search

uriel-naor / ISSUES

0 stars 0 forks source link

tap-11.1.5.tgz: 20 vulnerabilities (highest severity is: 9.8) - autoclosed #25

Closed uriel-mend-app[bot] closed 1 year ago

uriel-mend-app[bot] commented 1 year ago
Vulnerable Library - tap-11.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Mend has checked all newer package trees, and you are on the least vulnerable package!

Please note: There might be a version that explicitly solves one or more of the vulnerabilities listed below, but we do not recommend it. For more info about the optional fixes, check the section “Details” below.

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (tap version) Fix PR available
CVE-2019-19919 High 9.8 handlebars-4.0.11.tgz Transitive N/A* ❌
CVE-2019-10747 High 9.8 detected in multiple dependencies Transitive N/A* ❌
CVE-2019-10746 High 9.8 mixin-deep-1.3.1.tgz Transitive N/A* ❌
CVE-2019-10744 High 9.1 lodash-4.17.10.tgz Transitive N/A* ❌
WS-2019-0333 High 8.1 handlebars-4.0.11.tgz Transitive N/A* ❌
WS-2019-0064 High 8.0 handlebars-4.0.11.tgz Transitive N/A* ❌
CVE-2019-20922 High 7.5 handlebars-4.0.11.tgz Transitive N/A* ❌
CVE-2019-20149 High 7.5 kind-of-6.0.2.tgz Transitive N/A* ❌
WS-2019-0318 High 7.5 handlebars-4.0.11.tgz Transitive N/A* ❌
WS-2019-0492 High 7.5 handlebars-4.0.11.tgz Transitive N/A* ❌
WS-2019-0493 High 7.5 handlebars-4.0.11.tgz Transitive N/A* ❌
WS-2018-0590 High 7.0 diff-1.4.0.tgz Transitive N/A* ❌
CVE-2019-1010266 Medium 6.5 lodash-4.17.10.tgz Transitive N/A* ❌
CVE-2020-7598 Medium 5.6 minimist-0.0.8.tgz Transitive N/A* ❌
CVE-2018-16487 Medium 5.6 lodash-4.17.10.tgz Transitive N/A* ❌
WS-2019-0103 Medium 5.5 handlebars-4.0.11.tgz Transitive N/A* ❌
CVE-2020-7608 Medium 5.3 detected in multiple dependencies Transitive N/A* ❌
WS-2019-0307 Medium 5.0 mem-1.1.0.tgz Transitive N/A* ❌
WS-2019-0332 Medium 5.0 handlebars-4.0.11.tgz Transitive N/A* ❌
WS-2019-0331 Medium 5.0 handlebars-4.0.11.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2019-19919 ### Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-reports-1.4.0.tgz - :x: **handlebars-4.0.11.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's __proto__ and __defineGetter__ properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Publish Date: 2019-12-20

URL: CVE-2019-19919

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1164

Release Date: 2019-12-20

Fix Resolution: 4.3.0

CVE-2019-10747 ### Vulnerable Libraries - set-value-0.4.3.tgz, set-value-2.0.0.tgz

### set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/union-value/node_modules/set-value/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - micromatch-3.1.10.tgz - snapdragon-0.8.2.tgz - base-0.11.2.tgz - cache-base-1.0.1.tgz - union-value-1.0.0.tgz - :x: **set-value-0.4.3.tgz** (Vulnerable Library) ### set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/set-value/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - micromatch-3.1.10.tgz - snapdragon-0.8.2.tgz - base-0.11.2.tgz - cache-base-1.0.1.tgz - :x: **set-value-2.0.0.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and _proto_ payloads.

Publish Date: 2019-08-23

URL: CVE-2019-10747

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2019-07-24

Fix Resolution: 2.0.1,3.0.1

CVE-2019-10746 ### Vulnerable Library - mixin-deep-1.3.1.tgz

Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.

Library home page: https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/mixin-deep/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - micromatch-3.1.10.tgz - snapdragon-0.8.2.tgz - base-0.11.2.tgz - :x: **mixin-deep-1.3.1.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-08-23

URL: CVE-2019-10746

### CVSS 3 Score Details (9.8)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Release Date: 2019-07-11

Fix Resolution: 1.3.2,2.0.1

CVE-2019-10744 ### Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-lib-instrument-1.10.1.tgz - babel-types-6.26.0.tgz - :x: **lodash-4.17.10.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

### CVSS 3 Score Details (9.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://github.com/advisories/GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0

WS-2019-0333 ### Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-reports-1.4.0.tgz - :x: **handlebars-4.0.11.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

In handlebars, versions prior to v4.5.3 are vulnerable to prototype pollution. Using a malicious template it's possbile to add or modify properties to the Object prototype. This can also lead to DOS and RCE in certain conditions.

Publish Date: 2019-11-18

URL: WS-2019-0333

### CVSS 3 Score Details (8.1)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1325

Release Date: 2019-11-18

Fix Resolution: handlebars - 4.5.3

WS-2019-0064 ### Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-reports-1.4.0.tgz - :x: **handlebars-4.0.11.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.

Publish Date: 2019-01-30

URL: WS-2019-0064

### CVSS 2 Score Details (8.0)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/755/versions

Release Date: 2019-04-30

Fix Resolution: 1.0.6-2,4.0.14,4.1.2

CVE-2019-20922 ### Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-reports-1.4.0.tgz - :x: **handlebars-4.0.11.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.

Publish Date: 2020-09-30

URL: CVE-2019-20922

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1300

Release Date: 2020-09-30

Fix Resolution: handlebars - 4.4.5

CVE-2019-20149 ### Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/base/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/extglob/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/use/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/nanomatch/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/define-property/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/snapdragon-node/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/test-exclude/node_modules/kind-of/package.json,/node_modules/nyc/node_modules/micromatch/node_modules/kind-of/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - test-exclude-4.2.1.tgz - micromatch-3.1.10.tgz - :x: **kind-of-6.0.2.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: High - Availability Impact: None

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149

Release Date: 2019-12-30

Fix Resolution: 6.0.3

WS-2019-0318 ### Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-reports-1.4.0.tgz - :x: **handlebars-4.0.11.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

In "showdownjs/showdown", versions prior to v4.4.5 are vulnerable against Regular expression Denial of Service (ReDOS) once receiving specially-crafted templates.

Publish Date: 2019-10-20

URL: WS-2019-0318

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1300

Release Date: 2019-10-20

Fix Resolution: handlebars - 4.4.5

WS-2019-0492 ### Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-reports-1.4.0.tgz - :x: **handlebars-4.0.11.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.

Publish Date: 2019-11-19

URL: WS-2019-0492

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1324

Release Date: 2019-11-19

Fix Resolution: handlebars - 3.0.8,4.5.3

WS-2019-0493 ### Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-reports-1.4.0.tgz - :x: **handlebars-4.0.11.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

handlebars before 3.0.8 and 4.x before 4.5.2 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.

Publish Date: 2019-11-14

URL: WS-2019-0493

### CVSS 3 Score Details (7.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1316

Release Date: 2019-11-14

Fix Resolution: handlebars - 3.0.8,4.5.2

WS-2018-0590 ### Vulnerable Library - diff-1.4.0.tgz

A javascript text diff implementation.

Library home page: https://registry.npmjs.org/diff/-/diff-1.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/diff/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - tap-mocha-reporter-3.0.9.tgz - :x: **diff-1.4.0.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

A vulnerability was found in diff before v3.5.0, the affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS) attacks.

Publish Date: 2018-03-05

URL: WS-2018-0590

### CVSS 2 Score Details (7.0)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Release Date: 2018-03-05

Fix Resolution: 3.5.0

CVE-2019-1010266 ### Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-lib-instrument-1.10.1.tgz - babel-types-6.26.0.tgz - :x: **lodash-4.17.10.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-18

URL: CVE-2019-1010266

### CVSS 3 Score Details (6.5)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-18

Fix Resolution: 4.17.11

CVE-2020-7598 ### Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/minimist/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - mkdirp-0.5.1.tgz - :x: **minimist-0.0.8.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "__proto__" payload.

Publish Date: 2020-03-12

URL: CVE-2020-7598

### CVSS 3 Score Details (5.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2020-7598

Release Date: 2020-03-12

Fix Resolution: Virteom.Tenant.Mobile.Bluetooth.iOS - 0.20.41.103-prerelease;Virteom.Public.Utilities - 0.23.37.212-prerelease;org.webjars:npm - 5.0.0-1;Indianadavy.VueJsWebAPITemplate.CSharp - 1.0.1;NorDroN.AngularTemplate - 0.1.6;Virteom.Tenant.Mobile.Framework - 0.21.29.159-prerelease;Virteom.Tenant.Mobile.Bluetooth.Android - 0.20.41.103-prerelease;z4a-dotnet-scaffold - 1.0.0.2;Raml.Parser - 2.0.0;ApiExplorer.HelpPage - 1.0.0-alpha3;CoreVueWebTest - 3.0.101;dotnetng.template - 1.0.0.4;SitecoreMaster.TrueDynamicPlaceholders - 1.0.3;Virteom.Tenant.Mobile.Framework.Android - 0.20.41.103-prerelease;Fable.Template.Elmish.React - 0.1.6;BumperLane.Public.Api.Client - 0.23.35.214-prerelease;Yarn.MSBuild - 0.24.6,0.22.0;Bridge.AWS - 0.3.30.36;Nodejs.Redist.x64 - 7.7.3.1,10.3.0;tslint - 5.6.0,6.1.1;org.webjars.npm:bourbon-neat - 2.0.0-beta.2;GR.PageRender.Razor - 1.8.0;MIDIator.WebClient - 1.0.105;EntityFramework.LookupTables - 1.1.14.119;BumperLane.Public.Service.Contracts - 0.23.35.214-prerelease;org.webjars.npm:minimist - 1.2.4;minimist - 1.2.3,0.2.1;Virteom.Tenant.Mobile.Bluetooth - 0.21.29.159-prerelease;ShowingVault.DotNet.Sdk - 0.13.41.190-prerelease;Romano.Vue - 1.0.1;Yarnpkg.Yarn - 0.26.1;Virteom.Tenant.Mobile.Framework.UWP - 0.20.41.103-prerelease;Virteom.Tenant.Mobile.Framework.iOS - 0.20.41.103-prerelease;Chutzpah - 4.4.10;BumperLane.Public.Api.V2.ClientModule - 0.23.35.214-prerelease;VueJS.NetCore - 1.1.1;Dianoga - 5.0.0-beta.1

CVE-2018-16487 ### Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/lodash/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-lib-instrument-1.10.1.tgz - babel-types-6.26.0.tgz - :x: **lodash-4.17.10.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

### CVSS 3 Score Details (5.6)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11

WS-2019-0103 ### Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-reports-1.4.0.tgz - :x: **handlebars-4.0.11.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

Handlebars.js before 4.1.0 has Remote Code Execution (RCE)

Publish Date: 2019-01-30

URL: WS-2019-0103

### CVSS 2 Score Details (5.5)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Release Date: 2019-05-30

Fix Resolution: 4.1.0

CVE-2020-7608 ### Vulnerable Libraries - yargs-parser-8.1.0.tgz, yargs-parser-9.0.2.tgz

### yargs-parser-8.1.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-8.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/yargs-parser/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - :x: **yargs-parser-8.1.0.tgz** (Vulnerable Library) ### yargs-parser-9.0.2.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-9.0.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/yargs/node_modules/yargs-parser/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - yargs-11.1.0.tgz - :x: **yargs-parser-9.0.2.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "__proto__" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

### CVSS 3 Score Details (5.3)

Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low

For more information on CVSS3 Scores, click here.

### Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7608

Release Date: 2020-03-16

Fix Resolution: v18.1.1;13.1.2;15.0.1

WS-2019-0307 ### Vulnerable Library - mem-1.1.0.tgz

Memoize functions - An optimization used to speed up consecutive function calls by caching the result of calls with identical input

Library home page: https://registry.npmjs.org/mem/-/mem-1.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/mem/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - yargs-11.1.0.tgz - os-locale-2.1.0.tgz - :x: **mem-1.1.0.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

Denial of Service (DoS) vulnerability found in mem before 4.0.0. There is a failure in removal of old values from the cache. As a result, attacker may exhaust the system's memory.

Publish Date: 2018-08-27

URL: WS-2019-0307

### CVSS 2 Score Details (5.0)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1084

Release Date: 2019-12-01

Fix Resolution: mem - 4.0.0

WS-2019-0332 ### Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-reports-1.4.0.tgz - :x: **handlebars-4.0.11.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

Arbitrary Code Execution vulnerability found in handlebars before 4.5.3. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.It is due to an incomplete fix for a WS-2019-0331.

Publish Date: 2019-11-17

URL: WS-2019-0332

### CVSS 2 Score Details (5.0)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1324

Release Date: 2019-11-17

Fix Resolution: handlebars - 4.5.3

WS-2019-0331 ### Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/nyc/node_modules/handlebars/package.json

Dependency Hierarchy: - tap-11.1.5.tgz (Root Library) - nyc-11.9.0.tgz - istanbul-reports-1.4.0.tgz - :x: **handlebars-4.0.11.tgz** (Vulnerable Library)

Found in HEAD commit: 94f729510068f5d8203d19d5a1c9c50f8f631e8d

Found in base branch: main

### Vulnerability Details

Arbitrary Code Execution vulnerability found in handlebars before 4.5.2. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.

Publish Date: 2019-11-13

URL: WS-2019-0331

### CVSS 2 Score Details (5.0)

Base Score Metrics not available

### Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1316

Release Date: 2019-11-13

Fix Resolution: handlebars - 4.5.2

uriel-mend-app[bot] commented 1 year ago

:heavy_check_mark: This issue was automatically closed by Mend because the vulnerable library in the specific branch(es) was either marked as ignored or it is no longer part of the Mend inventory.