Open mend-bolt-for-github[bot] opened 2 years ago
moment-timezone-0.5.33.tgz
Parse and display moments in any timezone.
Library home page: https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.33.tgz
Path to dependency file: /open-offsets-directory/node-server/package.json
Path to vulnerable library: /open-offsets-directory/node-server/node_modules/moment-timezone/package.json
Dependency Hierarchy: - sequelize-6.6.5.tgz (Root Library) - :x: **moment-timezone-0.5.33.tgz** (Vulnerable Library)
Library home page: https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.32.tgz
Path to dependency file: /utility-emissions-channel/typescript_app/package.json
Path to vulnerable library: /utility-emissions-channel/typescript_app/node_modules/moment-timezone/package.json
Dependency Hierarchy: - serverless-s3-local-0.6.7.tgz (Root Library) - serverless-offline-6.8.0.tgz - node-schedule-1.3.2.tgz - cron-parser-2.18.0.tgz - :x: **moment-timezone-0.5.32.tgz** (Vulnerable Library)
Found in HEAD commit: d388e16464e00b9ce84df0d247029f534a429b90
Found in base branch: main
Command Injection in moment-timezone before 0.5.35.
Publish Date: 2022-08-30
URL: WS-2022-0280
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-56x4-j7p9-fcf9
Release Date: 2022-08-30
Fix Resolution (moment-timezone): 0.5.35
Direct dependency fix Resolution (sequelize): 6.7.0
Direct dependency fix Resolution (serverless-s3-local): 0.6.8
Step up your Open Source Security Game with Mend here
WS-2022-0280 - Critical Severity Vulnerability
moment-timezone-0.5.33.tgz
Parse and display moments in any timezone.
Library home page: https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.33.tgz
Path to dependency file: /open-offsets-directory/node-server/package.json
Path to vulnerable library: /open-offsets-directory/node-server/node_modules/moment-timezone/package.json
Dependency Hierarchy: - sequelize-6.6.5.tgz (Root Library) - :x: **moment-timezone-0.5.33.tgz** (Vulnerable Library)
moment-timezone-0.5.32.tgz
Parse and display moments in any timezone.
Library home page: https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.32.tgz
Path to dependency file: /utility-emissions-channel/typescript_app/package.json
Path to vulnerable library: /utility-emissions-channel/typescript_app/node_modules/moment-timezone/package.json
Dependency Hierarchy: - serverless-s3-local-0.6.7.tgz (Root Library) - serverless-offline-6.8.0.tgz - node-schedule-1.3.2.tgz - cron-parser-2.18.0.tgz - :x: **moment-timezone-0.5.32.tgz** (Vulnerable Library)
Found in HEAD commit: d388e16464e00b9ce84df0d247029f534a429b90
Found in base branch: main
Command Injection in moment-timezone before 0.5.35.
Publish Date: 2022-08-30
URL: WS-2022-0280
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here.Type: Upgrade version
Origin: https://github.com/advisories/GHSA-56x4-j7p9-fcf9
Release Date: 2022-08-30
Fix Resolution (moment-timezone): 0.5.35
Direct dependency fix Resolution (sequelize): 6.7.0
Fix Resolution (moment-timezone): 0.5.35
Direct dependency fix Resolution (serverless-s3-local): 0.6.8
Step up your Open Source Security Game with Mend here