Damn Vulnerable Web Services is a vulnerable application with a web service and an API that can be used to learn about webservices/API related vulnerabilities.
GNU General Public License v3.0
442
stars
173
forks
source link
[Snyk] Upgrade express-fileupload from 1.1.7-alpha.4 to 1.4.0 #43
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to upgrade express-fileupload from 1.1.7-alpha.4 to 1.4.0.
:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.
- The recommended version is **8 versions** ahead of your current version.
- The recommended version was released **a year ago**, on 2022-05-24.
The recommended version fixes:
Severity | Issue | PriorityScore (*) | Exploit Maturity |
:-------------------------:|:-------------------------|-------------------------|:-------------------------
| Denial of Service (DoS) [SNYK-JS-DICER-2311764](https://snyk.io/vuln/SNYK-JS-DICER-2311764) | **546/1000** **Why?** Mature exploit, CVSS 7.5 | Mature
| Prototype Pollution [SNYK-JS-EXPRESSFILEUPLOAD-595969](https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969) | **546/1000** **Why?** Mature exploit, CVSS 7.5 | Proof of Concept
(*) Note that the real score may have changed since the PR was raised.
Release notes Package name: express-fileupload
This PR was automatically created by Snyk using the credentials of a real user.
Snyk has created this PR to upgrade express-fileupload from 1.1.7-alpha.4 to 1.4.0.
:information_source: Keep your dependencies up-to-date. This makes it easier to fix existing vulnerabilities and to more quickly identify and fix newly disclosed vulnerabilities when they affect your project.- The recommended version is **8 versions** ahead of your current version. - The recommended version was released **a year ago**, on 2022-05-24. The recommended version fixes: Severity | Issue | PriorityScore (*) | Exploit Maturity | :-------------------------:|:-------------------------|-------------------------|:-------------------------
[SNYK-JS-DICER-2311764](https://snyk.io/vuln/SNYK-JS-DICER-2311764) | **546/1000**
**Why?** Mature exploit, CVSS 7.5 | Mature
[SNYK-JS-EXPRESSFILEUPLOAD-595969](https://snyk.io/vuln/SNYK-JS-EXPRESSFILEUPLOAD-595969) | **546/1000**
**Why?** Mature exploit, CVSS 7.5 | Proof of Concept (*) Note that the real score may have changed since the PR was raised.
Release notes
Package name: express-fileupload
What's Changed
New Contributors
Full Changelog: v1.3.1...v1.4.0
Updates
1.3.0
processNested
(#291)#241 Cleanup temporary files - @ nusu
Additional prototype-pollution security fix when using
processNested
(#239)Second prototype pollution security vulnerability fix when using
processNested
(#236)Fixed prototype pollution security vulnerability when using
processNested
(#236)Fixes:
Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open upgrade PRs.
For more information:![](https://api.segment.io/v1/pixel/track?data=eyJ3cml0ZUtleSI6InJyWmxZcEdHY2RyTHZsb0lYd0dUcVg4WkFRTnNCOUEwIiwiYW5vbnltb3VzSWQiOiJiNGQ5MWIxYi0wNmU2LTQxMTgtYjNiZi0xN2UyY2M3ZTc0NTYiLCJldmVudCI6IlBSIHZpZXdlZCIsInByb3BlcnRpZXMiOnsicHJJZCI6ImI0ZDkxYjFiLTA2ZTYtNDExOC1iM2JmLTE3ZTJjYzdlNzQ1NiJ9fQ==)
π§ View latest project report
π Adjust upgrade PR settings
π Ignore this dependency or unsubscribe from future upgrade PRs