Code Monkey home page Code Monkey logo

mundodepatitas's Introduction

💫 About Me:

class AboutMe():
  # I'm a passionate self-taught programmer.
    
  def __init__(self):
    self.name = "Jose Luis"
    self.username = "jospaquim"
    self.location = "Lima, Peru"
  
  def __str__(self):
    return self.name

if __name__ == '__main__':
    me = AboutMe()

🌐 Socials:

LinkedIn

💻 Tech Stack:

Python SQL R JavaScript HTML5 CSS3 PostgreSQL MySQL MongoDB Power BI Excel Tableau Qlik Anaconda Jupyter Notebook Google Colab Docker Git GitHub Linux Seaborn Matplotlib D3.js Adobe Illustrator NumPy Pandas Plotly PyCharm VSCode Apache Airflow Apache HBase Databricks Streamlit Jira

🔥 My Stats :

mundodepatitas's People

Contributors

adegabriela1 avatar jospaquim avatar mauriciofalla avatar

mundodepatitas's Issues

CVE-2019-11358 (Medium) detected in multiple libraries

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.2.1.min.js, jquery-3.3.1.min.js, jquery-3.3.1.js

jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to vulnerable library: /wwwroot/lib/jquery-3.2.1.min.js

Dependency Hierarchy:

  • ❌ jquery-3.2.1.min.js (Vulnerable Library)
jquery-3.3.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.min.js

Dependency Hierarchy:

  • ❌ jquery-3.3.1.min.js (Vulnerable Library)
jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.js

Dependency Hierarchy:

  • ❌ jquery-3.3.1.js (Vulnerable Library)

Found in HEAD commit: 0a5a2a98f91952fd8124eae4ee87a70ed3fd9d00

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0

Step up your Open Source Security Game with Mend here

CVE-2019-8331 (Medium) detected in bootstrap-4.1.0.min.js

CVE-2019-8331 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-4.1.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js

Path to vulnerable library: /wwwroot/lib/bootstrap-4.1/bootstrap.min.js

Dependency Hierarchy:

  • ❌ bootstrap-4.1.0.min.js (Vulnerable Library)

Vulnerability Details

In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.

Publish Date: 2019-02-20

URL: CVE-2019-8331

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-02-20

Fix Resolution: bootstrap - 3.4.1,4.3.1;bootstrap-sass - 3.4.1,4.3.1

Step up your Open Source Security Game with Mend here

WS-2022-0280 (High) detected in moment-timezone-0.5.15.min.js

WS-2022-0280 - High Severity Vulnerability

Vulnerable Library - moment-timezone-0.5.15.min.js

Parse and display moments in any timezone.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/moment-timezone/0.5.15/moment-timezone.min.js

Path to vulnerable library: /wwwroot/lib/countdown/moment-timezone.min.js

Dependency Hierarchy:

  • ❌ moment-timezone-0.5.15.min.js (Vulnerable Library)

Vulnerability Details

Command Injection in moment-timezone before 0.5.35.

Publish Date: 2022-08-30

URL: WS-2022-0280

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-56x4-j7p9-fcf9

Release Date: 2022-08-30

Fix Resolution: moment-timezone - 0.5.35

Step up your Open Source Security Game with Mend here

CVE-2021-21252 (High) detected in jquery.validate-1.17.0.js, jquery.validate-1.17.0.min.js

CVE-2021-21252 - High Severity Vulnerability

Vulnerable Libraries - jquery.validate-1.17.0.js, jquery.validate-1.17.0.min.js

jquery.validate-1.17.0.js

Client-side form validation made easy

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/jquery.validate.js

Path to vulnerable library: /wwwroot/lib/jquery-validation/dist/jquery.validate.js

Dependency Hierarchy:

  • ❌ jquery.validate-1.17.0.js (Vulnerable Library)
jquery.validate-1.17.0.min.js

Client-side form validation made easy

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/jquery.validate.min.js

Path to vulnerable library: /wwwroot/lib/jquery-validation/dist/jquery.validate.min.js

Dependency Hierarchy:

  • ❌ jquery.validate-1.17.0.min.js (Vulnerable Library)

Vulnerability Details

The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.

Publish Date: 2021-01-13

URL: CVE-2021-21252

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jxwx-85vp-gvwm

Release Date: 2021-01-13

Fix Resolution: jquery-validation - 1.19.3

Step up your Open Source Security Game with Mend here

CVE-2018-14041 (Medium) detected in bootstrap-4.1.0.min.js

CVE-2018-14041 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-4.1.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js

Path to vulnerable library: /wwwroot/lib/bootstrap-4.1/bootstrap.min.js

Dependency Hierarchy:

  • ❌ bootstrap-4.1.0.min.js (Vulnerable Library)

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.

Publish Date: 2018-07-13

URL: CVE-2018-14041

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:4.1.2

Step up your Open Source Security Game with Mend here

CVE-2022-31129 (High) detected in moment-2.20.1.min.js

CVE-2022-31129 - High Severity Vulnerability

Vulnerable Library - moment-2.20.1.min.js

Parse, validate, manipulate, and display dates

Library home page: https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.20.1/moment.min.js

Path to vulnerable library: /wwwroot/lib/countdown/moment.min.js

Dependency Hierarchy:

  • ❌ moment-2.20.1.min.js (Vulnerable Library)

Vulnerability Details

moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.

Publish Date: 2022-07-06

URL: CVE-2022-31129

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wc69-rhjr-hc9g

Release Date: 2022-07-06

Fix Resolution: moment - 2.29.4

Step up your Open Source Security Game with Mend here

WS-2022-0284 (High) detected in moment-timezone-0.5.15.min.js

WS-2022-0284 - High Severity Vulnerability

Vulnerable Library - moment-timezone-0.5.15.min.js

Parse and display moments in any timezone.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/moment-timezone/0.5.15/moment-timezone.min.js

Path to vulnerable library: /wwwroot/lib/countdown/moment-timezone.min.js

Dependency Hierarchy:

  • ❌ moment-timezone-0.5.15.min.js (Vulnerable Library)

Vulnerability Details

Cleartext Transmission of Sensitive Information in moment-timezone

Publish Date: 2022-08-30

URL: WS-2022-0284

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-v78c-4p63-2j6c

Release Date: 2022-08-30

Fix Resolution: moment-timezone - 0.5.35

Step up your Open Source Security Game with Mend here

CVE-2018-14040 (Medium) detected in bootstrap-4.1.0.min.js

CVE-2018-14040 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-4.1.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js

Path to vulnerable library: /wwwroot/lib/bootstrap-4.1/bootstrap.min.js

Dependency Hierarchy:

  • ❌ bootstrap-4.1.0.min.js (Vulnerable Library)

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute.

Publish Date: 2018-07-13

URL: CVE-2018-14040

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2,org.webjars:bootstrap:3.4.0

Step up your Open Source Security Game with Mend here

CVE-2020-11023 (Medium) detected in multiple libraries

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.2.1.min.js, jquery-3.3.1.min.js, jquery-3.3.1.js

jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to vulnerable library: /wwwroot/lib/jquery-3.2.1.min.js

Dependency Hierarchy:

  • ❌ jquery-3.2.1.min.js (Vulnerable Library)
jquery-3.3.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.min.js

Dependency Hierarchy:

  • ❌ jquery-3.3.1.min.js (Vulnerable Library)
jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.js

Dependency Hierarchy:

  • ❌ jquery-3.3.1.js (Vulnerable Library)

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

Step up your Open Source Security Game with Mend here

CVE-2018-14042 (Medium) detected in bootstrap-4.1.0.min.js

CVE-2018-14042 - Medium Severity Vulnerability

Vulnerable Library - bootstrap-4.1.0.min.js

The most popular front-end framework for developing responsive, mobile first projects on the web.

Library home page: https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/4.1.0/js/bootstrap.min.js

Path to vulnerable library: /wwwroot/lib/bootstrap-4.1/bootstrap.min.js

Dependency Hierarchy:

  • ❌ bootstrap-4.1.0.min.js (Vulnerable Library)

Vulnerability Details

In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.

Publish Date: 2018-07-13

URL: CVE-2018-14042

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-07-13

Fix Resolution: org.webjars.npm:bootstrap:4.1.2.org.webjars:bootstrap:3.4.0

Step up your Open Source Security Game with Mend here

CVE-2020-11022 (Medium) detected in multiple libraries

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.2.1.min.js, jquery-3.3.1.min.js, jquery-3.3.1.js

jquery-3.2.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js

Path to vulnerable library: /wwwroot/lib/jquery-3.2.1.min.js

Dependency Hierarchy:

  • ❌ jquery-3.2.1.min.js (Vulnerable Library)
jquery-3.3.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.min.js

Dependency Hierarchy:

  • ❌ jquery-3.3.1.min.js (Vulnerable Library)
jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to vulnerable library: /wwwroot/lib/jquery/dist/jquery.js

Dependency Hierarchy:

  • ❌ jquery-3.3.1.js (Vulnerable Library)

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

Step up your Open Source Security Game with Mend here

CVE-2022-24785 (High) detected in moment-2.20.1.min.js

CVE-2022-24785 - High Severity Vulnerability

Vulnerable Library - moment-2.20.1.min.js

Parse, validate, manipulate, and display dates

Library home page: https://cdnjs.cloudflare.com/ajax/libs/moment.js/2.20.1/moment.min.js

Path to vulnerable library: /wwwroot/lib/countdown/moment.min.js

Dependency Hierarchy:

  • ❌ moment-2.20.1.min.js (Vulnerable Library)

Found in HEAD commit: 0a5a2a98f91952fd8124eae4ee87a70ed3fd9d00

Vulnerability Details

Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.

Publish Date: 2022-04-04

URL: CVE-2022-24785

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8hfj-j24r-96c4

Release Date: 2022-04-04

Fix Resolution: moment - 2.29.2

Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.