goldenrecursion / env0-client-integrations Goto Github PK
View Code? Open in Web Editor NEWThis project forked from env0/env0-client-integrations
This is a repo for client integrating with env0 API
License: MIT License
This project forked from env0/env0-client-integrations
This is a repo for client integrating with env0 API
License: MIT License
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
CVE | Severity | Dependency | Type | Fixed in (boxen version) | Remediation Possible** | |
---|---|---|---|---|---|---|
CVE-2021-3807 | 7.5 | ansi-regex-4.1.0.tgz | Transitive | 5.0.0 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Dependency Hierarchy:
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
Found in base branch: master
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3807
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/
Release Date: 2021-09-17
Fix Resolution (ansi-regex): 4.1.1
Direct dependency fix Resolution (boxen): 5.0.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
CVE | Severity | Dependency | Type | Fixed in (inquirer version) | Remediation Possible** | |
---|---|---|---|---|---|---|
CVE-2021-3807 | 7.5 | ansi-regex-5.0.0.tgz | Transitive | 8.0.0 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Dependency Hierarchy:
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
Found in base branch: master
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3807
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/
Release Date: 2021-09-17
Fix Resolution (ansi-regex): 5.0.1
Direct dependency fix Resolution (inquirer): 8.0.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
CVE | Severity | Dependency | Type | Fixed in (update-notifier version) | Remediation Possible** | |
---|---|---|---|---|---|---|
CVE-2021-44906 | 9.8 | minimist-1.2.5.tgz | Transitive | 4.1.2 | ✅ | |
CVE-2022-25883 | 7.5 | semver-6.3.0.tgz | Transitive | 6.0.0 | ✅ | |
CVE-2022-25881 | 7.5 | http-cache-semantics-4.1.0.tgz | Transitive | 4.1.2 | ✅ | |
CVE-2022-33987 | 5.3 | got-9.6.0.tgz | Transitive | 6.0.0 | ✅ |
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.5.tgz
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Dependency Hierarchy:
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
Found in base branch: master
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-xvch-5gv4-984h
Release Date: 2022-03-17
Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (update-notifier): 4.1.2
⛑️ Automatic Remediation will be attempted for this issue.
The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Dependency Hierarchy:
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
Found in base branch: master
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Publish Date: 2023-06-21
URL: CVE-2022-25883
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-c2qf-rxjj-qqgw
Release Date: 2023-06-21
Fix Resolution (semver): 6.3.1
Direct dependency fix Resolution (update-notifier): 6.0.0
⛑️ Automatic Remediation will be attempted for this issue.
Parses Cache-Control and other headers. Helps building correct HTTP caches and proxies
Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Dependency Hierarchy:
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
Found in base branch: master
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
Publish Date: 2023-01-31
URL: CVE-2022-25881
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-rc47-6667-2j5j
Release Date: 2023-01-31
Fix Resolution (http-cache-semantics): 4.1.1
Direct dependency fix Resolution (update-notifier): 4.1.2
⛑️ Automatic Remediation will be attempted for this issue.
Simplified HTTP requests
Library home page: https://registry.npmjs.org/got/-/got-9.6.0.tgz
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Dependency Hierarchy:
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
Found in base branch: master
The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
Publish Date: 2022-06-18
URL: CVE-2022-33987
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33987
Release Date: 2022-06-18
Fix Resolution (got): 11.8.6
Direct dependency fix Resolution (update-notifier): 6.0.0
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.21.2.tgz
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
CVE | Severity | Dependency | Type | Fixed in (axios version) | Remediation Possible** | |
---|---|---|---|---|---|---|
CVE-2024-28849 | 6.5 | follow-redirects-1.14.7.tgz | Transitive | N/A* | ❌ | |
CVE-2023-45857 | 6.5 | axios-0.21.2.tgz | Direct | 0.28.0 | ✅ | |
CVE-2023-26159 | 6.1 | follow-redirects-1.14.7.tgz | Transitive | 0.21.3 | ✅ | |
CVE-2022-0536 | 5.9 | follow-redirects-1.14.7.tgz | Transitive | 0.21.3 | ✅ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.7.tgz
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Dependency Hierarchy:
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
Found in base branch: master
follow-redirects is an open source, drop-in replacement for Node's http
and https
modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Publish Date: 2024-03-14
URL: CVE-2024-28849
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-cxjh-pqwp-8mfp
Release Date: 2024-03-14
Fix Resolution: follow-redirects - 1.15.6
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.21.2.tgz
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Dependency Hierarchy:
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
Found in base branch: master
An issue discovered in Axios 1.5.1 inadvertently reveals the confidential XSRF-TOKEN stored in cookies by including it in the HTTP header X-XSRF-TOKEN for every request made to any host allowing attackers to view sensitive information.
Publish Date: 2023-11-08
URL: CVE-2023-45857
Base Score Metrics:
Type: Upgrade version
Release Date: 2023-11-08
Fix Resolution: 0.28.0
⛑️ Automatic Remediation will be attempted for this issue.
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.7.tgz
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Dependency Hierarchy:
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
Found in base branch: master
Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.
Publish Date: 2024-01-02
URL: CVE-2023-26159
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-26159
Release Date: 2024-01-02
Fix Resolution (follow-redirects): 1.15.4
Direct dependency fix Resolution (axios): 0.21.3
⛑️ Automatic Remediation will be attempted for this issue.
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.14.7.tgz
Path to dependency file: /node/package.json
Path to vulnerable library: /node/package.json
Dependency Hierarchy:
Found in HEAD commit: e04bfce3660648da471b5f314d6d255da55a7b56
Found in base branch: master
Improper Removal of Sensitive Information Before Storage or Transfer in NPM follow-redirects prior to 1.14.8.
Publish Date: 2022-02-09
URL: CVE-2022-0536
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0536
Release Date: 2022-02-09
Fix Resolution (follow-redirects): 1.14.8
Direct dependency fix Resolution (axios): 0.21.3
⛑️ Automatic Remediation will be attempted for this issue.
⛑️Automatic Remediation will be attempted for this issue.
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.