*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
Partial details (18 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
### Suggested Fix
Type: Upgrade version
Release Date: 2021-01-22
Fix Resolution (ejs): 3.1.6
Direct dependency fix Resolution (@wordpress/scripts): 13.0.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-37601
### Vulnerable Library - loader-utils-1.2.3.tgz
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-29078
### Vulnerable Library - ejs-2.7.1.tgz
The ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Direct dependency fix Resolution (@wordpress/scripts): 13.0.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-44906
### Vulnerable Library - minimist-1.1.3.tgz
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-26707
### Vulnerable Library - merge-deep-3.0.2.tgz
The merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-45133
### Vulnerable Library - traverse-7.6.0.tgz
The Babel Traverse module maintains the overall tree state, and is responsible for replacing, removing, and adding nodes
Babel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-48949
### Vulnerable Library - elliptic-6.5.1.tgz
The verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-33883
### Vulnerable Library - ejs-2.7.1.tgz
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-7660
### Vulnerable Library - serialize-javascript-1.9.1.tgz
Serialize JavaScript to a superset of JSON that includes regular expressions and functions.
Direct dependency fix Resolution (@wordpress/scripts): 5.1.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-36604
### Vulnerable Library - hoek-8.2.4.tgz
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
For more information on CVSS3 Scores, click here.
### Suggested Fix
Type: Upgrade version
Release Date: 2022-09-23
Fix Resolution (@hapi/hoek): 8.5.1
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2019-20920
### Vulnerable Library - handlebars-4.4.2.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-43138
### Vulnerable Library - async-2.6.3.tgz
Higher-order functions and common patterns for asynchronous code
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-13822
### Vulnerable Library - elliptic-6.5.1.tgz
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: Low
For more information on CVSS3 Scores, click here.
### Suggested Fix
Type: Upgrade version
Release Date: 2020-06-04
Fix Resolution (elliptic): 6.5.3
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2020-0450
### Vulnerable Library - handlebars-4.4.2.tgz
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Handlebars before 4.6.0 vulnerable to Prototype Pollution. Prototype access to the template engine allows for potential code execution, which may lead to Denial Of Service (DoS).
For more information on CVSS3 Scores, click here.
### Suggested Fix
Type: Upgrade version
Release Date: 2020-01-09
Fix Resolution (handlebars): 4.6.0
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2020-0042
### Vulnerable Libraries - acorn-6.3.0.tgz, acorn-7.0.0.tgz, acorn-5.7.3.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/acorn-globals/node_modules/acorn/package.json,/ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/webpack-bundle-analyzer/node_modules/acorn/package.json
acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Fix Resolution (acorn): 6.4.1
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Fix Resolution (acorn): 6.4.1
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2019-0310
### Vulnerable Library - https-proxy-agent-2.2.2.tgz
An HTTP(s) proxy `http.Agent` implementation for HTTPS
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-45590
### Vulnerable Library - body-parser-1.19.0.tgz
body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-45296
### Vulnerable Library - path-to-regexp-0.1.7.tgz
path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/elliptic/package.json
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Vulnerabilities
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.
**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation
Details
WS-2021-0153
### Vulnerable Library - ejs-2.7.1.tgzEmbedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.1.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/ejs/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - webpack-bundle-analyzer-3.5.0.tgz - :x: **ejs-2.7.1.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsArbitrary Code Injection vulnerability was found in ejs before 3.1.6. Caused by filename which isn't sanitized for display.
Publish Date: 2021-01-22
URL: WS-2021-0153
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2021-01-22
Fix Resolution (ejs): 3.1.6
Direct dependency fix Resolution (@wordpress/scripts): 13.0.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-37601
### Vulnerable Library - loader-utils-1.2.3.tgzutils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/loader-utils/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - thread-loader-2.1.3.tgz - :x: **loader-utils-1.2.3.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsPrototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils via the name variable in parseQuery.js. This affects all versions prior to 1.4.1 and 2.0.3.
Publish Date: 2022-10-12
URL: CVE-2022-37601
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-76p3-8jx3-jpfq
Release Date: 2022-10-12
Fix Resolution (loader-utils): 1.4.1
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2022-29078
### Vulnerable Library - ejs-2.7.1.tgzEmbedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.1.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/ejs/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - webpack-bundle-analyzer-3.5.0.tgz - :x: **ejs-2.7.1.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsThe ejs (aka Embedded JavaScript templates) package 3.1.6 for Node.js allows server-side template injection in settings[view options][outputFunctionName]. This is parsed as an internal option, and overwrites the outputFunctionName option with an arbitrary OS command (which is executed upon template compilation).
Publish Date: 2022-04-25
URL: CVE-2022-29078
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29078~
Release Date: 2022-04-25
Fix Resolution (ejs): 3.1.7
Direct dependency fix Resolution (@wordpress/scripts): 13.0.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-44906
### Vulnerable Library - minimist-1.1.3.tgzparse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.1.3.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/gonzales-pe/node_modules/minimist/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - stylelint-9.10.1.tgz - postcss-sass-0.3.5.tgz - gonzales-pe-4.2.4.tgz - :x: **minimist-1.1.3.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsMinimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-xvch-5gv4-984h
Release Date: 2022-03-17
Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-26707
### Vulnerable Library - merge-deep-3.0.2.tgzRecursively merge values in a javascript object.
Library home page: https://registry.npmjs.org/merge-deep/-/merge-deep-3.0.2.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/merge-deep/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - jest-puppeteer-4.3.0.tgz - jest-environment-puppeteer-4.3.0.tgz - :x: **merge-deep-3.0.2.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsThe merge-deep library before 3.0.3 for Node.js can be tricked into overwriting properties of Object.prototype or adding new properties to it. These properties are then inherited by every object in the program, thus facilitating prototype-pollution attacks against applications using this library.
Publish Date: 2021-06-02
URL: CVE-2021-26707
### CVSS 3 Score Details (9.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1922259
Release Date: 2021-06-02
Fix Resolution (merge-deep): 3.0.3
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2023-45133
### Vulnerable Library - traverse-7.6.0.tgzThe Babel Traverse module maintains the overall tree state, and is responsible for replacing, removing, and adding nodes
Library home page: https://registry.npmjs.org/@babel/traverse/-/traverse-7.6.0.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/@babel/traverse/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - eslint-plugin-3.1.0.tgz - babel-eslint-10.0.3.tgz - :x: **traverse-7.6.0.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsBabel is a compiler for writingJavaScript. In `@babel/traverse` prior to versions 7.23.2 and 8.0.0-alpha.4 and all versions of `babel-traverse`, using Babel to compile code that was specifically crafted by an attacker can lead to arbitrary code execution during compilation, when using plugins that rely on the `path.evaluate()`or `path.evaluateTruthy()` internal Babel methods. Known affected plugins are `@babel/plugin-transform-runtime`; `@babel/preset-env` when using its `useBuiltIns` option; and any "polyfill provider" plugin that depends on `@babel/helper-define-polyfill-provider`, such as `babel-plugin-polyfill-corejs3`, `babel-plugin-polyfill-corejs2`, `babel-plugin-polyfill-es-shims`, `babel-plugin-polyfill-regenerator`. No other plugins under the `@babel/` namespace are impacted, but third-party plugins might be. Users that only compile trusted code are not impacted. The vulnerability has been fixed in `@babel/traverse@7.23.2` and `@babel/traverse@8.0.0-alpha.4`. Those who cannot upgrade `@babel/traverse` and are using one of the affected packages mentioned above should upgrade them to their latest version to avoid triggering the vulnerable code path in affected `@babel/traverse` versions: `@babel/plugin-transform-runtime` v7.23.2, `@babel/preset-env` v7.23.2, `@babel/helper-define-polyfill-provider` v0.4.3, `babel-plugin-polyfill-corejs2` v0.4.6, `babel-plugin-polyfill-corejs3` v0.8.5, `babel-plugin-polyfill-es-shims` v0.10.0, `babel-plugin-polyfill-regenerator` v0.5.3.
Publish Date: 2023-10-12
URL: CVE-2023-45133
### CVSS 3 Score Details (9.3)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/babel/babel/security/advisories/GHSA-67hx-6x53-jw92
Release Date: 2023-10-12
Fix Resolution (@babel/traverse): 7.23.2
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-48949
### Vulnerable Library - elliptic-6.5.1.tgzEC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.1.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/elliptic/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - webpack-4.8.3.tgz - node-libs-browser-2.2.1.tgz - crypto-browserify-3.12.0.tgz - create-ecdh-4.0.3.tgz - :x: **elliptic-6.5.1.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsThe verify function in lib/elliptic/eddsa/index.js in the Elliptic package before 6.5.6 for Node.js omits "sig.S().gte(sig.eddsa.curve.n) || sig.S().isNeg()" validation.
Publish Date: 2024-10-10
URL: CVE-2024-48949
### CVSS 3 Score Details (9.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-48949
Release Date: 2024-10-10
Fix Resolution (elliptic): 6.5.6
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-33883
### Vulnerable Library - ejs-2.7.1.tgzEmbedded JavaScript templates
Library home page: https://registry.npmjs.org/ejs/-/ejs-2.7.1.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/ejs/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - webpack-bundle-analyzer-3.5.0.tgz - :x: **ejs-2.7.1.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsThe ejs (aka Embedded JavaScript templates) package before 3.1.10 for Node.js lacks certain pollution protection.
Publish Date: 2024-04-28
URL: CVE-2024-33883
### CVSS 3 Score Details (8.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2024-33883
Release Date: 2024-04-28
Fix Resolution: ejs - 3.1.10
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-7660
### Vulnerable Library - serialize-javascript-1.9.1.tgzSerialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.9.1.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/serialize-javascript/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - webpack-4.8.3.tgz - uglifyjs-webpack-plugin-1.3.0.tgz - :x: **serialize-javascript-1.9.1.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability Detailsserialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Publish Date: 2020-06-01
URL: CVE-2020-7660
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660
Release Date: 2020-06-01
Fix Resolution (serialize-javascript): 3.1.0
Direct dependency fix Resolution (@wordpress/scripts): 5.1.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-36604
### Vulnerable Library - hoek-8.2.4.tgzGeneral purpose node utilities
Library home page: https://registry.npmjs.org/@hapi/hoek/-/hoek-8.2.4.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/@hapi/hoek/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - jest-puppeteer-4.3.0.tgz - jest-environment-puppeteer-4.3.0.tgz - jest-dev-server-4.3.0.tgz - wait-on-3.3.0.tgz - joi-15.1.1.tgz - :x: **hoek-8.2.4.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability Detailshoek before 8.5.1 and 9.x before 9.0.3 allows prototype poisoning in the clone function.
Publish Date: 2022-09-23
URL: CVE-2020-36604
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2022-09-23
Fix Resolution (@hapi/hoek): 8.5.1
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2019-20920
### Vulnerable Library - handlebars-4.4.2.tgzHandlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.4.2.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/handlebars/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - jest-24.9.0.tgz - jest-cli-24.9.0.tgz - core-24.9.0.tgz - reporters-24.9.0.tgz - istanbul-reports-2.2.6.tgz - :x: **handlebars-4.4.2.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsHandlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).
Publish Date: 2020-09-30
URL: CVE-2019-20920
### CVSS 3 Score Details (8.1)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Changed - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.npmjs.com/advisories/1316
Release Date: 2020-09-30
Fix Resolution (handlebars): 4.5.3
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2021-43138
### Vulnerable Library - async-2.6.3.tgzHigher-order functions and common patterns for asynchronous code
Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/async/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - source-map-loader-0.2.4.tgz - :x: **async-2.6.3.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsIn Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
Publish Date: 2022-04-06
URL: CVE-2021-43138
### CVSS 3 Score Details (7.8)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138
Release Date: 2022-04-06
Fix Resolution (async): 2.6.4
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2020-13822
### Vulnerable Library - elliptic-6.5.1.tgzEC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.1.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/elliptic/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - webpack-4.8.3.tgz - node-libs-browser-2.2.1.tgz - crypto-browserify-3.12.0.tgz - create-ecdh-4.0.3.tgz - :x: **elliptic-6.5.1.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsThe Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Publish Date: 2020-06-04
URL: CVE-2020-13822
### CVSS 3 Score Details (7.7)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: Low
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-06-04
Fix Resolution (elliptic): 6.5.3
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2020-0450
### Vulnerable Library - handlebars-4.4.2.tgzHandlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.4.2.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/handlebars/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - jest-24.9.0.tgz - jest-cli-24.9.0.tgz - core-24.9.0.tgz - reporters-24.9.0.tgz - istanbul-reports-2.2.6.tgz - :x: **handlebars-4.4.2.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability DetailsHandlebars before 4.6.0 vulnerable to Prototype Pollution. Prototype access to the template engine allows for potential code execution, which may lead to Denial Of Service (DoS).
Publish Date: 2020-01-09
URL: WS-2020-0450
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Release Date: 2020-01-09
Fix Resolution (handlebars): 4.6.0
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2020-0042
### Vulnerable Libraries - acorn-6.3.0.tgz, acorn-7.0.0.tgz, acorn-5.7.3.tgz### acorn-6.3.0.tgz
ECMAScript parser
Library home page: https://registry.npmjs.org/acorn/-/acorn-6.3.0.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/acorn-globals/node_modules/acorn/package.json,/ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/webpack-bundle-analyzer/node_modules/acorn/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - jest-24.9.0.tgz - jest-cli-24.9.0.tgz - jest-config-24.9.0.tgz - jest-environment-jsdom-24.9.0.tgz - jsdom-11.12.0.tgz - acorn-globals-4.3.4.tgz - :x: **acorn-6.3.0.tgz** (Vulnerable Library) ### acorn-7.0.0.tgz
ECMAScript parser
Library home page: https://registry.npmjs.org/acorn/-/acorn-7.0.0.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/espree/node_modules/acorn/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - eslint-6.4.0.tgz - espree-6.1.1.tgz - :x: **acorn-7.0.0.tgz** (Vulnerable Library) ### acorn-5.7.3.tgz
ECMAScript parser
Library home page: https://registry.npmjs.org/acorn/-/acorn-5.7.3.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/acorn/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - webpack-4.8.3.tgz - :x: **acorn-5.7.3.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability Detailsacorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.
Publish Date: 2020-03-01
URL: WS-2020-0042
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/advisories/GHSA-6chw-6frg-f759
Release Date: 2020-03-01
Fix Resolution (acorn): 6.4.1
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Fix Resolution (acorn): 6.4.1
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Fix Resolution (acorn): 6.4.1
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
WS-2019-0310
### Vulnerable Library - https-proxy-agent-2.2.2.tgzAn HTTP(s) proxy `http.Agent` implementation for HTTPS
Library home page: https://registry.npmjs.org/https-proxy-agent/-/https-proxy-agent-2.2.2.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/https-proxy-agent/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - puppeteer-1.20.0.tgz - :x: **https-proxy-agent-2.2.2.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability Details"in 'https-proxy-agent', before v2.2.3, there is a failure of TLS enforcement on the socket. Attacker may intercept unencrypted communications.
Publish Date: 2019-10-07
URL: WS-2019-0310
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://www.npmjs.com/advisories/1184
Release Date: 2019-10-07
Fix Resolution (https-proxy-agent): 2.2.3
Direct dependency fix Resolution (@wordpress/scripts): 5.0.1
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-45590
### Vulnerable Library - body-parser-1.19.0.tgzNode.js body parsing middleware
Library home page: https://registry.npmjs.org/body-parser/-/body-parser-1.19.0.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/body-parser/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - webpack-bundle-analyzer-3.5.0.tgz - express-4.17.1.tgz - :x: **body-parser-1.19.0.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability Detailsbody-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.
Publish Date: 2024-09-10
URL: CVE-2024-45590
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/expressjs/body-parser/security/advisories/GHSA-qwcr-r2fm-qrc7
Release Date: 2024-09-10
Fix Resolution: body-parser - 1.20.3
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)
CVE-2024-45296
### Vulnerable Library - path-to-regexp-0.1.7.tgzExpress style path to RegExp utility
Library home page: https://registry.npmjs.org/path-to-regexp/-/path-to-regexp-0.1.7.tgz
Path to dependency file: /ctf-spring2022/www/wp-content/themes/twentytwenty/package.json
Path to vulnerable library: /ctf-spring2022/www/wp-content/themes/twentytwenty/node_modules/path-to-regexp/package.json
Dependency Hierarchy: - scripts-5.0.0.tgz (Root Library) - webpack-bundle-analyzer-3.5.0.tgz - express-4.17.1.tgz - :x: **path-to-regexp-0.1.7.tgz** (Vulnerable Library)
Found in HEAD commit: 7f949f4f48089e4e1ea7eb0b2482120d3327d7c4
Found in base branch: master
### Vulnerability Detailspath-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.
Publish Date: 2024-09-09
URL: CVE-2024-45296
### CVSS 3 Score Details (7.5)Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. ### Suggested FixType: Upgrade version
Origin: https://github.com/pillarjs/path-to-regexp/security/advisories/GHSA-9wv6-86v2-598j
Release Date: 2024-09-09
Fix Resolution (path-to-regexp): 0.1.10
Direct dependency fix Resolution (@wordpress/scripts): 13.0.0
Step up your Open Source Security Game with Mend [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)