amida-tech / greyscale

Indaba - Turn knowledge into data :earth_africa: :earth_asia: :earth_americas:
http://indaba.amida-tech.com
Other
8 stars 4 forks source link

[Snyk] Fix for 12 vulnerabilities #543

Open snyk-bot opened 1 year ago

snyk-bot commented 1 year ago

Snyk has created this PR to fix one or more vulnerable packages in the `yarn` dependencies of this project.

Changes included in this PR

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory. If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed

With an upgrade:
Severity Priority Score (*) Issue Breaking Change Exploit Maturity
medium severity 534/1000
Why? Has a fix available, CVSS 6.4
Improper Authentication
SNYK-JS-JSONWEBTOKEN-3180022
Yes No Known Exploit
medium severity 539/1000
Why? Has a fix available, CVSS 6.5
Improper Restriction of Security Token Assignment
SNYK-JS-JSONWEBTOKEN-3180024
Yes No Known Exploit
medium severity 554/1000
Why? Has a fix available, CVSS 6.8
Use of a Broken or Risky Cryptographic Algorithm
SNYK-JS-JSONWEBTOKEN-3180026
Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Information Exposure
SNYK-JS-SEQUELIZE-3324089
No No Known Exploit
medium severity 529/1000
Why? Has a fix available, CVSS 6.3
Access of Resource Using Incompatible Type ('Type Confusion')
SNYK-JS-SEQUELIZE-3324090
No No Known Exploit
medium severity 586/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 5.3
Insecure Defaults
SNYK-JS-SOCKETIO-1024859
Yes Proof of Concept
high severity 696/1000
Why? Proof of Concept exploit, Has a fix available, CVSS 7.5
Denial of Service (DoS)
SNYK-JS-SOCKETIOPARSER-1056752
Yes Proof of Concept
critical severity 704/1000
Why? Has a fix available, CVSS 9.8
Improper Input Validation
SNYK-JS-SOCKETIOPARSER-3091012
Yes No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7
Regular Expression Denial of Service (ReDoS)
npm:ms:20170412
Yes No Known Exploit
medium severity 424/1000
Why? Has a fix available, CVSS 4.2
Insecure Randomness
npm:node-uuid:20160328
No No Known Exploit
low severity 399/1000
Why? Has a fix available, CVSS 3.7
Denial of Service (DoS)
npm:superagent:20170807
Yes No Known Exploit
medium severity 479/1000
Why? Has a fix available, CVSS 5.3
Information Exposure
npm:superagent:20181108
Yes No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

With a Snyk patch:
Severity Priority Score (*) Issue Exploit Maturity
low severity 399/1000
Why? Has a fix available, CVSS 3.7
Regular Expression Denial of Service (ReDoS)
npm:ms:20170412
No Known Exploit

(*) Note that the real score may have changed since the PR was raised.

Check the changes in this PR to ensure they won't cause issues with your project.


Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report

🛠 Adjust project settings

📚 Read more about Snyk's upgrade and patch logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Use of a Broken or Risky Cryptographic Algorithm 🦉 Denial of Service (DoS) 🦉 Improper Input Validation 🦉 More lessons are available in Snyk Learn