kapseliboi / ilias-pegasus Goto Github PK
View Code? Open in Web Editor NEWThis project forked from fluxapps/ilias-pegasus
An ILIAS Companion App
License: GNU General Public License v3.0
This project forked from fluxapps/ilias-pegasus
An ILIAS Companion App
License: GNU General Public License v3.0
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.5.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/handlebars/package.json
Dependency Hierarchy:
Found in base branch: master
The package handlebars before 4.7.7 are vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.
Publish Date: 2021-05-04
URL: CVE-2021-23383
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23383
Release Date: 2021-05-04
Fix Resolution (handlebars): 4.7.7
Direct dependency fix Resolution (karma-coverage-istanbul-reporter): 3.0.0
Step up your Open Source Security Game with Mend here
Small footprint URL parser that works seamlessly across Node.js and browser environments
Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/url-parse/package.json
Dependency Hierarchy:
Found in base branch: master
url-parse is vulnerable to URL Redirection to Untrusted Site
Publish Date: 2021-07-26
URL: CVE-2021-3664
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3664
Release Date: 2021-07-26
Fix Resolution (url-parse): 1.5.2
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Step up your Open Source Security Game with Mend here
Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab
Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-2.8.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/hosted-git-info/package.json
Dependency Hierarchy:
Provides metadata and conversions from repository urls for Github, Bitbucket and Gitlab
Library home page: https://registry.npmjs.org/hosted-git-info/-/hosted-git-info-3.0.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/cordova-create/node_modules/hosted-git-info/package.json,/node_modules/cordova-fetch/node_modules/hosted-git-info/package.json
Dependency Hierarchy:
Found in base branch: master
The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.
Publish Date: 2021-03-23
URL: CVE-2021-23362
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-43f8-2h32-f4cj
Release Date: 2021-03-23
Fix Resolution (hosted-git-info): 2.8.9
Direct dependency fix Resolution (@angular/cli): 9.0.0
Fix Resolution (hosted-git-info): 2.8.9
Direct dependency fix Resolution (cordova): 10.0.1-nightly.2020.8.5.4e1cada0
Step up your Open Source Security Game with Mend here
Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.13.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@babel/compat-data/node_modules/browserslist/package.json,/node_modules/@babel/helper-compilation-targets/node_modules/browserslist/package.json
Dependency Hierarchy:
Share target browsers between different front-end tools, like Autoprefixer, Stylelint and babel-env-preset
Library home page: https://registry.npmjs.org/browserslist/-/browserslist-4.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/browserslist/package.json
Dependency Hierarchy:
Found in base branch: master
The package browserslist from 4.0.0 and before 4.16.5 are vulnerable to Regular Expression Denial of Service (ReDoS) during parsing of queries.
Publish Date: 2021-04-28
URL: CVE-2021-23364
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23364
Release Date: 2021-04-28
Fix Resolution (browserslist): 4.16.5
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.6
Fix Resolution (browserslist): 4.16.5
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.6
Step up your Open Source Security Game with Mend here
An abstract-encoding compliant module for encoding / decoding DNS packets
Library home page: https://registry.npmjs.org/dns-packet/-/dns-packet-1.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/dns-packet/package.json
Dependency Hierarchy:
Found in base branch: master
This affects the package dns-packet before 5.2.2. It creates buffers with allocUnsafe and does not always fill them before forming network packets. This can expose internal application memory over unencrypted network when querying crafted invalid domain names.
Publish Date: 2021-05-20
URL: CVE-2021-23386
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23386
Release Date: 2021-05-20
Fix Resolution (dns-packet): 1.3.2
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Step up your Open Source Security Game with Mend here
The realtime engine behind Socket.IO. Provides the foundation of a bidirectional connection between client and server
Library home page: https://registry.npmjs.org/engine.io/-/engine.io-3.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/engine.io/package.json
Dependency Hierarchy:
Found in base branch: master
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
Publish Date: 2021-01-08
URL: CVE-2020-36048
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36048
Release Date: 2021-01-08
Fix Resolution (engine.io): 3.6.0
Direct dependency fix Resolution (karma): 5.0.8
Step up your Open Source Security Game with Mend here
a CSS selector parser
Library home page: https://registry.npmjs.org/css-what/-/css-what-2.1.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/css-what/package.json
Dependency Hierarchy:
Found in base branch: master
The css-what package 4.0.0 through 5.0.0 for Node.js does not ensure that attribute parsing has Linear Time Complexity relative to the size of the input.
Publish Date: 2021-05-28
URL: CVE-2021-33587
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33587
Release Date: 2021-05-28
Fix Resolution (css-what): 5.0.1
Direct dependency fix Resolution (@ionic/angular-toolkit): 5.0.0
Step up your Open Source Security Game with WhiteSource here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.5.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/handlebars/package.json
Dependency Hierarchy:
Found in base branch: master
The package handlebars before 4.7.7 are vulnerable to Remote Code Execution (RCE) when selecting certain compiling options to compile templates coming from an untrusted source.
Publish Date: 2021-04-12
URL: CVE-2021-23369
Base Score Metrics:
Type: Upgrade version
Release Date: 2021-04-12
Fix Resolution (handlebars): 4.7.7
Direct dependency fix Resolution (karma-coverage-istanbul-reporter): 3.0.0
Step up your Open Source Security Game with Mend here
Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.
Library home page: https://registry.npmjs.org/ssri/-/ssri-8.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/copy-webpack-plugin/node_modules/ssri/package.json,/node_modules/terser-webpack-plugin/node_modules/ssri/package.json
Dependency Hierarchy:
Standard Subresource Integrity library -- parses, serializes, generates, and verifies integrity metadata according to the SRI spec.
Library home page: https://registry.npmjs.org/ssri/-/ssri-6.0.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ssri/package.json
Dependency Hierarchy:
Found in base branch: master
ssri 5.2.2-8.0.0, fixed in 8.0.1, processes SRIs using a regular expression which is vulnerable to a denial of service. Malicious SRIs could take an extremely long time to process, leading to denial of service. This issue only affects consumers using the strict option.
Publish Date: 2021-03-12
URL: CVE-2021-27290
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-vx3p-948g-6vhq
Release Date: 2021-03-12
Fix Resolution (ssri): 8.0.1
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Fix Resolution (ssri): 8.0.1
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Step up your Open Source Security Game with Mend here
Get, set, or delete a property from a nested object using a dot path
Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/conf/node_modules/dot-prop/package.json
Dependency Hierarchy:
Found in base branch: master
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Publish Date: 2020-02-04
URL: CVE-2020-8116
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116
Release Date: 2020-02-04
Fix Resolution (dot-prop): 4.2.1
Direct dependency fix Resolution (cordova): 10.0.1-nightly.2020.8.5.4e1cada0
Step up your Open Source Security Game with Mend here
A W3C Standard XML DOM(Level2 CORE) implementation and parser(DOMParser/XMLSerializer).
Library home page: https://registry.npmjs.org/xmldom/-/xmldom-0.1.27.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xmldom/package.json
Dependency Hierarchy:
Found in base branch: master
xmldom is a pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.4.0 and older do not correctly preserve system identifiers, FPIs or namespaces when repeatedly parsing and serializing maliciously crafted documents. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This is fixed in version 0.5.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Publish Date: 2021-03-12
URL: CVE-2021-21366
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-h6q6-9hqw-rwfv
Release Date: 2021-03-12
Fix Resolution: 0.5.0
Step up your Open Source Security Game with Mend here
Spectacular Test Runner for JavaScript.
Library home page: https://registry.npmjs.org/karma/-/karma-4.4.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/karma/package.json
Dependency Hierarchy:
Found in base branch: master
Cross-site Scripting (XSS) - DOM in NPM karma prior to 6.3.14.
Publish Date: 2022-02-05
URL: CVE-2022-0437
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-0437
Release Date: 2022-02-05
Fix Resolution: 6.3.14
Step up your Open Source Security Game with Mend here
Simple system and OS information library
Library home page: https://registry.npmjs.org/systeminformation/-/systeminformation-4.26.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/systeminformation/package.json
Dependency Hierarchy:
Found in base branch: master
This affects the package systeminformation before 4.30.2. The attacker can overwrite the properties and functions of an object, which can lead to executing OS commands.
Publish Date: 2020-11-26
URL: CVE-2020-7778
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-11-26
Fix Resolution (systeminformation): 4.30.2
Direct dependency fix Resolution (cordova): 10.0.1-nightly.2020.8.5.4e1cada0
Step up your Open Source Security Game with Mend here
Simple system and OS information library
Library home page: https://registry.npmjs.org/systeminformation/-/systeminformation-4.26.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/systeminformation/package.json
Dependency Hierarchy:
Found in base branch: master
systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.
Publish Date: 2021-04-29
URL: CVE-2021-21388
Base Score Metrics:
Type: Upgrade version
Release Date: 2021-04-29
Fix Resolution (systeminformation): 4.34.11
Direct dependency fix Resolution (cordova): 10.0.1-nightly.2020.8.5.4e1cada0
Step up your Open Source Security Game with Mend here
An XML builder for node.js
Library home page: https://registry.npmjs.org/xmlbuilder/-/xmlbuilder-8.2.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/simple-plist/node_modules/xmlbuilder/package.json
Dependency Hierarchy:
Found in base branch: master
The package xmlbuilder-js before 9.0.5 is vulnerable to denial of service due to a regular expression issue.
Publish Date: 2018-02-08
URL: WS-2018-0625
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Another JSON Schema Validator
Library home page: https://registry.npmjs.org/ajv/-/ajv-6.9.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ajv/package.json
Dependency Hierarchy:
Found in base branch: master
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Publish Date: 2020-07-15
URL: CVE-2020-15366
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-07-15
Fix Resolution (ajv): 6.12.3
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.901.12
Step up your Open Source Security Game with Mend here
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.17.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/postcss/package.json
Dependency Hierarchy:
Found in base branch: master
The package postcss before 8.2.13 are vulnerable to Regular Expression Denial of Service (ReDoS) via getAnnotationURL() and loadAnnotation() in lib/previous-map.js. The vulnerable regexes are caused mainly by the sub-pattern /*\s* sourceMappingURL=(.*).
Publish Date: 2021-04-26
URL: CVE-2021-23382
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23382
Release Date: 2021-04-26
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.1102.13
Step up your Open Source Security Game with Mend here
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/pacote/node_modules/tar/package.json
Dependency Hierarchy:
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-6.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/sharp/node_modules/tar/package.json,/node_modules/tar/package.json
Dependency Hierarchy:
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: master
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \
and /
characters as path separators, however \
is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO
, followed by a symbolic link named foo
, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO
directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.
Publish Date: 2021-08-31
URL: CVE-2021-37701
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-9r2w-394v-53qc
Release Date: 2021-08-31
Fix Resolution (tar): 4.4.16
Direct dependency fix Resolution (@angular/cli): 9.0.0
Fix Resolution (tar): 4.4.16
Direct dependency fix Resolution (@ionic/cli): 6.12.2
Fix Resolution (tar): 4.4.16
Direct dependency fix Resolution (@angular/compiler-cli): 9.0.0
Step up your Open Source Security Game with Mend here
JSON Schema validation and specifications
Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/json-schema/package.json
Dependency Hierarchy:
Found in base branch: master
json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Publish Date: 2021-11-13
URL: CVE-2021-3918
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918
Release Date: 2021-11-13
Fix Resolution (json-schema): 0.4.0
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Step up your Open Source Security Game with Mend here
HTTP and HTTPS modules that follow redirects.
Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.9.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/follow-redirects/package.json
Dependency Hierarchy:
Found in base branch: master
follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor
Publish Date: 2022-01-10
URL: CVE-2022-0155
Base Score Metrics:
Type: Upgrade version
Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/
Release Date: 2022-01-10
Fix Resolution (follow-redirects): 1.14.7
Direct dependency fix Resolution (karma): 5.0.0
Step up your Open Source Security Game with Mend here
Generates an asynchronous resolver function from a PAC file
Library home page: https://registry.npmjs.org/pac-resolver/-/pac-resolver-4.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/pac-resolver/package.json
Dependency Hierarchy:
Compiles sync functions into async generator functions
Library home page: https://registry.npmjs.org/degenerator/-/degenerator-2.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/degenerator/package.json
Dependency Hierarchy:
Found in base branch: master
This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
Publish Date: 2021-08-24
URL: CVE-2021-23406
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-9j49-mfvp-vmhm
Release Date: 2021-08-24
Fix Resolution (pac-resolver): 5.0.0
Direct dependency fix Resolution (@ionic/cli): 6.18.1
Fix Resolution (degenerator): 5.0.0
Direct dependency fix Resolution (@ionic/cli): 7.1.6
Step up your Open Source Security Game with Mend here
Create, read and edit .zip files with JavaScript http://stuartk.com/jszip
Library home page: https://registry.npmjs.org/jszip/-/jszip-3.5.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/jszip/package.json
Dependency Hierarchy:
Found in base branch: master
This affects the package jszip before 3.7.0. Crafting a new zip file with filenames set to Object prototype values (e.g proto, toString, etc) results in a returned object with a modified prototype instance.
Publish Date: 2021-07-25
URL: CVE-2021-23413
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23413
Release Date: 2021-07-25
Fix Resolution (jszip): 3.7.0
Direct dependency fix Resolution (protractor): 6.0.0
Step up your Open Source Security Game with Mend here
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
Found in base branch: master
The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.
Publish Date: 2022-01-08
URL: WS-2022-0008
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-5rrq-pxf6-6jx5
Release Date: 2022-01-08
Fix Resolution (node-forge): 1.0.0
Direct dependency fix Resolution (@angular-devkit/build-angular): 13.2.0
Step up your Open Source Security Game with Mend here
Port of Log4js to work with node.
Library home page: https://registry.npmjs.org/log4js/-/log4js-4.5.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/log4js/package.json
Dependency Hierarchy:
Found in base branch: master
log4js-node is a port of log4js to node.js. In affected versions default file permissions for log files created by the file, fileSync and dateFile appenders are world-readable (in unix). This could cause problems if log files contain sensitive information. This would affect any users that have not supplied their own permissions for the files via the mode parameter in the config. Users are advised to update.
Publish Date: 2022-01-19
URL: CVE-2022-21704
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-82v2-mx6x-wq7q
Release Date: 2022-01-19
Fix Resolution (log4js): 6.4.0
Direct dependency fix Resolution (karma): 5.0.8
Step up your Open Source Security Game with Mend here
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-6.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/sharp/node_modules/tar/package.json,/node_modules/tar/package.json
Dependency Hierarchy:
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/pacote/node_modules/tar/package.json
Dependency Hierarchy:
Found in base branch: master
The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths
flag is not set to true
. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc
would turn into home/user/.bashrc
. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc
. node-tar
would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc
) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry
method which sanitizes the entry.path
or a filter
method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.
Publish Date: 2021-08-03
URL: CVE-2021-32804
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-3jfq-g458-7qm9
Release Date: 2021-08-03
Fix Resolution (tar): 6.1.1
Direct dependency fix Resolution (@ionic/cli): 6.12.2
Fix Resolution (tar): 6.1.1
Direct dependency fix Resolution (@angular/compiler-cli): 9.0.0
Fix Resolution (tar): 6.1.1
Direct dependency fix Resolution (@angular/cli): 9.0.0
Step up your Open Source Security Game with Mend here
node.js realtime framework server
Library home page: https://registry.npmjs.org/socket.io/-/socket.io-2.1.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/socket.io/package.json
Dependency Hierarchy:
Found in base branch: master
In socket.io in versions 1.0.0 to 2.3.0 is vulnerable to Cross-Site Websocket Hijacking, it allows an attacker to bypass origin protection using special symbols include "`" and "$".
Publish Date: 2020-02-20
URL: WS-2020-0443
Base Score Metrics:
Type: Upgrade version
Origin: https://hackerone.com/reports/931197
Release Date: 2020-02-20
Fix Resolution (socket.io): 2.4.0
Direct dependency fix Resolution (karma): 5.0.8
Step up your Open Source Security Game with Mend here
Portable Unix shell commands for Node.js
Library home page: https://registry.npmjs.org/shelljs/-/shelljs-0.2.6.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/shelljs/package.json
Dependency Hierarchy:
Portable Unix shell commands for Node.js
Library home page: https://registry.npmjs.org/shelljs/-/shelljs-0.7.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/cordova-custom-config/node_modules/shelljs/package.json
Dependency Hierarchy:
Found in base branch: master
shelljs is vulnerable to Improper Privilege Management
Publish Date: 2022-01-11
URL: CVE-2022-0144
Base Score Metrics:
Step up your Open Source Security Game with Mend here
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@ionic/cli-framework-prompts/node_modules/lodash/package.json
Dependency Hierarchy:
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@babel/helper-hoist-variables/node_modules/lodash/package.json,/node_modules/@babel/core/node_modules/@babel/traverse/node_modules/lodash/package.json,/node_modules/@babel/helper-regex/node_modules/lodash/package.json,/node_modules/@babel/core/node_modules/@babel/types/node_modules/lodash/package.json,/node_modules/@babel/helper-optimise-call-expression/node_modules/lodash/package.json,/node_modules/@babel/helpers/node_modules/lodash/package.json,/node_modules/@babel/helper-module-imports/node_modules/lodash/package.json,/node_modules/@babel/helper-simple-access/node_modules/lodash/package.json,/node_modules/@babel/helper-annotate-as-pure/node_modules/lodash/package.json,/node_modules/@babel/helper-member-expression-to-functions/node_modules/lodash/package.json,/node_modules/@babel/plugin-transform-classes/node_modules/lodash/package.json,/node_modules/@babel/helper-builder-binary-assignment-operator-visitor/node_modules/lodash/package.json,/node_modules/@babel/helper-module-transforms/node_modules/lodash/package.json,/node_modules/@babel/preset-env/node_modules/lodash/package.json,/node_modules/@babel/plugin-transform-parameters/node_modules/lodash/package.json,/node_modules/@babel/helper-define-map/node_modules/lodash/package.json,/node_modules/@babel/helper-remap-async-to-generator/node_modules/lodash/package.json,/node_modules/@babel/helper-wrap-function/node_modules/lodash/package.json,/node_modules/@babel/helper-replace-supers/node_modules/lodash/package.json,/node_modules/@babel/helper-explode-assignable-expression/node_modules/lodash/package.json,/node_modules/@babel/plugin-transform-function-name/node_modules/lodash/package.json
Dependency Hierarchy:
Found in base branch: master
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Publish Date: 2021-02-15
URL: CVE-2021-23337
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-35jh-r3h4-6jhm
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (@ionic/cli): 6.12.2
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (@ionic/cli): 6.12.2
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Step up your Open Source Security Game with Mend here
XMLHttpRequest for Node
Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xmlhttprequest-ssl/package.json
Dependency Hierarchy:
Found in base branch: master
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.
Publish Date: 2021-03-05
URL: CVE-2020-28502
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-h4j5-c7cj-74xg
Release Date: 2021-03-05
Fix Resolution (xmlhttprequest-ssl): 1.6.1
Direct dependency fix Resolution (karma): 5.0.8
Step up your Open Source Security Game with Mend here
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-7.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ws/package.json
Dependency Hierarchy:
Simple to use, blazing fast and thoroughly tested websocket client and server for Node.js
Library home page: https://registry.npmjs.org/ws/-/ws-6.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/webpack-dev-server/node_modules/ws/package.json
Dependency Hierarchy:
Found in base branch: master
ws is an open source WebSocket client and server library for Node.js. A specially crafted value of the Sec-Websocket-Protocol
header can be used to significantly slow down a ws server. The vulnerability has been fixed in [email protected] (websockets/ws@00c425e). In vulnerable versions of ws, the issue can be mitigated by reducing the maximum allowed length of the request headers using the --max-http-header-size=size
and/or the maxHeaderSize
options.
Publish Date: 2021-05-25
URL: CVE-2021-32640
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-6fc8-4gx4-v693
Release Date: 2021-05-25
Fix Resolution (ws): 7.4.6
Direct dependency fix Resolution (@ionic/angular-toolkit): 3.0.0
Fix Resolution (ws): 7.4.6
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Step up your Open Source Security Game with Mend here
the bare-bones internationalization library used by yargs
Library home page: https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/yargs/node_modules/y18n/package.json,/node_modules/cli-highlight/node_modules/y18n/package.json
Dependency Hierarchy:
the bare-bones internationalization library used by yargs
Library home page: https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/y18n/package.json
Dependency Hierarchy:
Found in base branch: master
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
Publish Date: 2020-11-17
URL: CVE-2020-7774
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1654
Release Date: 2020-11-17
Fix Resolution (y18n): 3.2.2
Direct dependency fix Resolution (typeorm): 0.2.0
Fix Resolution (y18n): 3.2.2
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Step up your Open Source Security Game with Mend here
Node.js path.parse() ponyfill
Library home page: https://registry.npmjs.org/path-parse/-/path-parse-1.0.6.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/path-parse/package.json
Dependency Hierarchy:
Found in base branch: master
All versions of package path-parse are vulnerable to Regular Expression Denial of Service (ReDoS) via splitDeviceRe, splitTailRe, and splitPathRe regular expressions. ReDoS exhibits polynomial worst-case time complexity.
Publish Date: 2021-05-04
URL: CVE-2021-23343
Base Score Metrics:
Type: Upgrade version
Release Date: 2021-05-04
Fix Resolution (path-parse): 1.0.7
Direct dependency fix Resolution (tslint): 6.0.0
Step up your Open Source Security Game with Mend here
node.js realtime framework server
Library home page: https://registry.npmjs.org/socket.io/-/socket.io-2.1.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/socket.io/package.json
Dependency Hierarchy:
Found in base branch: master
The package socket.io before 2.4.0 are vulnerable to Insecure Defaults due to CORS Misconfiguration. All domains are whitelisted by default.
Publish Date: 2021-01-19
URL: CVE-2020-28481
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28481
Release Date: 2021-01-19
Fix Resolution (socket.io): 2.4.0
Direct dependency fix Resolution (karma): 5.0.8
Step up your Open Source Security Game with Mend here
Syntax highlighting with language autodetection.
Library home page: https://registry.npmjs.org/highlight.js/-/highlight.js-9.15.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/highlight.js/package.json
Dependency Hierarchy:
Found in base branch: master
If are you are using Highlight.js to highlight user-provided data you are possibly vulnerable. On the client-side (in a browser or Electron environment) risks could include lengthy freezes or crashes... On the server-side infinite freezes could occur... effectively preventing users from accessing your app or service (ie, Denial of Service). This is an issue with grammars shipped with the parser (and potentially 3rd party grammars also), not the parser itself. If you are using Highlight.js with any of the following grammars you are vulnerable. If you are using highlightAuto to detect the language (and have any of these grammars registered) you are vulnerable.
Publish Date: 2020-12-04
URL: WS-2020-0208
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-12-04
Fix Resolution (highlight.js): 10.4.1
Direct dependency fix Resolution (typeorm): 0.2.15
Step up your Open Source Security Game with Mend here
Simplest way to make http get requests. Supports HTTPS, redirects, gzip/deflate, streams in < 100 lines.
Library home page: https://registry.npmjs.org/simple-get/-/simple-get-3.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/prebuild-install/node_modules/simple-get/package.json
Dependency Hierarchy:
Simplest way to make http get requests. Supports HTTPS, redirects, gzip/deflate, streams in < 100 lines.
Library home page: https://registry.npmjs.org/simple-get/-/simple-get-4.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/simple-get/package.json
Dependency Hierarchy:
Found in base branch: master
Improper Removal of Sensitive Information Before Storage or Transfer in NPM simple-get prior to 4.0.1.
Publish Date: 2022-01-26
URL: CVE-2022-0355
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0355
Release Date: 2022-01-26
Fix Resolution (simple-get): 3.1.1
Direct dependency fix Resolution (cordova-res): 0.15.2
Fix Resolution (simple-get): 3.1.1
Direct dependency fix Resolution (cordova-res): 0.15.2
Step up your Open Source Security Game with Mend here
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-8.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/cli-highlight/node_modules/yargs-parser/package.json
Dependency Hierarchy:
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-11.1.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/protractor/node_modules/yargs-parser/package.json
Dependency Hierarchy:
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-7.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/yargs-parser/package.json
Dependency Hierarchy:
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-13.1.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@angular/compiler-cli/node_modules/yargs-parser/package.json
Dependency Hierarchy:
Found in base branch: master
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
Publish Date: 2020-03-16
URL: CVE-2020-7608
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-03-16
Fix Resolution (yargs-parser): 13.1.2
Direct dependency fix Resolution (typeorm): 0.2.15
Fix Resolution (yargs-parser): 13.1.2
Direct dependency fix Resolution (protractor): 7.0.0
Fix Resolution (yargs-parser): 13.1.2
Direct dependency fix Resolution (typeorm): 0.2.15
Fix Resolution (yargs-parser): 13.1.2
Direct dependency fix Resolution (@angular/compiler-cli): 9.0.0
Step up your Open Source Security Game with Mend here
Get the native type of a value.
Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/kind-of/package.json
Dependency Hierarchy:
Found in base branch: master
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Publish Date: 2019-12-30
URL: CVE-2019-20149
Base Score Metrics:
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149
Release Date: 2019-12-30
Fix Resolution (kind-of): 6.0.3
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Step up your Open Source Security Game with Mend here
EC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/elliptic/package.json
Dependency Hierarchy:
Found in base branch: master
The package elliptic before 6.5.4 are vulnerable to Cryptographic Issues via the secp256k1 implementation in elliptic/ec/key.js. There is no check to confirm that the public key point passed into the derive function actually exists on the secp256k1 curve. This results in the potential for the private key used in this implementation to be revealed after a number of ECDH operations are performed.
Publish Date: 2021-02-02
URL: CVE-2020-28498
Base Score Metrics:
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2020-28498
Release Date: 2021-02-02
Fix Resolution (elliptic): 6.5.4
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Step up your Open Source Security Game with Mend here
XMLHttpRequest for Node
Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xmlhttprequest-ssl/package.json
Dependency Hierarchy:
Found in base branch: master
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Publish Date: 2021-04-23
URL: CVE-2021-31597
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31597
Release Date: 2021-04-23
Fix Resolution (xmlhttprequest-ssl): 1.6.1
Direct dependency fix Resolution (karma): 5.0.8
Step up your Open Source Security Game with Mend here
An elegant lib that converts the chalked (ANSI) text to HTML.
Library home page: https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ansi-html/package.json
Dependency Hierarchy:
Found in base branch: master
This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.
Publish Date: 2021-08-18
URL: CVE-2021-23424
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23424
Release Date: 2021-08-18
Fix Resolution (ansi-html): 0.0.8
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.1102.18
Step up your Open Source Security Game with Mend here
socket.io protocol parser
Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/socket.io-parser/package.json
Dependency Hierarchy:
Found in base branch: master
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Publish Date: 2021-01-08
URL: CVE-2020-36049
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-xfhh-g9f5-x4m4
Release Date: 2021-01-08
Fix Resolution (socket.io-parser): 3.3.2
Direct dependency fix Resolution (karma): 5.0.8
Step up your Open Source Security Game with Mend here
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
Found in base branch: master
The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
Publish Date: 2020-09-01
URL: CVE-2020-7720
Base Score Metrics:
Type: Upgrade version
Release Date: 2020-09-01
Fix Resolution (node-forge): 0.10.0
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Step up your Open Source Security Game with Mend here
Simple system and OS information library
Library home page: https://registry.npmjs.org/systeminformation/-/systeminformation-4.26.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/systeminformation/package.json
Dependency Hierarchy:
Found in base branch: master
In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.
Publish Date: 2020-12-16
URL: CVE-2020-26274
Base Score Metrics:
Type: Upgrade version
Origin: https://www.npmjs.com/package/systeminformation/v/4.31.0
Release Date: 2020-12-16
Fix Resolution (systeminformation): 4.31.1
Direct dependency fix Resolution (cordova): 10.0.1-nightly.2020.8.5.4e1cada0
Step up your Open Source Security Game with Mend here
An ini encoder/decoder for node
Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ini/package.json,/package.json
Dependency Hierarchy:
Found in base branch: master
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Publish Date: 2020-12-11
URL: CVE-2020-7788
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
Release Date: 2020-12-11
Fix Resolution (ini): 1.3.6
Direct dependency fix Resolution (@angular/compiler-cli): 9.0.0
Step up your Open Source Security Game with Mend here
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.19.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@babel/helper-hoist-variables/node_modules/lodash/package.json,/node_modules/@babel/core/node_modules/@babel/traverse/node_modules/lodash/package.json,/node_modules/@babel/helper-regex/node_modules/lodash/package.json,/node_modules/@babel/core/node_modules/@babel/types/node_modules/lodash/package.json,/node_modules/@babel/helper-optimise-call-expression/node_modules/lodash/package.json,/node_modules/@babel/helpers/node_modules/lodash/package.json,/node_modules/@babel/helper-module-imports/node_modules/lodash/package.json,/node_modules/@babel/helper-simple-access/node_modules/lodash/package.json,/node_modules/@babel/helper-annotate-as-pure/node_modules/lodash/package.json,/node_modules/@babel/helper-member-expression-to-functions/node_modules/lodash/package.json,/node_modules/@babel/plugin-transform-classes/node_modules/lodash/package.json,/node_modules/@babel/helper-builder-binary-assignment-operator-visitor/node_modules/lodash/package.json,/node_modules/@babel/helper-module-transforms/node_modules/lodash/package.json,/node_modules/@babel/preset-env/node_modules/lodash/package.json,/node_modules/@babel/plugin-transform-parameters/node_modules/lodash/package.json,/node_modules/@babel/helper-define-map/node_modules/lodash/package.json,/node_modules/@babel/helper-remap-async-to-generator/node_modules/lodash/package.json,/node_modules/@babel/helper-wrap-function/node_modules/lodash/package.json,/node_modules/@babel/helper-replace-supers/node_modules/lodash/package.json,/node_modules/@babel/helper-explode-assignable-expression/node_modules/lodash/package.json,/node_modules/@babel/plugin-transform-function-name/node_modules/lodash/package.json
Dependency Hierarchy:
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@ionic/cli-framework-prompts/node_modules/lodash/package.json
Dependency Hierarchy:
Found in base branch: master
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.
Publish Date: 2021-02-15
URL: CVE-2020-28500
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.900.0
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (@ionic/cli): 6.12.2
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (@ionic/cli): 6.12.2
Step up your Open Source Security Game with Mend here
A W3C Standard XML DOM(Level2 CORE) implementation and parser(DOMParser/XMLSerializer).
Library home page: https://registry.npmjs.org/xmldom/-/xmldom-0.1.27.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xmldom/package.json
Dependency Hierarchy:
Found in base branch: master
xmldom is an open source pure JavaScript W3C standard-based (XML DOM Level 2 Core) DOMParser and XMLSerializer module. xmldom versions 0.6.0 and older do not correctly escape special characters when serializing elements removed from their ancestor. This may lead to unexpected syntactic changes during XML processing in some downstream applications. This issue has been resolved in version 0.7.0. As a workaround downstream applications can validate the input and reject the maliciously crafted documents.
Publish Date: 2021-07-27
URL: CVE-2021-32796
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-5fg8-2547-mr8q
Release Date: 2021-07-27
Fix Resolution: @xmldom/xmldom - 0.7.0
Step up your Open Source Security Game with Mend here
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-6.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/sharp/node_modules/tar/package.json,/node_modules/tar/package.json
Dependency Hierarchy:
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.13.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/pacote/node_modules/tar/package.json
Dependency Hierarchy:
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in base branch: master
The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar
aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat
calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar
directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar
checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar
symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.
Publish Date: 2021-08-03
URL: CVE-2021-32803
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-r628-mhmh-qjhw
Release Date: 2021-08-03
Fix Resolution (tar): 6.1.2
Direct dependency fix Resolution (@ionic/cli): 6.12.2
Fix Resolution (tar): 6.1.2
Direct dependency fix Resolution (@angular/cli): 9.0.0
Fix Resolution (tar): 6.1.2
Direct dependency fix Resolution (@angular/compiler-cli): 9.0.0
Step up your Open Source Security Game with Mend here
Tool for transforming styles with JS plugins
Library home page: https://registry.npmjs.org/postcss/-/postcss-7.0.17.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/postcss/package.json
Dependency Hierarchy:
Found in base branch: master
The package postcss from 7.0.0 and before 8.2.10 are vulnerable to Regular Expression Denial of Service (ReDoS) during source map parsing.
Publish Date: 2021-04-12
URL: CVE-2021-23368
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23368
Release Date: 2021-04-12
Fix Resolution (postcss): 7.0.36
Direct dependency fix Resolution (@angular-devkit/build-angular): 0.1102.13
Step up your Open Source Security Game with Mend here
Simple system and OS information library
Library home page: https://registry.npmjs.org/systeminformation/-/systeminformation-4.26.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/systeminformation/package.json
Dependency Hierarchy:
Found in base branch: master
npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade, be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().
Publish Date: 2020-11-27
URL: CVE-2020-26245
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-4v2w-h9jm-mqjg
Release Date: 2020-11-27
Fix Resolution (systeminformation): 4.30.5
Direct dependency fix Resolution (cordova): 10.0.1-nightly.2020.8.5.4e1cada0
Step up your Open Source Security Game with Mend here
Data-Mapper ORM for TypeScript, ES7, ES6, ES5. Supports MySQL, PostgreSQL, MariaDB, SQLite, MS SQL Server, Oracle, WebSQL, MongoDB databases.
Library home page: https://registry.npmjs.org/typeorm/-/typeorm-0.1.21.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/typeorm/package.json
Dependency Hierarchy:
Found in base branch: master
Prototype pollution vulnerability in the TypeORM package < 0.2.25 may allow attackers to add or modify Object properties leading to further denial of service or SQL injection attacks.
Publish Date: 2020-09-18
URL: CVE-2020-8158
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8158
Release Date: 2020-09-18
Fix Resolution: 0.2.25
Step up your Open Source Security Game with Mend here
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.