pablomatgar / Japanese-Sign-Language-Interpreter

Mobile application developed using Vue.js, Monaca, Framework7, Cordova and Teachable Machine, which recognises gestures from the Japanese Sign Language and converts them to Japanese text, with the possibility of translating them into English or Spanish.
MIT License
2 stars 3 forks source link

Try to solve security vulnerabilities #23

Closed yong-asial closed 2 years ago

yong-asial commented 2 years ago
➜  Japanese-Sign-Language-Interpreter git:(feat/cordova11) npm audit
# npm audit report

ansi-regex  >2.1.1 <5.0.1
Severity: moderate
 Inefficient Regular Expression Complexity in chalk/ansi-regex - https://github.com/advisories/GHSA-93q8-gq69-wqmw
fix available via `npm audit fix --force`
Will install cordova@11.0.0, which is a breaking change
node_modules/inquirer/node_modules/ansi-regex
node_modules/string-width/node_modules/ansi-regex
node_modules/webpack-dev-server/node_modules/cliui/node_modules/ansi-regex
node_modules/webpack-dev-server/node_modules/string-width/node_modules/ansi-regex
node_modules/webpack-dev-server/node_modules/wrap-ansi/node_modules/ansi-regex
  strip-ansi  4.0.0 - 5.2.0
  Depends on vulnerable versions of ansi-regex
  node_modules/inquirer/node_modules/strip-ansi
  node_modules/string-width/node_modules/strip-ansi
  node_modules/webpack-dev-server/node_modules/cliui/node_modules/strip-ansi
  node_modules/webpack-dev-server/node_modules/string-width/node_modules/strip-ansi
  node_modules/webpack-dev-server/node_modules/wrap-ansi/node_modules/strip-ansi
    cliui  4.0.0 - 5.0.0
    Depends on vulnerable versions of strip-ansi
    Depends on vulnerable versions of wrap-ansi
    node_modules/webpack-dev-server/node_modules/cliui
      yargs  10.1.0 - 15.0.0
      Depends on vulnerable versions of cliui
      Depends on vulnerable versions of string-width
      node_modules/webpack-dev-server/node_modules/yargs
        webpack-dev-server  2.0.0-beta - 4.7.2
        Depends on vulnerable versions of chokidar
        Depends on vulnerable versions of selfsigned
        Depends on vulnerable versions of yargs
        node_modules/webpack-dev-server
    inquirer  3.2.0 - 7.0.4
    Depends on vulnerable versions of string-width
    Depends on vulnerable versions of strip-ansi
    node_modules/inquirer
      insight  >=0.9.0
      Depends on vulnerable versions of inquirer
      node_modules/insight
        cordova  8.0.1-dev - 8.0.1-nightly.2019.3.20.f1a8fe80 || >=9.0.0
        Depends on vulnerable versions of insight
        Depends on vulnerable versions of systeminformation
        node_modules/cordova
    string-width  2.1.0 - 4.1.0
    Depends on vulnerable versions of strip-ansi
    node_modules/string-width
    node_modules/webpack-dev-server/node_modules/string-width
      wrap-ansi  3.0.0 - 6.1.0
      Depends on vulnerable versions of string-width
      Depends on vulnerable versions of strip-ansi
      node_modules/webpack-dev-server/node_modules/wrap-ansi

glob-parent  <5.1.2
Severity: high
Regular expression denial of service - https://github.com/advisories/GHSA-ww39-953v-wcq6
fix available via `npm audit fix --force`
Will install webpack-dev-server@4.7.4, which is a breaking change
node_modules/chokidar/node_modules/glob-parent
  chokidar  1.0.0-rc1 - 2.1.8
  Depends on vulnerable versions of glob-parent
  node_modules/chokidar
    webpack-dev-server  2.0.0-beta - 4.7.2
    Depends on vulnerable versions of chokidar
    Depends on vulnerable versions of selfsigned
    Depends on vulnerable versions of yargs
    node_modules/webpack-dev-server

node-fetch  <=2.6.6
Severity: high
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor - https://github.com/advisories/GHSA-r683-j2x4-v87g
The `size` option isn't honored after following a redirect in node-fetch - https://github.com/advisories/GHSA-w7rc-rwvf-8q5r
No fix available
node_modules/node-fetch
  @tensorflow/tfjs-core  1.1.0 - 2.4.0
  Depends on vulnerable versions of node-fetch
  node_modules/@tensorflow/tfjs-core
    @tensorflow/tfjs  0.14.0 - 2.4.0
    Depends on vulnerable versions of @tensorflow/tfjs-core
    Depends on vulnerable versions of @tensorflow/tfjs-data
    node_modules/@tensorflow/tfjs
      @teachablemachine/image  *
      Depends on vulnerable versions of @tensorflow/tfjs
      node_modules/@teachablemachine/image
    @tensorflow/tfjs-converter  1.1.0 - 2.4.0
    Depends on vulnerable versions of @tensorflow/tfjs-core
    node_modules/@tensorflow/tfjs-converter
    @tensorflow/tfjs-data  <=2.4.0
    Depends on vulnerable versions of @tensorflow/tfjs-core
    Depends on vulnerable versions of node-fetch
    node_modules/@tensorflow/tfjs-data
    @tensorflow/tfjs-layers  1.1.0 - 2.4.0
    Depends on vulnerable versions of @tensorflow/tfjs-core
    node_modules/@tensorflow/tfjs-layers

node-forge  <=1.2.1
Severity: high
Open Redirect in node-forge - https://github.com/advisories/GHSA-8fr3-hfg3-gpgp
Improper Verification of Cryptographic Signature in node-forge - https://github.com/advisories/GHSA-cfm4-qjh2-4765
fix available via `npm audit fix --force`
Will install webpack-dev-server@4.7.4, which is a breaking change
node_modules/node-forge
  selfsigned  1.1.1 - 1.10.14
  Depends on vulnerable versions of node-forge
  node_modules/selfsigned
    webpack-dev-server  2.0.0-beta - 4.7.2
    Depends on vulnerable versions of chokidar
    Depends on vulnerable versions of selfsigned
    Depends on vulnerable versions of yargs
    node_modules/webpack-dev-server

systeminformation  <=5.6.3
Severity: high
Command Injection Vulnerability in systeminformation - https://github.com/advisories/GHSA-jff2-qjw8-5476
Command Injection Vulnerability - https://github.com/advisories/GHSA-2m8v-572m-ff2v
fix available via `npm audit fix --force`
Will install cordova@11.0.0, which is a breaking change
node_modules/systeminformation
  cordova  8.0.1-dev - 8.0.1-nightly.2019.3.20.f1a8fe80 || >=9.0.0
  Depends on vulnerable versions of insight
  Depends on vulnerable versions of systeminformation
  node_modules/cordova

22 vulnerabilities (8 moderate, 14 high)

To address issues that do not require attention, run:
  npm audit fix

To address all issues possible (including breaking changes), run:
  npm audit fix --force

Some issues need review, and may require choosing
a different dependency.
➜  Japanese-Sign-Language-Interpreter git:(feat/cordova11)