eslint-utils/package.json
Dependency Hierarchy:
Found in HEAD commit: 7fc32a1c12d6b5ecc7ad15c905a2cba90e9af42a
Found in base branch: master
In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.
Publish Date: 2019-08-26
URL: CVE-2019-15657
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15657
Release Date: 2020-08-24
Fix Resolution (eslint-utils): 1.4.1
Direct dependency fix Resolution (eslint): 5.16.0
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.
Publish Date: 2018-12-17
URL: CVE-2018-20190
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-12-17
Fix Resolution: GR.PageRender.Razor - 1.8.0;Fable.Template.Elmish.React - 0.1.6
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Inspect::operator which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.
Publish Date: 2018-06-04
URL: CVE-2018-11696
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp).
Publish Date: 2019-04-23
URL: CVE-2018-20822
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: EcommEasy-Store/node_modules/handlebars/package.json
Dependency Hierarchy:
handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.
Publish Date: 2019-11-19
URL: WS-2019-0492
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1324
Release Date: 2019-11-19
Fix Resolution: handlebars - 3.0.8,4.5.3
Step up your Open Source Security Game with WhiteSource here
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-2.2.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /tmp/git/EcommEasy-Store/node_modules/tar/package.json
Dependency Hierarchy:
Versions of node-tar prior to 4.4.2 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.
Publish Date: 2019-04-05
URL: WS-2019-0047
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/803
Release Date: 2019-04-05
Fix Resolution: 4.4.2
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp).
Publish Date: 2019-04-23
URL: CVE-2018-20821
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-04-23
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js
Path to dependency file: /tmp/ws-scm/EcommEasy-Store/node_modules/js-base64/test/index.html
Path to vulnerable library: /EcommEasy-Store/node_modules/js-base64/test/index.html
Dependency Hierarchy:
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js
Path to dependency file: /tmp/ws-scm/EcommEasy-Store/node_modules/vm-browserify/example/run/index.html
Path to vulnerable library: /EcommEasy-Store/node_modules/vm-browserify/example/run/index.html
Dependency Hierarchy:
Found in HEAD commit: c9304d73ea89e8b5a86f81db18ead1dc2561174b
JQuery, before 2.2.0, is vulnerable to Cross-site Scripting (XSS) attacks via text/javascript response with arbitrary code execution.
Publish Date: 2016-11-27
URL: WS-2016-0090
Type: Upgrade version
Origin: jquery/jquery@b078a62
Release Date: 2019-04-08
Fix Resolution: 2.2.0
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.
Publish Date: 2019-01-14
URL: CVE-2019-6283
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-01-14
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: EcommEasy-Store/node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: 5741eb749a071020b9cbfaa9d02e738a630ee181
In handlebars, versions prior to v4.5.3 are vulnerable to prototype pollution. Using a malicious template it's possbile to add or modify properties to the Object prototype. This can also lead to DOS and RCE in certain conditions.
Publish Date: 2019-11-18
URL: WS-2019-0333
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1325
Release Date: 2019-12-05
Fix Resolution: handlebars - 4.5.3
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly() which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
Publish Date: 2018-06-04
URL: CVE-2018-11697
Base Score Metrics:
Step up your Open Source Security Game with Mend here
The Lodash method `_.mergeWith` exported as a module.
Library home page: https://registry.npmjs.org/lodash.mergewith/-/lodash.mergewith-4.6.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/lodash.mergewith/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
lodash.mergewith before 4.6.2 is vulnerable to prototype pollution. The function mergeWith() may allow a malicious user to modify the prototype of Object via {constructor: {prototype: {...}}} causing the addition or modification of an existing property that will exist on all objects.
Publish Date: 2019-08-14
URL: WS-2019-0180
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1071
Release Date: 2019-08-14
Fix Resolution (lodash.mergewith): 4.6.2
Direct dependency fix Resolution (node-sass): 4.12.0
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693.
Publish Date: 2019-01-14
URL: CVE-2019-6286
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-07-23
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
The lodash method `_.template` exported as a module.
Library home page: https://registry.npmjs.org/lodash.template/-/lodash.template-4.4.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/lodash.template/package.json
Dependency Hierarchy:
Lodash exported as ES modules.
Library home page: https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.11.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/lodash-es/package.json
Dependency Hierarchy:
The Lodash method `_.mergeWith` exported as a module.
Library home page: https://registry.npmjs.org/lodash.mergewith/-/lodash.mergewith-4.6.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/lodash.mergewith/package.json
Dependency Hierarchy:
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-07-26
URL: CVE-2019-10744
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-jf85-cpcp-j695
Release Date: 2019-07-26
Fix Resolution (lodash.template): 4.5.0
Direct dependency fix Resolution (workbox-webpack-plugin): 4.0.0
Fix Resolution (lodash-es): 4.5.0
Direct dependency fix Resolution (redux-form): 7.4.3
Fix Resolution (lodash.mergewith): 4.5.0
Direct dependency fix Resolution (node-sass): 4.12.0
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.1.tgz
Path to dependency file: /tmp/ws-scm/EcommEasy-Store/package.json
Path to vulnerable library: /EcommEasy-Store/node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: 437d60745e873ecbafdc71d0351af81770e4d95a
handlebars before 4.3.0 is vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Publish Date: 2019-10-06
URL: WS-2019-0291
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1164
Release Date: 2019-10-06
Fix Resolution: 4.3.0
Step up your Open Source Security Game with WhiteSource here
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-2.2.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/tar/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Publish Date: 2019-04-30
URL: CVE-2018-20834
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16082
Release Date: 2019-04-30
Fix Resolution (tar): 2.2.2
Direct dependency fix Resolution (node-sass): 4.12.0
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: EcommEasy-Store/node_modules/handlebars/package.json
Dependency Hierarchy:
handlebars before 3.0.8 and 4.x before 4.5.2 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.
Publish Date: 2019-11-14
URL: WS-2019-0493
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1316
Release Date: 2019-11-14
Fix Resolution: handlebars - 3.0.8,4.5.2
Step up your Open Source Security Game with WhiteSource here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.
Publish Date: 2019-12-20
URL: CVE-2019-19919
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-w457-6q6x-cgp9
Release Date: 2019-12-20
Fix Resolution: 4.3.0
Step up your Open Source Security Game with Mend here
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js
Path to dependency file: /tmp/ws-scm/EcommEasy-Store/node_modules/js-base64/test/index.html
Path to vulnerable library: /EcommEasy-Store/node_modules/js-base64/test/index.html
Dependency Hierarchy:
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js
Path to dependency file: /tmp/ws-scm/EcommEasy-Store/node_modules/vm-browserify/example/run/index.html
Path to vulnerable library: /EcommEasy-Store/node_modules/vm-browserify/example/run/index.html
Dependency Hierarchy:
Found in HEAD commit: c9304d73ea89e8b5a86f81db18ead1dc2561174b
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Publish Date: 2018-01-18
URL: CVE-2015-9251
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251
Release Date: 2018-01-18
Fix Resolution: jQuery - v3.0.0
Step up your Open Source Security Game with WhiteSource here
Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.
Library home page: https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/mixin-deep/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-08-23
URL: CVE-2019-10746
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-08-23
Fix Resolution (mixin-deep): 1.3.2
Direct dependency fix Resolution (lint-staged): 8.0.0
Step up your Open Source Security Game with Mend here
ECMAScript parser
Library home page: https://registry.npmjs.org/acorn/-/acorn-6.1.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/acorn/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.
Publish Date: 2020-03-01
URL: WS-2020-0042
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-6chw-6frg-f759
Release Date: 2020-03-01
Fix Resolution (acorn): 6.4.1
Direct dependency fix Resolution (webpack): 4.30.0
Step up your Open Source Security Game with Mend here
Get, set, or delete a property from a nested object using a dot path
Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/dot-prop/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Publish Date: 2020-02-04
URL: CVE-2020-8116
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116
Release Date: 2020-02-04
Fix Resolution (dot-prop): 4.2.1
Direct dependency fix Resolution (cssnano): 4.1.11
Step up your Open Source Security Game with Mend here
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.6.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/serialize-javascript/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.
Publish Date: 2019-12-05
URL: CVE-2019-16769
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16769
Release Date: 2019-12-05
Fix Resolution (serialize-javascript): 2.1.1
Direct dependency fix Resolution (webpack): 4.30.0
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.
Publish Date: 2018-12-03
URL: CVE-2018-19797
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-12-03
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
Content Security Policy middleware.
Library home page: https://registry.npmjs.org/helmet-csp/-/helmet-csp-2.7.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/helmet-csp/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
Helmet-csp before 2.9.1 is vulnerable to a Configuration Override affecting the application's Content Security Policy (CSP). The package's browser sniffing for Firefox deletes the default-src CSP policy, which is the fallback policy. This allows an attacker to remove an application's default CSP, possibly rendering the application vulnerable to Cross-Site Scripting.
Publish Date: 2019-11-18
URL: WS-2019-0289
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1176
Release Date: 2019-11-18
Fix Resolution (helmet-csp): 2.9.1
Direct dependency fix Resolution (helmet): 3.21.0
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.
Publish Date: 2019-01-14
URL: CVE-2019-6284
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2019-6284
Release Date: 2019-01-14
Fix Resolution: 5.0.0
Step up your Open Source Security Game with Mend here
Advanced file system stream things
Library home page: https://registry.npmjs.org/fstream/-/fstream-1.0.11.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/fstream/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.
Publish Date: 2019-07-02
URL: CVE-2019-13173
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13173
Release Date: 2019-07-02
Fix Resolution (fstream): 1.0.12
Direct dependency fix Resolution (node-sass): 4.12.0
Step up your Open Source Security Game with Mend here
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/union-value/node_modules/set-value/package.json
Dependency Hierarchy:
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/set-value/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.
Publish Date: 2019-08-23
URL: CVE-2019-10747
Base Score Metrics:
Type: Upgrade version
Release Date: 2019-08-23
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (lint-staged): 8.0.0
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (lint-staged): 8.0.0
Step up your Open Source Security Game with Mend here
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js
Path to dependency file: /tmp/ws-scm/EcommEasy-Store/node_modules/js-base64/test/index.html
Path to vulnerable library: /EcommEasy-Store/node_modules/js-base64/test/index.html
Dependency Hierarchy:
Found in HEAD commit: c9304d73ea89e8b5a86f81db18ead1dc2561174b
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.
Publish Date: 2019-04-20
URL: CVE-2019-11358
Base Score Metrics:
Type: Change files
Origin: jquery/jquery@753d591
Release Date: 2019-03-25
Fix Resolution: Replace or update the following files: core.js, core.js
Step up your Open Source Security Game with WhiteSource here
🌈 Node.js bindings to libsass
Library home page: https://github.com/sass/node-sass.git
Found in base branch: master
** DISPUTED ** In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::String_Quoted*) stack frame) may cause a Denial of Service via crafted sass input files with stray '&' or '/' characters. NOTE: Upstream comments indicate this issue is closed as "won't fix" and "works as intended" by design.
Publish Date: 2018-12-03
URL: CVE-2018-19826
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: EcommEasy-Store/node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: 5741eb749a071020b9cbfaa9d02e738a630ee181
In "showdownjs/showdown", versions prior to v4.4.5 are vulnerable against Regular expression Denial of Service (ReDOS) once receiving specially-crafted templates.
Publish Date: 2019-10-20
URL: WS-2019-0318
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1300
Release Date: 2019-12-01
Fix Resolution: handlebars - 4.4.5
Step up your Open Source Security Game with WhiteSource here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.
Publish Date: 2018-06-04
URL: CVE-2018-11694
Base Score Metrics:
Type: Upgrade version
Release Date: 2018-06-04
Fix Resolution: Fable.Template.Elmish.React - 0.1.6;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105
Step up your Open Source Security Game with Mend here
Lodash exported as ES modules.
Library home page: https://registry.npmjs.org/lodash-es/-/lodash-es-4.17.11.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/lodash-es/package.json
Dependency Hierarchy:
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Publish Date: 2021-02-15
URL: CVE-2021-23337
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-35jh-r3h4-6jhm
Release Date: 2021-02-15
Fix Resolution (lodash-es): 4.17.21
Direct dependency fix Resolution (redux-form): 7.4.3
Step up your Open Source Security Game with Mend here
Wrapper around libsass
Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.11.0.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: /node_modules/node-sass/package.json
Dependency Hierarchy:
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.
Publish Date: 2018-05-26
URL: CVE-2018-11499
Base Score Metrics:
Step up your Open Source Security Game with Mend here
A Java based fault and performance management system
Library home page: https://sourceforge.net/projects/opennms/
Found in HEAD commit: a37562abcaa46a622f12b63171bf5ae63e32c021
Found in base branch: master
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
Publish Date: 2018-06-04
URL: CVE-2018-11698
Base Score Metrics:
Step up your Open Source Security Game with Mend here
🌈 Node.js bindings to libsass
Library home page: https://github.com/sass/node-sass.git
* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.
An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skip_over_scopes which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.
Publish Date: 2018-06-04
URL: CVE-2018-11693
Base Score Metrics:
Step up your Open Source Security Game with WhiteSource here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.1.tgz
Path to dependency file: /EcommEasy-Store/package.json
Path to vulnerable library: EcommEasy-Store/node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: 5741eb749a071020b9cbfaa9d02e738a630ee181
Arbitrary Code Execution vulnerability found in handlebars before 4.5.2. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.
Publish Date: 2019-11-13
URL: WS-2019-0331
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1316
Release Date: 2019-12-05
Fix Resolution: handlebars - 4.5.2
Step up your Open Source Security Game with WhiteSource here
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.