You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Partial details (16 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running (user's machine or backend server). The following risks were identified: Malware dropper – this package contains a Trojan horse, allowing the unauthorized installation of other potentially malicious software.
fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.
Mend Note: After conducting further research, Mend has determined that all versions of set-value before versions 2.0.1, 4.0.1 are vulnerable to CVE-2021-23440.
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
The utile npm module, version 0.3.0, allows to extract sensitive data from uninitialized memory or to cause a DoS by passing in a large number, in setups where typed user input can be passed (e.g. from JSON).
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
Path to vulnerable library: /node_modules/extglob/node_modules/kind-of/package.json,/node_modules/nanomatch/node_modules/kind-of/package.json,/node_modules/micromatch/node_modules/kind-of/package.json,/node_modules/snapdragon-node/node_modules/kind-of/package.json,/node_modules/define-property/node_modules/kind-of/package.json,/node_modules/base/node_modules/kind-of/package.json
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
mend-for-github-combot
changed the title
forever-2.0.0.tgz: 24 vulnerabilities (highest severity is: 9.8)
forever-2.0.0.tgz: 26 vulnerabilities (highest severity is: 9.8)
May 14, 2024
Vulnerable Library - forever-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/union-value/node_modules/set-value/package.json
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Vulnerabilities
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
Unreachable
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
MSC-2023-16609
Vulnerable Library - fsevents-1.2.9.tgz
Native Access to Mac OS-X FSEvents
Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.2.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
This package has been identified by Mend as containing potential malicious functionality. The severity of the functionality can change depending on where the library is running (user's machine or backend server). The following risks were identified: Malware dropper – this package contains a Trojan horse, allowing the unauthorized installation of other potentially malicious software.
Publish Date: 2023-09-20
URL: MSC-2023-16609
Threat Assessment
Exploit Maturity: High
EPSS:
CVSS 3 Score Details (9.8)
Base Score Metrics:
CVE-2023-45311
Vulnerable Library - fsevents-1.2.9.tgz
Native Access to Mac OS-X FSEvents
Library home page: https://registry.npmjs.org/fsevents/-/fsevents-1.2.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
fsevents before 1.2.11 depends on the https://fsevents-binaries.s3-us-west-2.amazonaws.com URL, which might allow an adversary to execute arbitrary code if any JavaScript project (that depends on fsevents) distributes code that was obtained from that URL at a time when it was controlled by an adversary. NOTE: some sources feel that this means that no version is affected any longer, because the URL is not controlled by an adversary.
Publish Date: 2023-10-06
URL: CVE-2023-45311
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.4%
CVSS 4 Score Details (9.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2023-45311
Release Date: 2023-10-06
Fix Resolution (fsevents): 1.2.11
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-37713
Vulnerable Library - tar-4.4.8.tgz
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain
..
path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such asC:some\path
. If the drive letter does not match the extraction target, for exampleD:\extraction\dir
, then the result ofpath.resolve(extractionDirectory, entryPath)
would resolve against the current working directory on theC:
drive, rather than the extraction target directory. Additionally, a..
portion of the path could occur immediately after the drive letter, such asC:../foo
, and was not properly sanitized by the logic that checked for..
within the normalized and split portions of the path. This only affects users ofnode-tar
on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.Publish Date: 2021-08-31
URL: CVE-2021-37713
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 4 Score Details (9.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-5955-9wpr-37jh
Release Date: 2021-08-31
Fix Resolution (tar): 4.4.18
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-37712
Vulnerable Library - tar-4.4.8.tgz
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.
Publish Date: 2021-08-31
URL: CVE-2021-37712
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 4 Score Details (9.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-qq89-hq3f-393p
Release Date: 2021-08-31
Fix Resolution (tar): 4.4.18
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-37701
Vulnerable Library - tar-4.4.8.tgz
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-4.4.8.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both
\
and/
characters as path separators, however\
is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory atFOO
, followed by a symbolic link namedfoo
, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within theFOO
directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.Publish Date: 2021-08-31
URL: CVE-2021-37701
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 4 Score Details (9.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-9r2w-394v-53qc
Release Date: 2021-08-31
Fix Resolution (tar): 4.4.16
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-23440
Vulnerable Libraries - set-value-2.0.0.tgz, set-value-0.4.3.tgz
set-value-2.0.0.tgz
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/set-value/package.json
Dependency Hierarchy:
set-value-0.4.3.tgz
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/union-value/node_modules/set-value/package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Mend Note: After conducting further research, Mend has determined that all versions of set-value before versions 2.0.1, 4.0.1 are vulnerable to CVE-2021-23440.
Publish Date: 2021-09-12
URL: CVE-2021-23440
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 6.4%
CVSS 4 Score Details (9.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.huntr.dev/bounties/2eae1159-01de-4f82-a177-7478a408c4a2/
Release Date: 2021-09-12
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (forever): 3.0.0
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-7774
Vulnerable Library - y18n-3.2.1.tgz
the bare-bones internationalization library used by yargs
Library home page: https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/y18n/package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
Publish Date: 2020-11-17
URL: CVE-2020-7774
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 30.4%
CVSS 4 Score Details (9.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1654
Release Date: 2020-11-17
Fix Resolution (y18n): 3.2.2
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2019-10747
Vulnerable Libraries - set-value-2.0.0.tgz, set-value-0.4.3.tgz
set-value-2.0.0.tgz
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/set-value/package.json
Dependency Hierarchy:
set-value-0.4.3.tgz
Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/union-value/node_modules/set-value/package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.
Publish Date: 2019-08-23
URL: CVE-2019-10747
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.4%
CVSS 4 Score Details (9.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2019-08-23
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (forever): 3.0.0
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2019-10746
Vulnerable Library - mixin-deep-1.3.1.tgz
Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.
Library home page: https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mixin-deep/package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-08-23
URL: CVE-2019-10746
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.5%
CVSS 4 Score Details (9.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Release Date: 2019-08-23
Fix Resolution (mixin-deep): 1.3.2
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
WS-2018-0148
Vulnerable Libraries - utile-0.2.1.tgz, utile-0.3.0.tgz
utile-0.2.1.tgz
A drop-in replacement for `util` with some additional advantageous functions
Library home page: https://registry.npmjs.org/utile/-/utile-0.2.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/prompt/node_modules/utile/package.json,/node_modules/broadway/node_modules/utile/package.json
Dependency Hierarchy:
utile-0.3.0.tgz
A drop-in replacement for `util` with some additional advantageous functions
Library home page: https://registry.npmjs.org/utile/-/utile-0.3.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/utile/package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
The
utile
npm module, version 0.3.0, allows to extract sensitive data from uninitialized memory or to cause a DoS by passing in a large number, in setups where typed user input can be passed (e.g. from JSON).Publish Date: 2018-07-16
URL: WS-2018-0148
Threat Assessment
Exploit Maturity: Not Defined
EPSS:
CVSS 4 Score Details (8.7)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/WS-2018-0148
Release Date: 2018-01-16
Fix Resolution: JetBrains.Rider.Frontend5 - 213.0.20211008.154703-eap03
CVE-2022-38900
Vulnerable Library - decode-uri-component-0.2.0.tgz
A better decodeURIComponent
Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/decode-uri-component/package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.
Publish Date: 2022-11-28
URL: CVE-2022-38900
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.2%
CVSS 4 Score Details (8.7)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-w573-4hg7-7wgq
Release Date: 2022-11-28
Fix Resolution (decode-uri-component): 0.2.1
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-25883
Vulnerable Library - semver-5.7.0.tgz
The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-5.7.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Publish Date: 2023-06-21
URL: CVE-2022-25883
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 4 Score Details (8.7)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-c2qf-rxjj-qqgw
Release Date: 2023-06-21
Fix Resolution (semver): 5.7.2
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-21803
Vulnerable Libraries - nconf-0.10.0.tgz, nconf-0.6.9.tgz
nconf-0.10.0.tgz
Hierarchical node.js configuration with files, environment variables, command-line arguments, and atomic object merging.
Library home page: https://registry.npmjs.org/nconf/-/nconf-0.10.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/nconf/package.json
Dependency Hierarchy:
nconf-0.6.9.tgz
Hierarchical node.js configuration with files, environment variables, command-line arguments, and atomic object merging.
Library home page: https://registry.npmjs.org/nconf/-/nconf-0.6.9.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/broadway/node_modules/nconf/package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
Publish Date: 2022-04-12
URL: CVE-2022-21803
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 4 Score Details (8.7)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21803
Release Date: 2022-04-12
Fix Resolution: nconf - 0.11.4
CVE-2021-3820
Vulnerable Library - i-0.3.6.tgz
custom inflections for nodejs
Library home page: https://registry.npmjs.org/i/-/i-0.3.6.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/i/package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
inflect is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-27
URL: CVE-2021-3820
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 4 Score Details (8.7)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3820
Release Date: 2021-09-27
Fix Resolution (i): 0.3.7
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-28469
Vulnerable Library - glob-parent-3.1.0.tgz
Strips glob magic from a string to provide the parent directory path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/glob-parent/package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Publish Date: 2021-06-03
URL: CVE-2020-28469
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 1.2%
CVSS 4 Score Details (8.7)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
Release Date: 2021-06-03
Fix Resolution: glob-parent - 5.1.2
CVE-2019-20149
Vulnerable Library - kind-of-6.0.2.tgz
Get the native type of a value.
Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/extglob/node_modules/kind-of/package.json,/node_modules/nanomatch/node_modules/kind-of/package.json,/node_modules/micromatch/node_modules/kind-of/package.json,/node_modules/snapdragon-node/node_modules/kind-of/package.json,/node_modules/define-property/node_modules/kind-of/package.json,/node_modules/base/node_modules/kind-of/package.json
Dependency Hierarchy:
Found in HEAD commit: e2e0b888bf18dbfbcbb74bc9b3455119cf973a08
Found in base branch: master
Reachability Analysis
The vulnerable code is unreachable
Vulnerability Details
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Publish Date: 2019-12-30
URL: CVE-2019-20149
Threat Assessment
Exploit Maturity: Not Defined
EPSS: 0.1%
CVSS 4 Score Details (8.7)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149
Release Date: 2019-12-30
Fix Resolution (kind-of): 6.0.3
Direct dependency fix Resolution (forever): 3.0.0
In order to enable automatic remediation, please create workflow rules
In order to enable automatic remediation for this issue, please create workflow rules
The text was updated successfully, but these errors were encountered: