search

Sultan-QA / sbt3

Other
0 stars 0 forks source link

sbt-uglify-2.0.1-SNAPSHOT: 31 vulnerabilities (highest severity is: 9.8) - autoclosed #5

Closed dev-mend-for-github-com[bot] closed 1 year ago

dev-mend-for-github-com[bot] commented 1 year ago
Vulnerable Library - sbt-uglify-2.0.1-SNAPSHOT

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (sbt-uglify version) Remediation Available
CVE-2018-16492 Critical 9.8 npm-4.2.0.jar Transitive N/A* ❌
CVE-2018-1000620 Critical 9.8 npm-4.2.0.jar Transitive N/A* ❌
WS-2020-0344 Critical 9.8 npm-4.2.0.jar Transitive N/A* ❌
CVE-2019-20444 Critical 9.1 netty-3.10.6.Final.jar Transitive N/A* ❌
CVE-2018-16115 Critical 9.1 akka-actor_2.12-2.5.4.jar Transitive N/A* ❌
CVE-2018-3728 High 8.8 npm-4.2.0.jar Transitive N/A* ❌
WS-2018-0084 High 8.0 npm-4.2.0.jar Transitive N/A* ❌
CVE-2022-25858 High 7.5 uglify-js-2.8.14.jar Transitive N/A* ❌
CVE-2018-20834 High 7.5 npm-4.2.0.jar Transitive N/A* ❌
CVE-2017-15010 High 7.5 npm-4.2.0.jar Transitive N/A* ❌
WS-2020-0180 High 7.5 npm-4.2.0.jar Transitive N/A* ❌
WS-2018-0069 High 7.5 npm-4.2.0.jar Transitive N/A* ❌
CVE-2018-3737 High 7.5 npm-4.2.0.jar Transitive N/A* ❌
CVE-2017-18077 High 7.5 npm-4.2.0.jar Transitive N/A* ❌
CVE-2019-13173 High 7.5 npm-4.2.0.jar Transitive N/A* ❌
CVE-2018-18854 High 7.5 spray-json_2.12-1.3.3.jar Transitive N/A* ❌
CVE-2018-18853 High 7.5 spray-json_2.12-1.3.3.jar Transitive N/A* ❌
CVE-2018-21270 Medium 6.5 npm-4.2.0.jar Transitive N/A* ❌
CVE-2019-16777 Medium 6.5 npm-4.2.0.jar Transitive N/A* ❌
CVE-2020-7598 Medium 5.6 npm-4.2.0.jar Transitive N/A* ❌
CVE-2017-16032 Medium 5.5 npm-4.2.0.jar Transitive N/A* ❌
WS-2018-0125 Medium 5.3 jackson-core-2.7.3.jar Transitive N/A* ❌
WS-2018-0124 Medium 5.3 jackson-core-2.7.3.jar Transitive N/A* ❌
WS-2020-0342 Medium 5.3 npm-4.2.0.jar Transitive N/A* ❌
CVE-2021-23362 Medium 5.3 npm-4.2.0.jar Transitive N/A* ❌
CVE-2018-1107 Medium 5.3 npm-4.2.0.jar Transitive N/A* ❌
WS-2018-0076 Medium 5.1 npm-4.2.0.jar Transitive N/A* ❌
CVE-2017-1000048 Medium 5.0 npm-4.2.0.jar Transitive N/A* ❌
WS-2018-0103 Medium 4.8 npm-4.2.0.jar Transitive N/A* ❌
CVE-2020-15095 Medium 4.4 npm-4.2.0.jar Transitive N/A* ❌
CVE-2017-18869 Low 2.5 npm-4.2.0.jar Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

Partial details (27 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2018-16492 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16492

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/381185

Release Date: 2019-02-01

Fix Resolution: extend - v3.0.2,v2.0.2

CVE-2018-1000620 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620

Release Date: 2018-07-09

Fix Resolution: v4.1.2

WS-2020-0344 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

Arbitrary Code Execution vulnerability was found in is-my-json-valid before 2.20.3 via the fromatName function.

Publish Date: 2020-06-09

URL: WS-2020-0344

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-06-09

Fix Resolution: is-my-json-valid - 2.20.3

CVE-2019-20444 ### Vulnerable Library - netty-3.10.6.Final.jar

The Netty project is an effort to provide an asynchronous event-driven network application framework and tools for rapid development of maintainable high performance and high scalability protocol servers and clients. In other words, Netty is a NIO client server framework which enables quick and easy development of network applications such as protocol servers and clients. It greatly simplifies and streamlines network programming such as TCP and UDP socket server.

Library home page: http://netty.io/

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/io.netty/netty/bundles/netty-3.10.6.Final.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - jse_2.12-1.2.3.jar - akka-contrib_2.12-2.5.4.jar - akka-remote_2.12-2.5.4.jar - :x: **netty-3.10.6.Final.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

HttpObjectDecoder.java in Netty before 4.1.44 allows an HTTP header that lacks a colon, which might be interpreted as a separate header with an incorrect syntax, or might be interpreted as an "invalid fold."

Publish Date: 2020-01-29

URL: CVE-2019-20444

### CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-20444

Release Date: 2020-01-29

Fix Resolution: io.netty:netty-all:4.1.44.Final

CVE-2018-16115 ### Vulnerable Library - akka-actor_2.12-2.5.4.jar

akka-actor

Library home page: http://akka.io/

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.typesafe.akka/akka-actor_2.12/jars/akka-actor_2.12-2.5.4.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **akka-actor_2.12-2.5.4.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

Lightbend Akka 2.5.x before 2.5.16 allows message disclosure and modification because of an RNG error. A random number generator is used in Akka Remoting for TLS (both classic and Artery Remoting). Akka allows configuration of custom random number generators. For historical reasons, Akka included the AES128CounterSecureRNG and AES256CounterSecureRNG random number generators. The implementations had a bug that caused the generated numbers to be repeated after only a few bytes. The custom RNG implementations were not configured by default but examples in the documentation showed (and therefore implicitly recommended) using the custom ones. This can be used by an attacker to compromise the communication if these random number generators are enabled in configuration. It would be possible to eavesdrop, replay, or modify the messages sent with Akka Remoting/Cluster.

Publish Date: 2018-08-29

URL: CVE-2018-16115

### CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16115

Release Date: 2018-08-29

Fix Resolution: v2.5.16

CVE-2018-3728 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via __proto__, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-03-30

URL: CVE-2018-3728

### CVSS 3 Score Details (8.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3728

Release Date: 2018-03-30

Fix Resolution: 4.2.1,5.0.3

WS-2018-0084 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

Versions of sshpk before 1.14.1 are vulnerable to regular expression denial of service when parsing crafted invalid public keys.

Publish Date: 2018-04-25

URL: WS-2018-0084

### CVSS 2 Score Details (8.0)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/606

Release Date: 2018-01-27

Fix Resolution: 1.14.1

CVE-2022-25858 ### Vulnerable Library - uglify-js-2.8.14.jar

WebJar for uglify-js

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars.npm/uglify-js/jars/uglify-js-2.8.14.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - :x: **uglify-js-2.8.14.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

The package terser before 4.8.1, from 5.0.0 and before 5.14.2 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.

Publish Date: 2022-07-15

URL: CVE-2022-25858

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-25858

Release Date: 2022-07-15

Fix Resolution: Fable.Template.Elmish.React - 0.1.6;BlazorPolyfill.Build - 6.0.100.2;terser - 5.0.0-beta.0;Moxie - 1.0.4;SAFE.Template - 3.0.1;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105;ng-grid - 2.0.4;Envisia.DotNet.Templates - 3.0.1;VueJS.NetCore - 1.1.1;PugViewEngine - 0.0.1.3;Indianadavy.VueJsWebAPITemplate.CSharp - 1.0.1;NorDroN.AngularTemplate - 0.1.6;z4a-dotnet-scaffold - 1.0.0.2;Raml.Parser - 1.0.7;dotnetng.template - 1.0.0.4

CVE-2018-20834 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).

Publish Date: 2019-04-30

URL: CVE-2018-20834

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20834

Release Date: 2019-04-30

Fix Resolution: tar - 2.2.2,4.4.2

CVE-2017-15010 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

A ReDoS (regular expression denial of service) flaw was found in the tough-cookie module before 2.3.3 for Node.js. An attacker that is able to make an HTTP request using a specially crafted cookie may cause the application to consume an excessive amount of CPU.

Publish Date: 2017-10-04

URL: CVE-2017-15010

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-15010

Release Date: 2017-10-04

Fix Resolution: 2.3.3

WS-2020-0180 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

The package npm-user-validate prior to version 1.0.1 is vulnerable to REDoS. The regex that validates a user's email took exponentially longer to process input strings that begin with the '@' character.

Publish Date: 2020-10-16

URL: WS-2020-0180

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-xgh6-85xh-479p

Release Date: 2020-10-16

Fix Resolution: 1.0.1

WS-2018-0069 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

Version of is-my-json-valid before 1.4.1 or 2.17.2 are vulnerable to regular expression denial of service (ReDoS) via the email validation function.

Publish Date: 2018-02-14

URL: WS-2018-0069

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/572

Release Date: 2018-02-14

Fix Resolution: 1.4.1

CVE-2018-3737 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.

Publish Date: 2018-06-07

URL: CVE-2018-3737

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/319593

Release Date: 2018-06-07

Fix Resolution: 1.13.2

CVE-2017-18077 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

index.js in brace-expansion before 1.1.7 is vulnerable to Regular Expression Denial of Service (ReDoS) attacks, as demonstrated by an expand argument containing many comma characters.

Publish Date: 2018-01-27

URL: CVE-2017-18077

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2017-18077

Release Date: 2018-01-27

Fix Resolution: 1.1.7

CVE-2019-13173 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.

Publish Date: 2019-07-02

URL: CVE-2019-13173

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13173

Release Date: 2020-08-24

Fix Resolution: 1.0.12

CVE-2018-18854 ### Vulnerable Library - spray-json_2.12-1.3.3.jar

A Scala library for easy and idiomatic JSON (de)serialization

Library home page: https://github.com/spray/spray-json

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/io.spray/spray-json_2.12/bundles/spray-json_2.12-1.3.3.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - jse_2.12-1.2.3.jar - :x: **spray-json_2.12-1.3.3.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of many JSON object fields (with keys that have the same hash code).

Publish Date: 2018-10-31

URL: CVE-2018-18854

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2018-10-31

Fix Resolution: io.spray:spray-json_2.10 - 1.3.5

CVE-2018-18853 ### Vulnerable Library - spray-json_2.12-1.3.3.jar

A Scala library for easy and idiomatic JSON (de)serialization

Library home page: https://github.com/spray/spray-json

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/io.spray/spray-json_2.12/bundles/spray-json_2.12-1.3.3.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - jse_2.12-1.2.3.jar - :x: **spray-json_2.12-1.3.3.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

Lightbend Spray spray-json through 1.3.4 allows remote attackers to cause a denial of service (resource consumption) because of Algorithmic Complexity during the parsing of a field composed of many decimal digits.

Publish Date: 2018-10-31

URL: CVE-2018-18853

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2018-10-31

Fix Resolution: io.spray:spray-json_2.10 - 1.3.5

CVE-2018-21270 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

Versions less than 0.0.6 of the Node.js stringstream module are vulnerable to an out-of-bounds read because of allocation of uninitialized buffers when a number is passed in the input stream (when using Node.js 4.x).

Publish Date: 2020-12-03

URL: CVE-2018-21270

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-21270

Release Date: 2020-12-03

Fix Resolution: 0.0.6

CVE-2019-16777 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of packages that also create a serve binary would overwrite the previous serve binary. This behavior is still allowed in local installations and also through install scripts. This vulnerability bypasses a user using the --ignore-scripts install option.

Publish Date: 2019-12-13

URL: CVE-2019-16777

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://blog.npmjs.org/post/189618601100/binary-planting-with-the-npm-cli

Release Date: 2019-12-13

Fix Resolution: npm - 6.13.4

CVE-2020-7598 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

### CVSS 3 Score Details (5.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-7598

Release Date: 2020-03-11

Fix Resolution: Virteom.Tenant.Mobile.Bluetooth.iOS - 0.20.41.103-prerelease;Virteom.Public.Utilities - 0.23.37.212-prerelease;org.webjars:npm - 5.0.0-1;Indianadavy.VueJsWebAPITemplate.CSharp - 1.0.1;NorDroN.AngularTemplate - 0.1.6;Virteom.Tenant.Mobile.Framework - 0.21.29.159-prerelease;Virteom.Tenant.Mobile.Bluetooth.Android - 0.20.41.103-prerelease;z4a-dotnet-scaffold - 1.0.0.2;Raml.Parser - 2.0.0;ApiExplorer.HelpPage - 1.0.0-alpha3;CoreVueWebTest - 3.0.101;dotnetng.template - 1.0.0.4;SitecoreMaster.TrueDynamicPlaceholders - 1.0.3;Virteom.Tenant.Mobile.Framework.Android - 0.20.41.103-prerelease;Fable.Template.Elmish.React - 0.1.6;BumperLane.Public.Api.Client - 0.23.35.214-prerelease;Yarn.MSBuild - 0.24.6,0.22.0;Bridge.AWS - 0.3.30.36;Nodejs.Redist.x64 - 7.7.3.1,10.3.0;tslint - 5.6.0,6.1.1;org.webjars.npm:bourbon-neat - 2.0.0-beta.2;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105;EntityFramework.LookupTables - 1.1.14.119;BumperLane.Public.Service.Contracts - 0.23.35.214-prerelease;org.webjars.npm:minimist - 1.2.4;minimist - 1.2.3,0.2.1;Virteom.Tenant.Mobile.Bluetooth - 0.21.29.159-prerelease;ShowingVault.DotNet.Sdk - 0.13.41.190-prerelease;Romano.Vue - 1.0.1;Yarnpkg.Yarn - 0.26.1;Virteom.Tenant.Mobile.Framework.UWP - 0.20.41.103-prerelease;Virteom.Tenant.Mobile.Framework.iOS - 0.20.41.103-prerelease;Chutzpah - 4.4.10;BumperLane.Public.Api.V2.ClientModule - 0.23.35.214-prerelease;VueJS.NetCore - 1.1.1;Dianoga - 5.0.0-beta.1

CVE-2017-16032 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

brace-expansion before 1.1.7 are vulnerable to a regular expression denial of service.

Publish Date: 2020-07-21

URL: CVE-2017-16032

### CVSS 3 Score Details (5.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: Low - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/338

Release Date: 2020-07-21

Fix Resolution: v1.1.7

WS-2018-0125 ### Vulnerable Library - jackson-core-2.7.3.jar

Core Jackson abstractions, basic JSON streaming API implementation

Library home page: https://github.com/FasterXML/jackson-core

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-core/bundles/jackson-core-2.7.3.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - webjars-locator-core-0.32.jar - :x: **jackson-core-2.7.3.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

OutOfMemoryError when writing BigDecimal In Jackson Core before version 2.7.7. When enabled the WRITE_BIGDECIMAL_AS_PLAIN setting, Jackson will attempt to write out the whole number, no matter how large the exponent.

Publish Date: 2016-08-25

URL: WS-2018-0125

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2016-08-25

Fix Resolution: com.fasterxml.jackson.core:jackson-core:2.7.7

WS-2018-0124 ### Vulnerable Library - jackson-core-2.7.3.jar

Core Jackson abstractions, basic JSON streaming API implementation

Library home page: https://github.com/FasterXML/jackson-core

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/com.fasterxml.jackson.core/jackson-core/bundles/jackson-core-2.7.3.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - webjars-locator-core-0.32.jar - :x: **jackson-core-2.7.3.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

In Jackson Core before version 2.8.6 if the REST endpoint consumes POST requests with JSON or XML data and data are invalid, the first unrecognized token is printed to server.log. If the first token is word of length 10MB, the whole word is printed. This is potentially dangerous and can be used to attack the server by filling the disk with logs.

Publish Date: 2018-06-24

URL: WS-2018-0124

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=WS-2018-0124

Release Date: 2018-01-24

Fix Resolution: 2.8.6

WS-2020-0342 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

Regular Expression Denial of Service (ReDoS) vulnerability was found in is-my-json-valid before 2.20.2 via the style format.

Publish Date: 2020-06-27

URL: WS-2020-0342

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2020-06-27

Fix Resolution: is-my-json-valid - 2.20.2

CVE-2021-23362 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

The package hosted-git-info before 3.0.8 are vulnerable to Regular Expression Denial of Service (ReDoS) via regular expression shortcutMatch in the fromUrl function in index.js. The affected regular expression exhibits polynomial worst-case time complexity.

Publish Date: 2021-03-23

URL: CVE-2021-23362

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-43f8-2h32-f4cj

Release Date: 2021-03-23

Fix Resolution: hosted-git-info - 2.8.9,3.0.8

CVE-2018-1107 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

It was discovered that the is-my-json-valid JavaScript library used an inefficient regular expression to validate JSON fields defined to have email format. A specially crafted JSON file could cause it to consume an excessive amount of CPU time when validated.

Publish Date: 2021-03-30

URL: CVE-2018-1107

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1546357

Release Date: 2021-03-30

Fix Resolution: 1.4.2,2.17.2

WS-2018-0076 ### Vulnerable Library - npm-4.2.0.jar

WebJar for npm

Library home page: http://webjars.org

Path to vulnerable library: /home/wss-scanner/.ivy2/cache/org.webjars/npm/jars/npm-4.2.0.jar

Dependency Hierarchy: - sbt-uglify-2.0.1-SNAPSHOT (Root Library) - sbt-js-engine-1.2.2.jar - npm_2.12-1.2.1.jar - :x: **npm-4.2.0.jar** (Vulnerable Library)

Found in HEAD commit: d4a3f852ac7ea5cb51f8a928c57c2cc3f2a3ee69

Found in base branch: main

### Vulnerability Details

Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure. This is exploitable if user supplied input is provided to the auth value and is a number.

Publish Date: 2017-03-05

URL: WS-2018-0076

### CVSS 3 Score Details (5.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/598

Release Date: 2017-03-05

Fix Resolution: 0.6.0

dev-mend-for-github-com[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.