*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Partial details (21 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
ssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Improper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.
The NPM package `micromatch` is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.
Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of micromatch should follow the fix recommendation as noted.
Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
The package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
This affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
Path to vulnerable library: /package.json,/scripts/auto_backtester/node_modules/@snyk/inquirer/node_modules/ansi-regex/package.json,/scripts/auto_backtester/node_modules/ansi-align/node_modules/ansi-regex/package.json,/scripts/auto_backtester/node_modules/snyk/node_modules/ansi-regex/package.json,/scripts/auto_backtester/node_modules/wrap-ansi/node_modules/ansi-regex/package.json
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Snyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1. This affects, for example, the Snyk TeamCity plugin (which does not update automatically) before 20220930.142957.
The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
snyk library and cli utility
Library home page: https://registry.npmjs.org/snyk/-/snyk-1.386.0.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/snyk/package.json
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
CVE-2020-26301
### Vulnerable Library - ssh2-0.8.9.tgzSSH2 client and server modules written in pure JavaScript for node.js
Library home page: https://registry.npmjs.org/ssh2/-/ssh2-0.8.9.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/ssh2/package.json,/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-docker-plugin-3.18.1.tgz - docker-modem-2.1.3.tgz - :x: **ssh2-0.8.9.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability Detailsssh2 is client and server modules written in pure JavaScript for node.js. In ssh2 before version 1.4.0 there is a command injection vulnerability. The issue only exists on Windows. This issue may lead to remote code execution if a client of the library calls the vulnerable method with untrusted input. This is fixed in version 1.4.0.
Publish Date: 2021-09-20
URL: CVE-2020-26301
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 4.0%
### CVSS 4 Score Details (9.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://securitylab.github.com/advisories/GHSL-2020-123-mscdex-ssh2/
Release Date: 2021-09-20
Fix Resolution (ssh2): 1.4.0
Direct dependency fix Resolution (snyk): 1.685.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-23406
### Vulnerable Libraries - degenerator-1.0.4.tgz, pac-resolver-3.0.0.tgz### degenerator-1.0.4.tgz
Turns sync functions into async generator functions
Library home page: https://registry.npmjs.org/degenerator/-/degenerator-1.0.4.tgz
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - proxy-agent-3.1.1.tgz - pac-proxy-agent-3.0.1.tgz - pac-resolver-3.0.0.tgz - :x: **degenerator-1.0.4.tgz** (Vulnerable Library) ### pac-resolver-3.0.0.tgz
Generates an asynchronous resolver function from a PAC file
Library home page: https://registry.npmjs.org/pac-resolver/-/pac-resolver-3.0.0.tgz
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - proxy-agent-3.1.1.tgz - pac-proxy-agent-3.0.1.tgz - :x: **pac-resolver-3.0.0.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThis affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. **NOTE:** The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
Publish Date: 2021-08-24
URL: CVE-2021-23406
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.4%
### CVSS 4 Score Details (9.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-9j49-mfvp-vmhm
Release Date: 2021-08-24
Fix Resolution (degenerator): 3.0.1
Direct dependency fix Resolution (snyk): 1.518.0
Fix Resolution (pac-resolver): 3.0.1
Direct dependency fix Resolution (snyk): 1.518.0
CVE-2020-7788
### Vulnerable Library - ini-1.3.5.tgzAn ini encoder/decoder for node
Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json,/scripts/auto_backtester/node_modules/ini/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - update-notifier-4.1.1.tgz - latest-version-5.1.0.tgz - package-json-6.5.0.tgz - registry-auth-token-4.2.0.tgz - rc-1.2.8.tgz - :x: **ini-1.3.5.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThis affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Publish Date: 2020-12-11
URL: CVE-2020-7788
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 1.2%
### CVSS 4 Score Details (9.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
Release Date: 2020-12-11
Fix Resolution (ini): 1.3.6
Direct dependency fix Resolution (snyk): 1.387.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-7774
### Vulnerable Library - y18n-3.2.1.tgzthe bare-bones internationalization library used by yargs
Library home page: https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-config-3.1.0.tgz - nconf-0.10.0.tgz - yargs-3.32.0.tgz - :x: **y18n-3.2.1.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThe package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.
Publish Date: 2020-11-17
URL: CVE-2020-7774
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 30.4%
### CVSS 4 Score Details (9.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.npmjs.com/advisories/1654
Release Date: 2020-11-17
Fix Resolution (y18n): 3.2.2
Direct dependency fix Resolution (snyk): 1.387.0
CVE-2021-28918
### Vulnerable Library - netmask-1.0.6.tgzParse and lookup IP network blocks
Library home page: https://registry.npmjs.org/netmask/-/netmask-1.0.6.tgz
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - proxy-agent-3.1.1.tgz - pac-proxy-agent-3.0.1.tgz - pac-resolver-3.0.0.tgz - :x: **netmask-1.0.6.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsImproper input validation of octal strings in netmask npm package v1.0.6 and below allows unauthenticated remote attackers to perform indeterminate SSRF, RFI, and LFI attacks on many of the dependent packages. A remote unauthenticated attacker can bypass packages relying on netmask to filter IPs and reach critical VPN or LAN hosts.
Publish Date: 2021-04-01
URL: CVE-2021-28918
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 8.1%
### CVSS 4 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-pch5-whg9-qr2r
Release Date: 2021-04-01
Fix Resolution (netmask): 2.0.1
Direct dependency fix Resolution (snyk): 1.518.0
CVE-2024-4068
### Vulnerable Library - braces-3.0.2.tgzBash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
Library home page: https://registry.npmjs.org/braces/-/braces-3.0.2.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/braces/package.json,/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-nodejs-lockfile-parser-1.27.0.tgz - core-2.2.0.tgz - micromatch-4.0.2.tgz - :x: **braces-3.0.2.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThe NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash. Mend Note: After conducting a further research, it was concluded that CVE-2024-4068 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of braces should follow the fix recommendation as noted.
Publish Date: 2024-05-14
URL: CVE-2024-4068
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.0%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2024-05-14
Fix Resolution: braces - 3.0.3
CVE-2024-4067
### Vulnerable Library - micromatch-4.0.2.tgzGlob matching for javascript/node.js. A replacement and faster alternative to minimatch and multimatch.
Library home page: https://registry.npmjs.org/micromatch/-/micromatch-4.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json,/scripts/auto_backtester/node_modules/micromatch/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-nodejs-lockfile-parser-1.27.0.tgz - core-2.2.0.tgz - :x: **micromatch-4.0.2.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThe NPM package `micromatch` is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. Mend Note: After conducting a further research, it was concluded that CVE-2024-4067 does not contain a high security risk that reflects the NVD score, but should be kept for users' awareness. Users of micromatch should follow the fix recommendation as noted.
Publish Date: 2024-05-14
URL: CVE-2024-4067
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.0%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2024-05-14
Fix Resolution (micromatch): 4.0.6
Direct dependency fix Resolution (snyk): 1.387.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-25883
### Vulnerable Libraries - semver-5.7.1.tgz, semver-6.3.0.tgz### semver-5.7.1.tgz
The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - os-name-3.1.0.tgz - windows-release-3.3.3.tgz - execa-1.0.0.tgz - cross-spawn-6.0.5.tgz - :x: **semver-5.7.1.tgz** (Vulnerable Library) ### semver-6.3.0.tgz
The semantic version parser used by npm.
Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json,/scripts/auto_backtester/node_modules/semver/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - :x: **semver-6.3.0.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsVersions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.
Publish Date: 2023-06-21
URL: CVE-2022-25883
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.1%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-c2qf-rxjj-qqgw
Release Date: 2023-06-21
Fix Resolution (semver): 5.7.2
Direct dependency fix Resolution (snyk): 1.685.0
Fix Resolution (semver): 5.7.2
Direct dependency fix Resolution (snyk): 1.685.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-25881
### Vulnerable Library - http-cache-semantics-4.1.0.tgzParses Cache-Control and other headers. Helps building correct HTTP caches and proxies
Library home page: https://registry.npmjs.org/http-cache-semantics/-/http-cache-semantics-4.1.0.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/http-cache-semantics/package.json,/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-nodejs-lockfile-parser-1.27.0.tgz - got-11.4.0.tgz - cacheable-request-7.0.1.tgz - :x: **http-cache-semantics-4.1.0.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThis affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
Publish Date: 2023-01-31
URL: CVE-2022-25881
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.1%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-rc47-6667-2j5j
Release Date: 2023-01-31
Fix Resolution (http-cache-semantics): 4.1.1
Direct dependency fix Resolution (snyk): 1.387.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-24441
### Vulnerable Library - snyk-1.386.0.tgzsnyk library and cli utility
Library home page: https://registry.npmjs.org/snyk/-/snyk-1.386.0.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/snyk/package.json
Dependency Hierarchy: - :x: **snyk-1.386.0.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThe package snyk before 1.1064.0 are vulnerable to Code Injection when analyzing a project. An attacker who can convince a user to scan a malicious project can include commands in a build file such as build.gradle or gradle-wrapper.jar, which will be executed with the privileges of the application. This vulnerability may be triggered when running the the CLI tool directly, or when running a scan with one of the IDE plugins that invoke the Snyk CLI. Successful exploitation of this issue would likely require some level of social engineering - to coerce an untrusted project to be downloaded and analyzed via the Snyk CLI or opened in an IDE where a Snyk IDE plugin is installed and enabled. Additionally, if the IDE has a Trust feature then the target folder must be marked as ‘trusted’ in order to be vulnerable. **NOTE:** This issue is independent of the one reported in [CVE-2022-40764](https://security.snyk.io/vuln/SNYK-JS-SNYK-3037342), and upgrading to a fixed version for this addresses that issue as well. The affected IDE plugins and versions are: - VS Code - Affected: <=1.8.0, Fixed: 1.9.0 - IntelliJ - Affected: <=2.4.47, Fixed: 2.4.48 - Visual Studio - Affected: <=1.1.30, Fixed: 1.1.31 - Eclipse - Affected: <=v20221115.132308, Fixed: All subsequent versions - Language Server - Affected: <=v20221109.114426, Fixed: All subsequent versions
Publish Date: 2022-11-30
URL: CVE-2022-24441
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 1.5%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: N/A - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-24441
Release Date: 2022-11-30
Fix Resolution: 1.1064.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-21803
### Vulnerable Library - nconf-0.10.0.tgzHierarchical node.js configuration with files, environment variables, command-line arguments, and atomic object merging.
Library home page: https://registry.npmjs.org/nconf/-/nconf-0.10.0.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/nconf/package.json,/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-config-3.1.0.tgz - :x: **nconf-0.10.0.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThis affects the package nconf before 0.11.4. When using the memory engine, it is possible to store a nested JSON representation of the configuration. The .set() function, that is responsible for setting the configuration properties, is vulnerable to Prototype Pollution. By providing a crafted property, it is possible to modify the properties on the Object.prototype.
Publish Date: 2022-04-12
URL: CVE-2022-21803
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.2%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-21803
Release Date: 2022-04-12
Fix Resolution (nconf): 0.11.4
Direct dependency fix Resolution (snyk): 1.425.4
In order to enable automatic remediation, please create workflow rules
CVE-2021-3807
### Vulnerable Libraries - ansi-regex-4.1.0.tgz, ansi-regex-5.0.0.tgz### ansi-regex-4.1.0.tgz
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-4.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json,/scripts/auto_backtester/node_modules/@snyk/inquirer/node_modules/ansi-regex/package.json,/scripts/auto_backtester/node_modules/ansi-align/node_modules/ansi-regex/package.json,/scripts/auto_backtester/node_modules/snyk/node_modules/ansi-regex/package.json,/scripts/auto_backtester/node_modules/wrap-ansi/node_modules/ansi-regex/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - inquirer-6.2.2-patch.tgz - strip-ansi-5.2.0.tgz - :x: **ansi-regex-4.1.0.tgz** (Vulnerable Library) ### ansi-regex-5.0.0.tgz
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-5.0.0.tgz
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - update-notifier-4.1.1.tgz - boxen-4.2.0.tgz - widest-line-3.1.0.tgz - string-width-4.2.0.tgz - strip-ansi-6.0.0.tgz - :x: **ansi-regex-5.0.0.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability Detailsansi-regex is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3807
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.4%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/
Release Date: 2021-09-17
Fix Resolution (ansi-regex): 4.1.1
Direct dependency fix Resolution (snyk): 1.387.0
Fix Resolution (ansi-regex): 4.1.1
Direct dependency fix Resolution (snyk): 1.387.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-33502
### Vulnerable Library - normalize-url-4.5.0.tgzNormalize a URL
Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-4.5.0.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/normalize-url/package.json,/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-nodejs-lockfile-parser-1.27.0.tgz - got-11.4.0.tgz - cacheable-request-7.0.1.tgz - :x: **normalize-url-4.5.0.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThe normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
Publish Date: 2021-05-24
URL: CVE-2021-33502
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.1%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502
Release Date: 2021-05-24
Fix Resolution (normalize-url): 4.5.1
Direct dependency fix Resolution (snyk): 1.387.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-23490
### Vulnerable Library - parse-link-header-1.0.1.tgzParses a link header and returns paging information for each contained link.
Library home page: https://registry.npmjs.org/parse-link-header/-/parse-link-header-1.0.1.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/parse-link-header/package.json,/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-docker-plugin-3.18.1.tgz - snyk-docker-pull-3.2.0.tgz - docker-registry-v2-client-1.13.5.tgz - :x: **parse-link-header-1.0.1.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThe package parse-link-header before 2.0.0 are vulnerable to Regular Expression Denial of Service (ReDoS) via the checkHeader function.
Publish Date: 2021-12-24
URL: CVE-2021-23490
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.2%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23490
Release Date: 2021-12-24
Fix Resolution (parse-link-header): 2.0.0
Direct dependency fix Resolution (snyk): 1.387.0
In order to enable automatic remediation, please create workflow rules
CVE-2020-28469
### Vulnerable Library - glob-parent-5.1.1.tgzExtract the non-magic parent path from a glob string.
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /package.json,/scripts/auto_backtester/node_modules/glob-parent/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-nodejs-lockfile-parser-1.27.0.tgz - core-2.2.0.tgz - shell-2.2.0.tgz - fast-glob-3.2.4.tgz - :x: **glob-parent-5.1.1.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThis affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Publish Date: 2021-06-03
URL: CVE-2020-28469
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 1.2%
### CVSS 4 Score Details (8.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
Release Date: 2021-06-03
Fix Resolution (glob-parent): 5.1.2
Direct dependency fix Resolution (snyk): 1.387.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-23358
### Vulnerable Library - underscore-1.11.0.tgzJavaScript's functional programming helper library.
Library home page: https://registry.npmjs.org/underscore/-/underscore-1.11.0.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/underscore/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-nodejs-lockfile-parser-1.27.0.tgz - core-2.2.0.tgz - logic-solver-2.0.1.tgz - :x: **underscore-1.11.0.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThe package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Publish Date: 2021-03-29
URL: CVE-2021-23358
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 1.1%
### CVSS 4 Score Details (8.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23358
Release Date: 2021-03-29
Fix Resolution (underscore): 1.12.1
Direct dependency fix Resolution (snyk): 1.387.0
In order to enable automatic remediation, please create workflow rules
CVE-2021-23337
### Vulnerable Library - lodash-4.17.20.tgzLodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.20.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/lodash/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-nodejs-lockfile-parser-1.27.0.tgz - core-2.2.0.tgz - :x: **lodash-4.17.20.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsLodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Publish Date: 2021-02-15
URL: CVE-2021-23337
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.6%
### CVSS 4 Score Details (8.6)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-35jh-r3h4-6jhm
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (snyk): 1.387.0
In order to enable automatic remediation, please create workflow rules
CVE-2022-40764
### Vulnerable Library - snyk-1.386.0.tgzsnyk library and cli utility
Library home page: https://registry.npmjs.org/snyk/-/snyk-1.386.0.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/snyk/package.json
Dependency Hierarchy: - :x: **snyk-1.386.0.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsSnyk CLI before 1.996.0 allows arbitrary command execution, affecting Snyk IDE plugins and the snyk npm package. Exploitation could follow from the common practice of viewing untrusted files in the Visual Studio Code editor, for example. The original demonstration was with shell metacharacters in the vendor.json ignore field, affecting snyk-go-plugin before 1.19.1. This affects, for example, the Snyk TeamCity plugin (which does not update automatically) before 20220930.142957.
Publish Date: 2022-10-03
URL: CVE-2022-40764
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.1%
### CVSS 4 Score Details (8.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-hpqj-7cj6-hfj8
Release Date: 2022-10-03
Fix Resolution: 1.996.0
In order to enable automatic remediation, please create workflow rules
CVE-2023-48795
### Vulnerable Library - ssh2-0.8.9.tgzSSH2 client and server modules written in pure JavaScript for node.js
Library home page: https://registry.npmjs.org/ssh2/-/ssh2-0.8.9.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/ssh2/package.json,/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-docker-plugin-3.18.1.tgz - docker-modem-2.1.3.tgz - :x: **ssh2-0.8.9.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsThe SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
Publish Date: 2023-12-18
URL: CVE-2023-48795
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 96.3%
### CVSS 4 Score Details (8.2)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://security-tracker.debian.org/tracker/CVE-2023-48795
Release Date: 2023-12-18
Fix Resolution: putty - 0.80, openssh - V_9_6_P1, golang/crypto - v0.17.0, asyncssh - 2.14.2, libssh-0.9.8, libssh-0.10.6, teraterm - v5.1, paramiko - 3.4.0, russh - 0.40.2, com.github.mwiede:jsch:0.2.15, proftpd - v1.3.8b, thrussh - 0.35.1, teraterm - v5.1, org.connectbot:sshlib:2.2.22, mscdex/ssh2 - 1.15.0, jtesta/ssh-audit - v3.1.0, Oryx-Embedded/CycloneSSH - v2.3.4, opnsense/src - 23.7, winscp - 6.2.2, PowerShell/openssh-portable - v9.5.0.0
CVE-2023-26115
### Vulnerable Library - word-wrap-1.2.3.tgzWrap words to a specified length.
Library home page: https://registry.npmjs.org/word-wrap/-/word-wrap-1.2.3.tgz
Path to dependency file: /scripts/auto_backtester/package.json
Path to vulnerable library: /scripts/auto_backtester/node_modules/word-wrap/package.json
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - proxy-agent-3.1.1.tgz - pac-proxy-agent-3.0.1.tgz - pac-resolver-3.0.0.tgz - degenerator-1.0.4.tgz - escodegen-1.14.3.tgz - optionator-0.8.3.tgz - :x: **word-wrap-1.2.3.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsAll versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.
Publish Date: 2023-06-22
URL: CVE-2023-26115
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.1%
### CVSS 4 Score Details (8.2)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-j8xg-fqg3-53r7
Release Date: 2023-06-22
Fix Resolution (word-wrap): 1.2.4
Direct dependency fix Resolution (snyk): 1.387.0
In order to enable automatic remediation, please create workflow rules
CVE-2024-39249
### Vulnerable Library - async-1.5.2.tgzHigher-order functions and common patterns for asynchronous code
Library home page: https://registry.npmjs.org/async/-/async-1.5.2.tgz
Dependency Hierarchy: - snyk-1.386.0.tgz (Root Library) - snyk-config-3.1.0.tgz - nconf-0.10.0.tgz - :x: **async-1.5.2.tgz** (Vulnerable Library)
Found in base branch: unstable
### Vulnerability DetailsAsync <= 2.6.4 and <= 3.2.5 are vulnerable to ReDoS (Regular Expression Denial of Service) while parsing function in autoinject function.
Publish Date: 2024-07-01
URL: CVE-2024-39249
### Threat AssessmentExploit Maturity: Not Defined
EPSS: 0.0%
### CVSS 4 Score Details (7.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: N/A - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS4 Scores, click here.In order to enable automatic remediation for this issue, please create workflow rules