You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/qs/package.json
Dependency Hierarchy:
grunt-contrib-connect-0.7.1.tgz (Root Library)
connect-2.13.1.tgz
❌ qs-0.6.6.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Denial-of-Service Extended Event Loop Blocking.The qs module does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/debug/package.json
Dependency Hierarchy:
grunt-contrib-connect-0.7.1.tgz (Root Library)
connect-2.13.1.tgz
❌ debug-0.8.1.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/fresh/package.json
Dependency Hierarchy:
grunt-contrib-connect-0.7.1.tgz (Root Library)
connect-2.13.1.tgz
❌ fresh-0.2.0.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/qs/package.json
Dependency Hierarchy:
grunt-contrib-connect-0.7.1.tgz (Root Library)
connect-2.13.1.tgz
❌ qs-0.6.6.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/negotiator/package.json
Dependency Hierarchy:
grunt-contrib-connect-0.7.1.tgz (Root Library)
connect-2.13.1.tgz
❌ negotiator-0.3.0.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/qs/package.json
Dependency Hierarchy:
grunt-contrib-connect-0.7.1.tgz (Root Library)
connect-2.13.1.tgz
❌ qs-0.6.6.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/send/package.json
Dependency Hierarchy:
grunt-contrib-connect-0.7.1.tgz (Root Library)
connect-2.13.1.tgz
❌ send-0.1.4.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/connect/package.json
Dependency Hierarchy:
grunt-contrib-connect-0.7.1.tgz (Root Library)
❌ connect-2.13.1.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/qs/package.json
Dependency Hierarchy:
grunt-contrib-connect-0.7.1.tgz (Root Library)
connect-2.13.1.tgz
❌ qs-0.6.6.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/debug/package.json
Dependency Hierarchy:
grunt-contrib-connect-0.7.1.tgz (Root Library)
connect-2.13.1.tgz
❌ debug-0.8.1.tgz (Vulnerable Library)
Found in base branch: master
Vulnerability Details
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Vulnerable Library - grunt-contrib-connect-0.7.1.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/connect/package.json
Vulnerabilities
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
WS-2018-0107
Vulnerable Library - open-0.0.4.tgz
open a file or url in the user's preferred application
Library home page: https://registry.npmjs.org/open/-/open-0.0.4.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/open/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
All versions of open are vulnerable to command injection when unsanitized user input is passed in.
Publish Date: 2018-05-16
URL: WS-2018-0107
CVSS 3 Score Details (7.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/WS-2018-0107
Release Date: 2018-01-27
Fix Resolution (open): 6.0.0
Direct dependency fix Resolution (grunt-contrib-connect): 0.9.0
Step up your Open Source Security Game with Mend here
WS-2014-0005
Vulnerable Library - qs-0.6.6.tgz
querystring parser
Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/qs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Denial-of-Service Extended Event Loop Blocking.The qs module does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time
Publish Date: 2014-07-31
URL: WS-2014-0005
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/WS-2014-0005
Release Date: 2014-07-31
Fix Resolution (qs): 1.0.0
Direct dependency fix Resolution (grunt-contrib-connect): 0.9.0
Step up your Open Source Security Game with Mend here
CVE-2017-20165
Vulnerable Library - debug-0.8.1.tgz
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-0.8.1.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/debug/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
A vulnerability classified as problematic has been found in debug-js debug up to 3.0.x. This affects the function useColors of the file src/node.js. The manipulation of the argument str leads to inefficient regular expression complexity. Upgrading to version 3.1.0 is able to address this issue. The identifier of the patch is c38a0166c266a679c8de012d4eaccec3f944e685. It is recommended to upgrade the affected component. The identifier VDB-217665 was assigned to this vulnerability.
Publish Date: 2023-01-09
URL: CVE-2017-20165
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-9vvw-cc9w-f27h
Release Date: 2023-01-09
Fix Resolution (debug): 2.6.9
Direct dependency fix Resolution (grunt-contrib-connect): 0.11.0
Step up your Open Source Security Game with Mend here
CVE-2017-16138
Vulnerable Library - mime-1.2.11.tgz
A comprehensive library for mime-type mapping
Library home page: https://registry.npmjs.org/mime/-/mime-1.2.11.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/mime/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Publish Date: 2018-06-07
URL: CVE-2017-16138
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138
Release Date: 2018-04-26
Fix Resolution (mime): 1.4.1
Direct dependency fix Resolution (grunt-contrib-connect): 0.11.0
Step up your Open Source Security Game with Mend here
CVE-2017-16119
Vulnerable Library - fresh-0.2.0.tgz
HTTP response freshness testing
Library home page: https://registry.npmjs.org/fresh/-/fresh-0.2.0.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/fresh/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Publish Date: 2018-06-07
URL: CVE-2017-16119
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/526
Release Date: 2018-04-26
Fix Resolution (fresh): 0.5.2
Direct dependency fix Resolution (grunt-contrib-connect): 0.11.0
Step up your Open Source Security Game with Mend here
CVE-2017-1000048
Vulnerable Library - qs-0.6.6.tgz
querystring parser
Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/qs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.
Publish Date: 2017-07-17
URL: CVE-2017-1000048
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1000048
Release Date: 2017-07-13
Fix Resolution (qs): 6.0.4
Direct dependency fix Resolution (grunt-contrib-connect): 0.11.0
Step up your Open Source Security Game with Mend here
CVE-2016-10539
Vulnerable Library - negotiator-0.3.0.tgz
HTTP content negotiation
Library home page: https://registry.npmjs.org/negotiator/-/negotiator-0.3.0.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/negotiator/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
negotiator is an HTTP content negotiator for Node.js and is used by many modules and frameworks including Express and Koa. The header for "Accept-Language", when parsed by negotiator 0.6.0 and earlier is vulnerable to Regular Expression Denial of Service via a specially crafted string.
Publish Date: 2018-05-31
URL: CVE-2016-10539
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/106
Release Date: 2018-04-26
Fix Resolution (negotiator): 0.6.1
Direct dependency fix Resolution (grunt-contrib-connect): 0.11.0
Step up your Open Source Security Game with Mend here
CVE-2014-10064
Vulnerable Library - qs-0.6.6.tgz
querystring parser
Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/qs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
Publish Date: 2018-05-31
URL: CVE-2014-10064
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-10064
Release Date: 2018-04-26
Fix Resolution (qs): 1.0.0
Direct dependency fix Resolution (grunt-contrib-connect): 0.9.0
Step up your Open Source Security Game with Mend here
CVE-2014-6394
Vulnerable Library - send-0.1.4.tgz
Better streaming static file server with Range and conditional-GET support
Library home page: https://registry.npmjs.org/send/-/send-0.1.4.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/send/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
Publish Date: 2014-10-08
URL: CVE-2014-6394
CVSS 3 Score Details (7.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-6394
Release Date: 2014-10-08
Fix Resolution (send): 0.8.4
Direct dependency fix Resolution (grunt-contrib-connect): 0.9.0
Step up your Open Source Security Game with Mend here
CVE-2018-3717
Vulnerable Library - connect-2.13.1.tgz
High performance middleware framework
Library home page: https://registry.npmjs.org/connect/-/connect-2.13.1.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/connect/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.
Publish Date: 2018-06-07
URL: CVE-2018-3717
CVSS 3 Score Details (5.4)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3717
Release Date: 2018-06-07
Fix Resolution (connect): 2.14.0
Direct dependency fix Resolution (grunt-contrib-connect): 0.8.0
Step up your Open Source Security Game with Mend here
CVE-2015-8859
Vulnerable Library - send-0.1.4.tgz
Better streaming static file server with Range and conditional-GET support
Library home page: https://registry.npmjs.org/send/-/send-0.1.4.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/send/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.
Publish Date: 2017-01-23
URL: CVE-2015-8859
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-8859
Release Date: 2017-01-23
Fix Resolution (send): 0.11.1
Direct dependency fix Resolution (grunt-contrib-connect): 0.9.0
Step up your Open Source Security Game with Mend here
CVE-2014-7191
Vulnerable Library - qs-0.6.6.tgz
querystring parser
Library home page: https://registry.npmjs.org/qs/-/qs-0.6.6.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/qs/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Publish Date: 2014-10-19
URL: CVE-2014-7191
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-7191
Release Date: 2014-10-19
Fix Resolution (qs): 1.0.0
Direct dependency fix Resolution (grunt-contrib-connect): 0.9.0
Step up your Open Source Security Game with Mend here
CVE-2016-1000236
Vulnerable Library - cookie-signature-1.0.1.tgz
Sign and unsign cookies
Library home page: https://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.1.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/cookie-signature/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Node-cookie-signature before 1.0.6 is affected by a timing attack due to the type of comparison used.
Publish Date: 2019-11-19
URL: CVE-2016-1000236
CVSS 3 Score Details (4.4)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-92vm-wfm5-mxvv
Release Date: 2019-11-19
Fix Resolution (cookie-signature): 1.0.4
Direct dependency fix Resolution (grunt-contrib-connect): 0.9.0
Step up your Open Source Security Game with Mend here
CVE-2017-16137
Vulnerable Library - debug-0.8.1.tgz
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-0.8.1.tgz
Path to dependency file: /clumsy-bird/package.json
Path to vulnerable library: /clumsy-bird/node_modules/debug/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Publish Date: 2018-06-07
URL: CVE-2017-16137
CVSS 3 Score Details (3.7)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-gxpj-cx7g-858c
Release Date: 2018-04-26
Fix Resolution (debug): 2.6.9
Direct dependency fix Resolution (grunt-contrib-connect): 0.11.0
Step up your Open Source Security Game with Mend here
The text was updated successfully, but these errors were encountered: