mend-for-github-com[bot]
commented
3 hours ago :information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #46
Closed mend-for-github-com[bot] closed 3 hours ago
mend-for-github-com[bot]
commented
3 hours ago :information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #46
mend-for-github-com[bot]
commented
3 hours ago :information_source: This issue was automatically closed by Mend because it is a duplicate of an existing issue: #46
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2023-42282
### Vulnerable Library - ip-1.1.5.tgz[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - webpack-dev-server-2.9.4.tgz - :x: **ip-1.1.5.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsThe ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.
Publish Date: 2024-02-08
URL: CVE-2023-42282
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-42282
Release Date: 2024-02-08
Fix Resolution (ip): 1.1.9
Direct dependency fix Resolution (react-scripts): 1.1.0
CVE-2022-37601
### Vulnerable Libraries - loader-utils-0.2.17.tgz, loader-utils-1.1.0.tgz### loader-utils-0.2.17.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-0.2.17.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - html-webpack-plugin-2.29.0.tgz - :x: **loader-utils-0.2.17.tgz** (Vulnerable Library) ### loader-utils-1.1.0.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.1.0.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - eslint-loader-1.9.0.tgz - :x: **loader-utils-1.1.0.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsPrototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
Publish Date: 2022-10-12
URL: CVE-2022-37601
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-76p3-8jx3-jpfq
Release Date: 2022-10-12
Fix Resolution (loader-utils): 1.4.1
Direct dependency fix Resolution (react-scripts): 4.0.0
Fix Resolution (loader-utils): 1.4.1
Direct dependency fix Resolution (react-scripts): 4.0.0
CVE-2022-0691
### Vulnerable Libraries - url-parse-1.0.5.tgz, url-parse-1.2.0.tgz### url-parse-1.0.5.tgz
Small footprint URL parser that works seamlessly across Node.js and browser environments
Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.0.5.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - react-dev-utils-4.2.1.tgz - sockjs-client-1.1.4.tgz - eventsource-0.1.6.tgz - original-1.0.0.tgz - :x: **url-parse-1.0.5.tgz** (Vulnerable Library) ### url-parse-1.2.0.tgz
Small footprint URL parser that works seamlessly across Node.js and browser environments
Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.2.0.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - react-dev-utils-4.2.1.tgz - sockjs-client-1.1.4.tgz - :x: **url-parse-1.2.0.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsAuthorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.
Publish Date: 2022-02-21
URL: CVE-2022-0691
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691
Release Date: 2022-02-21
Fix Resolution (url-parse): 1.5.9
Direct dependency fix Resolution (react-scripts): 1.1.0
Fix Resolution (url-parse): 1.5.9
Direct dependency fix Resolution (react-scripts): 1.1.0
CVE-2021-44906
### Vulnerable Libraries - minimist-1.2.0.tgz, minimist-0.0.8.tgz, minimist-0.0.10.tgz### minimist-1.2.0.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - jest-20.0.4.tgz - jest-cli-20.0.4.tgz - jest-haste-map-20.0.5.tgz - sane-1.6.0.tgz - :x: **minimist-1.2.0.tgz** (Vulnerable Library) ### minimist-0.0.8.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - babel-loader-7.1.2.tgz - mkdirp-0.5.1.tgz - :x: **minimist-0.0.8.tgz** (Vulnerable Library) ### minimist-0.0.10.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - jest-20.0.4.tgz - jest-cli-20.0.4.tgz - istanbul-api-1.2.1.tgz - istanbul-reports-1.1.3.tgz - handlebars-4.5.3.tgz - optimist-0.6.1.tgz - :x: **minimist-0.0.10.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsMinimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-xvch-5gv4-984h
Release Date: 2022-03-17
Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (react-scripts): 1.1.0
Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (react-scripts): 1.1.0
Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (react-scripts): 1.1.0
CVE-2021-42740
### Vulnerable Library - shell-quote-1.6.1.tgzquote and parse shell commands
Library home page: https://registry.npmjs.org/shell-quote/-/shell-quote-1.6.1.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - react-dev-utils-4.2.1.tgz - :x: **shell-quote-1.6.1.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsThe shell-quote package before 1.7.3 for Node.js allows command injection. An attacker can inject unescaped shell metacharacters through a regex designed to support Windows drive letters. If the output of this package is passed to a real shell as a quoted argument to a command with exec(), an attacker can inject arbitrary commands. This is because the Windows drive letter regex character class is {A-z] instead of the correct {A-Za-z]. Several shell metacharacters exist in the space between capital letter Z and lower case letter a, such as the backtick character.
Publish Date: 2021-10-21
URL: CVE-2021-42740
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42740
Release Date: 2021-10-21
Fix Resolution (shell-quote): 1.7.3
Direct dependency fix Resolution (react-scripts): 5.0.0
CVE-2021-3918
### Vulnerable Library - json-schema-0.2.3.tgzJSON Schema validation and specifications
Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - jest-20.0.4.tgz - jest-cli-20.0.4.tgz - jest-environment-jsdom-20.0.3.tgz - jsdom-9.12.0.tgz - request-2.83.0.tgz - http-signature-1.2.0.tgz - jsprim-1.4.1.tgz - :x: **json-schema-0.2.3.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability Detailsjson-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Publish Date: 2021-11-13
URL: CVE-2021-3918
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918
Release Date: 2021-11-13
Fix Resolution (json-schema): 0.4.0
Direct dependency fix Resolution (react-scripts): 1.1.0
CVE-2020-7720
### Vulnerable Library - node-forge-0.6.33.tgzJavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.6.33.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - webpack-dev-server-2.9.4.tgz - selfsigned-1.10.1.tgz - :x: **node-forge-0.6.33.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsThe package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.
Publish Date: 2020-09-01
URL: CVE-2020-7720
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-09-01
Fix Resolution (node-forge): 0.10.0
Direct dependency fix Resolution (react-scripts): 1.1.0
CVE-2018-6342
### Vulnerable Library - react-dev-utils-4.2.1.tgzWebpack utilities used by Create React App
Library home page: https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-4.2.1.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - :x: **react-dev-utils-4.2.1.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability Detailsreact-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.
Publish Date: 2018-12-31
URL: CVE-2018-6342
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6342
Release Date: 2018-12-31
Fix Resolution (react-dev-utils): 4.2.2
Direct dependency fix Resolution (react-scripts): 1.1.0
CVE-2018-3774
### Vulnerable Libraries - url-parse-1.0.5.tgz, url-parse-1.2.0.tgz### url-parse-1.0.5.tgz
Small footprint URL parser that works seamlessly across Node.js and browser environments
Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.0.5.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - react-dev-utils-4.2.1.tgz - sockjs-client-1.1.4.tgz - eventsource-0.1.6.tgz - original-1.0.0.tgz - :x: **url-parse-1.0.5.tgz** (Vulnerable Library) ### url-parse-1.2.0.tgz
Small footprint URL parser that works seamlessly across Node.js and browser environments
Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.2.0.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - react-dev-utils-4.2.1.tgz - sockjs-client-1.1.4.tgz - :x: **url-parse-1.2.0.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsIncorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.
Publish Date: 2018-08-12
URL: CVE-2018-3774
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3774
Release Date: 2018-08-12
Fix Resolution (url-parse): 1.4.3
Direct dependency fix Resolution (react-scripts): 1.1.0
Fix Resolution (url-parse): 1.4.3
Direct dependency fix Resolution (react-scripts): 1.1.0
CVE-2018-16492
### Vulnerable Library - extend-3.0.1.tgzPort of jQuery.extend for node.js and the browser
Library home page: https://registry.npmjs.org/extend/-/extend-3.0.1.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - jest-20.0.4.tgz - jest-cli-20.0.4.tgz - jest-environment-jsdom-20.0.3.tgz - jsdom-9.12.0.tgz - request-2.83.0.tgz - :x: **extend-3.0.1.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsA prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
Publish Date: 2019-02-01
URL: CVE-2018-16492
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://hackerone.com/reports/381185
Release Date: 2019-02-01
Fix Resolution (extend): 3.0.2
Direct dependency fix Resolution (react-scripts): 1.1.0
CVE-2018-13797
### Vulnerable Library - macaddress-0.2.8.tgzGet the MAC addresses (hardware addresses) of the hosts network interfaces.
Library home page: https://registry.npmjs.org/macaddress/-/macaddress-0.2.8.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - css-loader-0.28.7.tgz - cssnano-3.10.0.tgz - postcss-filter-plugins-2.0.2.tgz - uniqid-4.1.1.tgz - :x: **macaddress-0.2.8.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsThe macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw, due to allowing unsanitized input to an exec (rather than execFile) call.
Publish Date: 2018-07-10
URL: CVE-2018-13797
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-13797
Release Date: 2022-10-03
Fix Resolution (macaddress): 0.2.9
Direct dependency fix Resolution (react-scripts): 1.1.0
CVE-2018-1000620
### Vulnerable Library - cryptiles-3.1.2.tgzGeneral purpose crypto utilities
Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-3.1.2.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - jest-20.0.4.tgz - jest-cli-20.0.4.tgz - jest-environment-jsdom-20.0.3.tgz - jsdom-9.12.0.tgz - request-2.83.0.tgz - hawk-6.0.2.tgz - :x: **cryptiles-3.1.2.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsEran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.
Publish Date: 2018-07-09
URL: CVE-2018-1000620
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620
Release Date: 2018-07-09
Fix Resolution (cryptiles): 4.1.2
Direct dependency fix Resolution (react-scripts): 1.1.1
CVE-2023-45133
### Vulnerable Library - babel-traverse-6.26.0.tgzThe Babel Traverse module maintains the overall tree state, and is responsible for replacing, removing, and adding nodes
Library home page: https://registry.npmjs.org/babel-traverse/-/babel-traverse-6.26.0.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - babel-core-6.26.0.tgz - :x: **babel-traverse-6.26.0.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsBabel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.
Publish Date: 2023-10-12
URL: CVE-2023-45133
### CVSS 3 Score Details (9.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92
Release Date: 2023-10-12
Fix Resolution: @babel/traverse - 7.23.2
CVE-2024-48949
### Vulnerable Libraries - elliptic-6.5.4.tgz, elliptic-6.4.0.tgz### elliptic-6.5.4.tgz
EC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.4.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - webpack-3.8.1.tgz - node-libs-browser-2.0.0.tgz - crypto-browserify-3.12.0.tgz - browserify-sign-4.2.2.tgz - :x: **elliptic-6.5.4.tgz** (Vulnerable Library) ### elliptic-6.4.0.tgz
EC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.4.0.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - webpack-3.8.1.tgz - node-libs-browser-2.0.0.tgz - crypto-browserify-3.12.0.tgz - create-ecdh-4.0.0.tgz - :x: **elliptic-6.4.0.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsThe verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
Publish Date: 2024-10-10
URL: CVE-2024-48949
### CVSS 3 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-48949
Release Date: 2024-10-10
Fix Resolution (elliptic): 6.5.6
Direct dependency fix Resolution (react-scripts): 1.1.0
Fix Resolution (elliptic): 6.5.6
Direct dependency fix Resolution (react-scripts): 1.1.0
CVE-2024-29415
### Vulnerable Library - ip-1.1.5.tgz[](https://www.npmjs.com/package/ip)
Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz
Dependency Hierarchy: - react-scripts-1.0.17.tgz (Root Library) - webpack-dev-server-2.9.4.tgz - :x: **ip-1.1.5.tgz** (Vulnerable Library)
Found in HEAD commit: e860641c6c1a3b39daa0fa29dbca45ac5104d93d
Found in base branch: main
### Vulnerability DetailsThe ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
Publish Date: 2024-05-27
URL: CVE-2024-29415
### CVSS 3 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here.