Giter Club home page Giter Club logo

empirequal's Introduction

EmpirEqual

Running

# fetch deps, transpile typescript, and transpile react front end
make build

# run backend / frontend locally
make run

# deploy to server
make publish
curl -H 'Content-Type: application/json' \
    -d '{ "fullname": "alex", "password": "test", "age": "35", "description": "gwm", "email": "[email protected]" }' \
    -X POST http://localhost:7000/users

curl -H 'Content-Type: application/json' \
    -d '{ "question": "How are you?" }' \
    -X POST http://localhost:7000/meetingquestions

curl -X GET http://localhost:7000/meetingquestions

[{"_id":"a768e519-b287-464f-b994-68da2b50fa2a","question":"How are you?"}]

curl -H 'Content-Type: application/json' \
    -d '{ "userId": "7e3d6e47-57d0-4106-9b05-1e0b46f71bd2", "questionResponses": [ { "questionId": "a768e519-b287-464f-b994-68da2b50fa2a", "responseValue": "good" } ] }' \
    -X POST http://localhost:7000/meetings

curl -X GET http://localhost:7000/meetings
[{"_id":"75495864-abba-464a-84af-b0934b5635d5","userId":"7e3d6e47-57d0-4106-9b05-1e0b46f71bd2","questionResponses":[{"questionId":"a768e519-b287-464f-b994-68da2b50fa2a","responseValue":"good"}]}]

empirequal's People

Contributors

neveroddoreven avatar lnispel avatar javi-aire avatar mend-bolt-for-github[bot] avatar

Stargazers

 avatar

Forkers

neveroddoreven

empirequal's Issues

CVE-2020-7598 (Medium) detected in multiple libraries

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Libraries - minimist-0.0.8.tgz, minimist-0.0.10.tgz, minimist-1.2.0.tgz

minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/node_modules/mkdirp/node_modules/minimist/package.json,/src/node_modules/mkdirp/node_modules/minimist/package.json

Dependency Hierarchy:

  • ts-node-5.0.1.tgz (Root Library)
    • mkdirp-0.5.1.tgz
      • minimist-0.0.8.tgz (Vulnerable Library)
minimist-0.0.10.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/hbs/node_modules/minimist/package.json,/src/frontend/node_modules/hbs/node_modules/minimist/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz
      • optimist-0.6.1.tgz
        • minimist-0.0.10.tgz (Vulnerable Library)
minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/node_modules/tsconfig-paths/node_modules/minimist/package.json,/src/node_modules/tsconfig-paths/node_modules/minimist/package.json

Dependency Hierarchy:

  • tsconfig-paths-3.3.2.tgz (Root Library)
    • minimist-1.2.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-11

Fix Resolution (minimist): 0.2.1

Direct dependency fix Resolution (ts-node): 6.0.0

Fix Resolution (minimist): 0.2.1

Direct dependency fix Resolution (hbs): 4.1.1

Fix Resolution (minimist): 0.2.1

Direct dependency fix Resolution (tsconfig-paths): 3.4.0


Step up your Open Source Security Game with Mend here

CVE-2019-10746 (Critical) detected in mixin-deep-1.3.1.tgz

CVE-2019-10746 - Critical Severity Vulnerability

Vulnerable Library - mixin-deep-1.3.1.tgz

Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.

Library home page: https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/mixin-deep/package.json,/src/frontend/node_modules/react-scripts/node_modules/mixin-deep/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • babel-jest-20.0.3.tgz
      • babel-plugin-istanbul-4.1.6.tgz
        • test-exclude-4.2.1.tgz
          • micromatch-3.1.10.tgz
            • snapdragon-0.8.2.tgz
              • base-0.11.2.tgz
                • mixin-deep-1.3.1.tgz (Vulnerable Library)

Found in HEAD commit: 95570e41b1fabd86612a9a88d0ca4afa85bd659b

Found in base branch: master

Vulnerability Details

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-08-23

URL: CVE-2019-10746

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-08-23

Fix Resolution (mixin-deep): 1.3.2

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

CVE-2019-2391 (Medium) detected in bson-1.0.9.tgz, bson-1.1.1.tgz

CVE-2019-2391 - Medium Severity Vulnerability

Vulnerable Libraries - bson-1.0.9.tgz, bson-1.1.1.tgz

bson-1.0.9.tgz

A bson parser for node.js and the browser

Library home page: https://registry.npmjs.org/bson/-/bson-1.0.9.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/node_modules/bson/package.json

Dependency Hierarchy:

  • mongodb-3.0.10.tgz (Root Library)
    • mongodb-core-3.0.9.tgz
      • bson-1.0.9.tgz (Vulnerable Library)
bson-1.1.1.tgz

A bson parser for node.js and the browser

Library home page: https://registry.npmjs.org/bson/-/bson-1.1.1.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/bson/package.json

Dependency Hierarchy:

  • mongodb-3.2.7.tgz (Root Library)
    • mongodb-core-3.2.7.tgz
      • bson-1.1.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Incorrect parsing of certain JSON input may result in js-bson not correctly serializing BSON. This may cause unexpected application behaviour including data disclosure. This issue affects: MongoDB Inc. js-bson library version 1.1.3 and prior to.

Publish Date: 2020-03-31

URL: CVE-2019-2391

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-2391

Release Date: 2020-03-31

Fix Resolution (bson): 1.1.4

Direct dependency fix Resolution (mongodb): 3.1.3

Fix Resolution (bson): 1.1.4

Direct dependency fix Resolution (mongodb): 3.3.0


Step up your Open Source Security Game with Mend here

WS-2019-0493 (High) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz - autoclosed

WS-2019-0493 - High Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/node_modules/handlebars/package.json,EmpirEqual/src/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Vulnerability Details

handlebars before 3.0.8 and 4.x before 4.5.2 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.

Publish Date: 2019-11-14

URL: WS-2019-0493

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1316

Release Date: 2019-11-14

Fix Resolution: handlebars - 3.0.8,4.5.2


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16469 (High) detected in merge-1.2.0.tgz

CVE-2018-16469 - High Severity Vulnerability

Vulnerable Library - merge-1.2.0.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

Library home page: https://registry.npmjs.org/merge/-/merge-1.2.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/merge/package.json,/src/frontend/node_modules/react-scripts/node_modules/merge/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • jest-haste-map-20.0.5.tgz
          • sane-1.6.0.tgz
            • exec-sh-0.2.1.tgz
              • merge-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Found in base branch: master

Vulnerability Details

The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.

Publish Date: 2018-10-30

URL: CVE-2018-16469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16469

Release Date: 2018-10-30

Fix Resolution (merge): 1.2.1

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

WS-2020-0218 (High) detected in merge-1.2.0.tgz - autoclosed

WS-2020-0218 - High Severity Vulnerability

Vulnerable Library - merge-1.2.0.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

Library home page: https://registry.npmjs.org/merge/-/merge-1.2.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/merge/package.json,EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/merge/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • jest-haste-map-20.0.5.tgz
          • sane-1.6.0.tgz
            • exec-sh-0.2.1.tgz
              • merge-1.2.0.tgz (Vulnerable Library)

Vulnerability Details

A Prototype Pollution vulnerability was found in merge before 2.1.0 via the merge.recursive function. It can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.

Publish Date: 2020-10-09

URL: WS-2020-0218

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: swordev/merge#38

Release Date: 2020-10-09

Fix Resolution: merge - 2.1.0


Step up your Open Source Security Game with WhiteSource here

WS-2019-0047 (Medium) detected in tar-4.4.1.tgz - autoclosed

WS-2019-0047 - Medium Severity Vulnerability

Vulnerable Library - tar-4.4.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.1.tgz

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • fsevents-1.2.4.tgz
      • node-pre-gyp-0.10.0.tgz
        • tar-4.4.1.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Vulnerability Details

Versions of node-tar prior to 4.4.2 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

Publish Date: 2019-04-05

URL: WS-2019-0047

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/803

Release Date: 2019-04-05

Fix Resolution: 4.4.2


Step up your Open Source Security Game with WhiteSource here

CVE-2018-6342 (Critical) detected in react-dev-utils-5.0.1.tgz

CVE-2018-6342 - Critical Severity Vulnerability

Vulnerable Library - react-dev-utils-5.0.1.tgz

Webpack utilities used by Create React App

Library home page: https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-5.0.1.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/react-dev-utils/package.json,/src/frontend/node_modules/react-scripts/node_modules/react-dev-utils/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • react-dev-utils-5.0.1.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Found in base branch: master

Vulnerability Details

react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.

Publish Date: 2018-12-31

URL: CVE-2018-6342

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6342

Release Date: 2018-12-31

Fix Resolution (react-dev-utils): 5.0.2

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

CVE-2020-7608 (Medium) detected in multiple libraries

CVE-2020-7608 - Medium Severity Vulnerability

Vulnerable Libraries - yargs-parser-4.2.1.tgz, yargs-parser-5.0.0.tgz, yargs-parser-7.0.0.tgz

yargs-parser-4.2.1.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-4.2.1.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/webpack-dev-server/node_modules/yargs-parser/package.json,/src/node_modules/webpack-dev-server/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • webpack-dev-server-2.9.4.tgz
      • yargs-6.6.0.tgz
        • yargs-parser-4.2.1.tgz (Vulnerable Library)
yargs-parser-5.0.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-5.0.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/yargs-parser/package.json,/src/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • yargs-7.1.0.tgz
          • yargs-parser-5.0.0.tgz (Vulnerable Library)
yargs-parser-7.0.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-7.0.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/webpack/node_modules/yargs-parser/package.json,/src/frontend/node_modules/react-scripts/node_modules/webpack/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • webpack-3.8.1.tgz
      • yargs-8.0.2.tgz
        • yargs-parser-7.0.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-03-16

Fix Resolution (yargs-parser): 5.0.0-security.0

Direct dependency fix Resolution (react-scripts): 2.0.0

Fix Resolution (yargs-parser): 5.0.0-security.0

Direct dependency fix Resolution (react-scripts): 2.0.0

Fix Resolution (yargs-parser): 5.0.0-security.0

Direct dependency fix Resolution (react-scripts): 2.0.0


Step up your Open Source Security Game with Mend here

CVE-2018-20834 (High) detected in tar-4.4.1.tgz

CVE-2018-20834 - High Severity Vulnerability

Vulnerable Library - tar-4.4.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.1.tgz

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • fsevents-1.2.4.tgz
      • node-pre-gyp-0.10.0.tgz
        • tar-4.4.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).

Publish Date: 2019-04-30

URL: CVE-2018-20834

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16082

Release Date: 2019-04-30

Fix Resolution (tar): 4.4.2

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

CVE-2012-6708 (Medium) detected in jquery-1.7.1.min.js - autoclosed

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/multiplex/index.html

Path to vulnerable library: /EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/multiplex/index.html,/EmpirEqual/src/node_modules/sockjs/examples/echo/index.html,/EmpirEqual/src/node_modules/sockjs/examples/express/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/echo/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/vm-browserify/example/run/index.html,/EmpirEqual/src/node_modules/sockjs/examples/hapi/html/index.html,/EmpirEqual/src/node_modules/sockjs/examples/express-3.x/index.html,/EmpirEqual/src/node_modules/vm-browserify/example/run/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/hapi/html/index.html,/EmpirEqual/src/node_modules/sockjs/examples/multiplex/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 95570e41b1fabd86612a9a88d0ca4afa85bd659b

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0


Step up your Open Source Security Game with WhiteSource here

WS-2019-0331 (Medium) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz - autoclosed

WS-2019-0331 - Medium Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/node_modules/handlebars/package.json,EmpirEqual/src/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Vulnerability Details

Arbitrary Code Execution vulnerability found in handlebars before 4.5.2. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.

Publish Date: 2019-11-13

URL: WS-2019-0331

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1316

Release Date: 2019-12-05

Fix Resolution: handlebars - 4.5.2


Step up your Open Source Security Game with WhiteSource here

WS-2019-0103 (Medium) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

WS-2019-0103 - Medium Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/handlebars/package.json,/src/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 95570e41b1fabd86612a9a88d0ca4afa85bd659b

Found in base branch: master

Vulnerability Details

Handlebars.js before 4.1.0 has Remote Code Execution (RCE)

Publish Date: 2019-01-30

URL: WS-2019-0103

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-01-30

Fix Resolution (handlebars): 4.0.13

Direct dependency fix Resolution (react-scripts): 1.1.5

Fix Resolution (handlebars): 4.0.13

Direct dependency fix Resolution (hbs): 4.0.2


Step up your Open Source Security Game with Mend here

CVE-2021-27515 (Medium) detected in url-parse-1.4.1.tgz

CVE-2021-27515 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.1.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.1.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/url-parse/package.json,/src/frontend/node_modules/react-scripts/node_modules/url-parse/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • react-dev-utils-5.0.1.tgz
      • sockjs-client-1.1.4.tgz
        • url-parse-1.4.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

url-parse before 1.5.0 mishandles certain uses of backslash such as http:/ and interprets the URI as a relative path.

Publish Date: 2021-02-22

URL: CVE-2021-27515

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-27515

Release Date: 2021-02-22

Fix Resolution (url-parse): 1.5.0

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

WS-2019-0291 (High) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz - autoclosed

WS-2019-0291 - High Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /tmp/ws-scm/EmpirEqual/src/frontend/package.json

Path to vulnerable library: /tmp/ws-scm/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /tmp/ws-scm/EmpirEqual/src/package.json

Path to vulnerable library: /tmp/ws-scm/EmpirEqual/src/frontend/node_modules/hbs/node_modules/handlebars/package.json,/tmp/ws-scm/EmpirEqual/src/frontend/node_modules/hbs/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Found in HEAD commit: 95570e41b1fabd86612a9a88d0ca4afa85bd659b

Vulnerability Details

handlebars before 4.3.0 is vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Publish Date: 2019-10-06

URL: WS-2019-0291

CVSS 2 Score Details (7.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1164

Release Date: 2019-10-06

Fix Resolution: 4.3.0


Step up your Open Source Security Game with WhiteSource here

CVE-2019-19919 (Critical) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

CVE-2019-19919 - Critical Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/handlebars/package.json,/src/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Publish Date: 2019-12-20

URL: CVE-2019-19919

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w457-6q6x-cgp9

Release Date: 2019-12-20

Fix Resolution (handlebars): 4.3.0

Direct dependency fix Resolution (react-scripts): 1.1.5

Fix Resolution (handlebars): 4.3.0

Direct dependency fix Resolution (hbs): 4.0.5


Step up your Open Source Security Game with Mend here

WS-2019-0063 (High) detected in js-yaml-3.7.0.tgz, js-yaml-3.12.0.tgz

WS-2019-0063 - High Severity Vulnerability

Vulnerable Libraries - js-yaml-3.7.0.tgz, js-yaml-3.12.0.tgz

js-yaml-3.7.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.7.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/js-yaml/package.json,/src/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • js-yaml-3.7.0.tgz (Vulnerable Library)
js-yaml-3.12.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.12.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/eslint/node_modules/js-yaml/package.json,/src/node_modules/eslint/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • eslint-4.10.0.tgz
      • js-yaml-3.12.0.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Found in base branch: master

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-05

URL: WS-2019-0063

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-05

Fix Resolution (js-yaml): 3.13.1

Direct dependency fix Resolution (react-scripts): 2.0.0

Fix Resolution (js-yaml): 3.13.1

Direct dependency fix Resolution (react-scripts): 2.0.0


Step up your Open Source Security Game with Mend here

CVE-2019-11358 (Medium) detected in jquery-2.1.4.min.js - autoclosed

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Library - jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/EmpirEqual/src/node_modules/js-base64/test/index.html

Path to vulnerable library: /EmpirEqual/src/node_modules/js-base64/test/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/js-base64/test-moment/index.html

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)

Found in HEAD commit: 95570e41b1fabd86612a9a88d0ca4afa85bd659b

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: jquery/jquery@753d591

Release Date: 2019-03-25

Fix Resolution: Replace or update the following files: core.js, core.js


Step up your Open Source Security Game with WhiteSource here

CVE-2019-20149 (High) detected in kind-of-6.0.2.tgz

CVE-2019-20149 - High Severity Vulnerability

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/nanomatch/node_modules/kind-of/package.json,/src/node_modules/nanomatch/node_modules/kind-of/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • babel-jest-20.0.3.tgz
      • babel-plugin-istanbul-4.1.6.tgz
        • test-exclude-4.2.1.tgz
          • micromatch-3.1.10.tgz
            • kind-of-6.0.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149

Release Date: 2019-12-30

Fix Resolution (kind-of): 6.0.3

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

WS-2019-0064 (High) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

WS-2019-0064 - High Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/handlebars/package.json,/src/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Found in base branch: master

Vulnerability Details

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.

Publish Date: 2019-01-30

URL: WS-2019-0064

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/755/

Release Date: 2019-01-30

Fix Resolution (handlebars): 4.0.14

Direct dependency fix Resolution (react-scripts): 1.1.5

Fix Resolution (handlebars): 4.0.14

Direct dependency fix Resolution (hbs): 4.0.4


Step up your Open Source Security Game with Mend here

WS-2020-0042 (High) detected in acorn-5.6.2.tgz

WS-2020-0042 - High Severity Vulnerability

Vulnerable Library - acorn-5.6.2.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-5.6.2.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/node_modules/acorn/package.json,/src/node_modules/acorn/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • webpack-3.8.1.tgz
      • acorn-5.6.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.

Publish Date: 2020-03-01

URL: WS-2020-0042

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6chw-6frg-f759

Release Date: 2020-03-01

Fix Resolution (acorn): 5.7.4

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

CVE-2019-20920 (High) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

CVE-2019-20920 - High Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/handlebars/package.json,/src/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Publish Date: 2020-09-30

URL: CVE-2019-20920

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1316

Release Date: 2020-10-15

Fix Resolution (handlebars): 4.5.3

Direct dependency fix Resolution (react-scripts): 1.1.5

Fix Resolution (handlebars): 4.5.3

Direct dependency fix Resolution (hbs): 4.1.0


Step up your Open Source Security Game with Mend here

WS-2016-0090 (Medium) detected in jquery-2.1.4.min.js, jquery-1.7.1.min.js - autoclosed

WS-2016-0090 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.7.1.min.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/EmpirEqual/src/node_modules/js-base64/test/index.html

Path to vulnerable library: /EmpirEqual/src/node_modules/js-base64/test/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/js-base64/test-moment/index.html

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)
jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/multiplex/index.html

Path to vulnerable library: /EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/multiplex/index.html,/EmpirEqual/src/node_modules/sockjs/examples/echo/index.html,/EmpirEqual/src/node_modules/sockjs/examples/express/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/echo/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/vm-browserify/example/run/index.html,/EmpirEqual/src/node_modules/sockjs/examples/hapi/html/index.html,/EmpirEqual/src/node_modules/sockjs/examples/express-3.x/index.html,/EmpirEqual/src/node_modules/vm-browserify/example/run/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/hapi/html/index.html,/EmpirEqual/src/node_modules/sockjs/examples/multiplex/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 95570e41b1fabd86612a9a88d0ca4afa85bd659b

Vulnerability Details

JQuery, before 2.2.0, is vulnerable to Cross-site Scripting (XSS) attacks via text/javascript response with arbitrary code execution.

Publish Date: 2016-11-27

URL: WS-2016-0090

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jquery/jquery@b078a62

Release Date: 2019-04-08

Fix Resolution: 2.2.0


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3774 (Critical) detected in url-parse-1.4.1.tgz

CVE-2018-3774 - Critical Severity Vulnerability

Vulnerable Library - url-parse-1.4.1.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.1.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/url-parse/package.json,/src/frontend/node_modules/react-scripts/node_modules/url-parse/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • react-dev-utils-5.0.1.tgz
      • sockjs-client-1.1.4.tgz
        • url-parse-1.4.1.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Found in base branch: master

Vulnerability Details

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

Publish Date: 2018-08-12

URL: CVE-2018-3774

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3774

Release Date: 2018-08-12

Fix Resolution (url-parse): 1.4.3

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

CVE-2020-28500 (Medium) detected in lodash-4.17.10.tgz

CVE-2020-28500 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json

Dependency Hierarchy:

  • lodash-4.17.10.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.

Publish Date: 2021-02-15

URL: CVE-2020-28500

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500

Release Date: 2021-02-15

Fix Resolution: 4.17.21


Step up your Open Source Security Game with Mend here

CVE-2020-28499 (Critical) detected in merge-1.2.0.tgz

CVE-2020-28499 - Critical Severity Vulnerability

Vulnerable Library - merge-1.2.0.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

Library home page: https://registry.npmjs.org/merge/-/merge-1.2.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/merge/package.json,/src/frontend/node_modules/react-scripts/node_modules/merge/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • jest-haste-map-20.0.5.tgz
          • sane-1.6.0.tgz
            • exec-sh-0.2.1.tgz
              • merge-1.2.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .

Publish Date: 2021-02-18

URL: CVE-2020-28499

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-02-18

Fix Resolution (merge): 2.1.0

Direct dependency fix Resolution (react-scripts): 3.0.0


Step up your Open Source Security Game with Mend here

WS-2019-0311 (Medium) detected in mongodb-3.0.10.tgz

WS-2019-0311 - Medium Severity Vulnerability

Vulnerable Library - mongodb-3.0.10.tgz

The official MongoDB driver for Node.js

Library home page: https://registry.npmjs.org/mongodb/-/mongodb-3.0.10.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/node_modules/mongodb/package.json

Dependency Hierarchy:

  • mongodb-3.0.10.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In 'node-mongodb-native', versions prior to v3.1.13 are vulnerable against DOS as a result of a potential crash when a collection name is invalid and the DB doesn't exist.

Publish Date: 2019-01-23

URL: WS-2019-0311

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1203

Release Date: 2019-01-23

Fix Resolution: 3.1.13


Step up your Open Source Security Game with Mend here

CVE-2015-9251 (Medium) detected in jquery-2.1.4.min.js, jquery-1.7.1.min.js - autoclosed

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.7.1.min.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/EmpirEqual/src/node_modules/js-base64/test/index.html

Path to vulnerable library: /EmpirEqual/src/node_modules/js-base64/test/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/js-base64/test-moment/index.html

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)
jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/multiplex/index.html

Path to vulnerable library: /EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/multiplex/index.html,/EmpirEqual/src/node_modules/sockjs/examples/echo/index.html,/EmpirEqual/src/node_modules/sockjs/examples/express/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/echo/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/vm-browserify/example/run/index.html,/EmpirEqual/src/node_modules/sockjs/examples/hapi/html/index.html,/EmpirEqual/src/node_modules/sockjs/examples/express-3.x/index.html,/EmpirEqual/src/node_modules/vm-browserify/example/run/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/hapi/html/index.html,/EmpirEqual/src/node_modules/sockjs/examples/multiplex/index.html,/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 95570e41b1fabd86612a9a88d0ca4afa85bd659b

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0


Step up your Open Source Security Game with WhiteSource here

WS-2019-0032 (High) detected in js-yaml-3.7.0.tgz, js-yaml-3.12.0.tgz

WS-2019-0032 - High Severity Vulnerability

Vulnerable Libraries - js-yaml-3.7.0.tgz, js-yaml-3.12.0.tgz

js-yaml-3.7.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.7.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/js-yaml/package.json,/src/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • js-yaml-3.7.0.tgz (Vulnerable Library)
js-yaml-3.12.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.12.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/eslint/node_modules/js-yaml/package.json,/src/node_modules/eslint/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • eslint-4.10.0.tgz
      • js-yaml-3.12.0.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Found in base branch: master

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-20

URL: WS-2019-0032

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-20

Fix Resolution (js-yaml): 3.13.0

Direct dependency fix Resolution (react-scripts): 2.0.0

Fix Resolution (js-yaml): 3.13.0

Direct dependency fix Resolution (react-scripts): 2.0.0


Step up your Open Source Security Game with Mend here

CVE-2020-7693 (Medium) detected in sockjs-0.3.18.tgz

CVE-2020-7693 - Medium Severity Vulnerability

Vulnerable Library - sockjs-0.3.18.tgz

SockJS-node is a server counterpart of SockJS-client a JavaScript library that provides a WebSocket-like object in the browser. SockJS gives you a coherent, cross-browser, Javascript API which creates a low latency, full duplex, cross-domain communication

Library home page: https://registry.npmjs.org/sockjs/-/sockjs-0.3.18.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/sockjs/package.json,/src/frontend/node_modules/react-scripts/node_modules/sockjs/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • webpack-dev-server-2.9.4.tgz
      • sockjs-0.3.18.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.

Publish Date: 2020-07-09

URL: CVE-2020-7693

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-14

Fix Resolution (sockjs): 0.3.20

Direct dependency fix Resolution (react-scripts): 3.4.2


Step up your Open Source Security Game with Mend here

WS-2018-0592 (Medium) detected in eslint-4.10.0.tgz - autoclosed

WS-2018-0592 - Medium Severity Vulnerability

Vulnerable Library - eslint-4.10.0.tgz

An AST-based pattern checker for JavaScript.

Library home page: https://registry.npmjs.org/eslint/-/eslint-4.10.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /tmp/git/EmpirEqual/src/node_modules/eslint/package.json,/tmp/git/EmpirEqual/src/node_modules/eslint/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • eslint-4.10.0.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Vulnerability Details

A vulnerability was descovered in eslint before 4.18.2. One of the regexes in eslint is vulnerable to catastrophic backtracking.

Publish Date: 2019-06-17

URL: WS-2018-0592

CVSS 2 Score Details (4.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: eslint/eslint#10002

Release Date: 2019-06-16

Fix Resolution: 4.18.2


Step up your Open Source Security Game with WhiteSource here

WS-2019-0492 (High) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz - autoclosed

WS-2019-0492 - High Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/node_modules/handlebars/package.json,EmpirEqual/src/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Vulnerability Details

handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.

Publish Date: 2019-11-19

URL: WS-2019-0492

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1324

Release Date: 2019-11-19

Fix Resolution: handlebars - 3.0.8,4.5.3


Step up your Open Source Security Game with WhiteSource here

CVE-2020-7610 (Critical) detected in bson-1.0.9.tgz, bson-1.1.1.tgz

CVE-2020-7610 - Critical Severity Vulnerability

Vulnerable Libraries - bson-1.0.9.tgz, bson-1.1.1.tgz

bson-1.0.9.tgz

A bson parser for node.js and the browser

Library home page: https://registry.npmjs.org/bson/-/bson-1.0.9.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/node_modules/bson/package.json

Dependency Hierarchy:

  • mongodb-3.0.10.tgz (Root Library)
    • mongodb-core-3.0.9.tgz
      • bson-1.0.9.tgz (Vulnerable Library)
bson-1.1.1.tgz

A bson parser for node.js and the browser

Library home page: https://registry.npmjs.org/bson/-/bson-1.1.1.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/bson/package.json

Dependency Hierarchy:

  • mongodb-3.2.7.tgz (Root Library)
    • mongodb-core-3.2.7.tgz
      • bson-1.1.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Publish Date: 2020-03-30

URL: CVE-2020-7610

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-04-01

Fix Resolution (bson): 1.1.4

Direct dependency fix Resolution (mongodb): 3.1.3

Fix Resolution (bson): 1.1.4

Direct dependency fix Resolution (mongodb): 3.3.0


Step up your Open Source Security Game with Mend here

CVE-2018-16492 (Critical) detected in extend-3.0.1.tgz

CVE-2018-16492 - Critical Severity Vulnerability

Vulnerable Library - extend-3.0.1.tgz

Port of jQuery.extend for node.js and the browser

Library home page: https://registry.npmjs.org/extend/-/extend-3.0.1.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/extend/package.json,/src/frontend/node_modules/react-scripts/node_modules/extend/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • jest-environment-jsdom-20.0.3.tgz
          • jsdom-9.12.0.tgz
            • request-2.87.0.tgz
              • extend-3.0.1.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16492

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/381185

Release Date: 2019-02-01

Fix Resolution (extend): 3.0.2

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

CVE-2019-10747 (Critical) detected in set-value-0.4.3.tgz, set-value-2.0.0.tgz

CVE-2019-10747 - Critical Severity Vulnerability

Vulnerable Libraries - set-value-0.4.3.tgz, set-value-2.0.0.tgz

set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/union-value/node_modules/set-value/package.json,/src/node_modules/union-value/node_modules/set-value/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • babel-jest-20.0.3.tgz
      • babel-plugin-istanbul-4.1.6.tgz
        • test-exclude-4.2.1.tgz
          • micromatch-3.1.10.tgz
            • snapdragon-0.8.2.tgz
              • base-0.11.2.tgz
                • cache-base-1.0.1.tgz
                  • union-value-1.0.0.tgz
                    • set-value-0.4.3.tgz (Vulnerable Library)
set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.

Library home page: https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/set-value/package.json,/src/frontend/node_modules/react-scripts/node_modules/set-value/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • babel-jest-20.0.3.tgz
      • babel-plugin-istanbul-4.1.6.tgz
        • test-exclude-4.2.1.tgz
          • micromatch-3.1.10.tgz
            • snapdragon-0.8.2.tgz
              • base-0.11.2.tgz
                • cache-base-1.0.1.tgz
                  • set-value-2.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 95570e41b1fabd86612a9a88d0ca4afa85bd659b

Found in base branch: master

Vulnerability Details

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Publish Date: 2019-08-23

URL: CVE-2019-10747

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-08-23

Fix Resolution (set-value): 2.0.1

Direct dependency fix Resolution (react-scripts): 1.1.5

Fix Resolution (set-value): 2.0.1

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

WS-2019-0019 (Medium) detected in braces-1.8.5.tgz - autoclosed

WS-2019-0019 - Medium Severity Vulnerability

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /tmp/git/EmpirEqual/src/node_modules/jest-haste-map/node_modules/braces/package.json,/tmp/git/EmpirEqual/src/node_modules/jest-haste-map/node_modules/braces/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • webpack-dev-server-2.9.4.tgz
      • chokidar-1.7.0.tgz
        • anymatch-1.3.2.tgz
          • micromatch-2.3.11.tgz
            • braces-1.8.5.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2019-03-25

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1


Step up your Open Source Security Game with WhiteSource here

CVE-2019-20922 (High) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

CVE-2019-20922 - High Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/handlebars/package.json,/src/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Handlebars before 4.4.5 allows Regular Expression Denial of Service (ReDoS) because of eager matching. The parser may be forced into an endless loop while processing crafted templates. This may allow attackers to exhaust system resources.

Publish Date: 2020-09-30

URL: CVE-2019-20922

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1300

Release Date: 2020-09-30

Fix Resolution (handlebars): 4.4.5

Direct dependency fix Resolution (react-scripts): 1.1.5

Fix Resolution (handlebars): 4.4.5

Direct dependency fix Resolution (hbs): 4.1.0


Step up your Open Source Security Game with Mend here

WS-2018-0347 (Medium) detected in eslint-4.10.0.tgz

WS-2018-0347 - Medium Severity Vulnerability

Vulnerable Library - eslint-4.10.0.tgz

An AST-based pattern checker for JavaScript.

Library home page: https://registry.npmjs.org/eslint/-/eslint-4.10.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/eslint/package.json,/src/node_modules/eslint/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • eslint-4.10.0.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Found in base branch: master

Vulnerability Details

A vulnerability was descovered in eslint before 4.18.2. One of the regexes in eslint is vulnerable to catastrophic backtracking.

Publish Date: 2018-02-27

URL: WS-2018-0347

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-02-27

Fix Resolution (eslint): 4.18.2

Direct dependency fix Resolution (react-scripts): 2.0.0


Step up your Open Source Security Game with Mend here

CVE-2018-6341 (Medium) detected in react-dom-16.4.0.tgz

CVE-2018-6341 - Medium Severity Vulnerability

Vulnerable Library - react-dom-16.4.0.tgz

React package for working with the DOM.

Library home page: https://registry.npmjs.org/react-dom/-/react-dom-16.4.0.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/frontend/node_modules/react-dom/package.json,/src/frontend/node_modules/react-dom/package.json

Dependency Hierarchy:

  • react-dom-16.4.0.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Found in base branch: master

Vulnerability Details

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.

Publish Date: 2018-12-31

URL: CVE-2018-6341

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6341

Release Date: 2018-12-31

Fix Resolution: 16.4.2


Step up your Open Source Security Game with Mend here

WS-2019-0332 (Medium) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz - autoclosed

WS-2019-0332 - Medium Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/node_modules/handlebars/package.json,EmpirEqual/src/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Vulnerability Details

Arbitrary Code Execution vulnerability found in handlebars before 4.5.3. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.It is due to an incomplete fix for a WS-2019-0331.

Publish Date: 2019-11-17

URL: WS-2019-0332

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1324

Release Date: 2019-12-05

Fix Resolution: handlebars - 4.5.3


Step up your Open Source Security Game with WhiteSource here

CVE-2019-1010266 (Medium) detected in lodash-4.17.10.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json

Dependency Hierarchy:

  • lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: 95570e41b1fabd86612a9a88d0ca4afa85bd659b

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2019-07-17

Fix Resolution: 4.17.11


Step up your Open Source Security Game with Mend here

CVE-2020-8203 (High) detected in lodash-4.17.10.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json

Dependency Hierarchy:

  • lodash-4.17.10.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution: 4.17.19


Step up your Open Source Security Game with Mend here

WS-2019-0318 (High) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz - autoclosed

WS-2019-0318 - High Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/node_modules/handlebars/package.json,EmpirEqual/src/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Vulnerability Details

In "showdownjs/showdown", versions prior to v4.4.5 are vulnerable against Regular expression Denial of Service (ReDOS) once receiving specially-crafted templates.

Publish Date: 2019-10-20

URL: WS-2019-0318

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1300

Release Date: 2019-12-01

Fix Resolution: handlebars - 4.4.5


Step up your Open Source Security Game with WhiteSource here

CVE-2021-23337 (High) detected in lodash-4.17.10.tgz

CVE-2021-23337 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json

Dependency Hierarchy:

  • lodash-4.17.10.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2021-02-15

Fix Resolution: 4.17.21


Step up your Open Source Security Game with Mend here

WS-2019-0333 (High) detected in handlebars-4.0.11.tgz, handlebars-4.0.5.tgz - autoclosed

WS-2019-0333 - High Severity Vulnerability

Vulnerable Libraries - handlebars-4.0.11.tgz, handlebars-4.0.5.tgz

handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.1.tgz
          • istanbul-reports-1.3.0.tgz
            • handlebars-4.0.11.tgz (Vulnerable Library)
handlebars-4.0.5.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.5.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: EmpirEqual/src/node_modules/handlebars/package.json,EmpirEqual/src/node_modules/handlebars/package.json

Dependency Hierarchy:

  • hbs-4.0.1.tgz (Root Library)
    • handlebars-4.0.5.tgz (Vulnerable Library)

Vulnerability Details

In handlebars, versions prior to v4.5.3 are vulnerable to prototype pollution. Using a malicious template it's possbile to add or modify properties to the Object prototype. This can also lead to DOS and RCE in certain conditions.

Publish Date: 2019-11-18

URL: WS-2019-0333

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1325

Release Date: 2019-12-05

Fix Resolution: handlebars - 4.5.3


Step up your Open Source Security Game with WhiteSource here

CVE-2020-8124 (Medium) detected in url-parse-1.4.1.tgz

CVE-2020-8124 - Medium Severity Vulnerability

Vulnerable Library - url-parse-1.4.1.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.1.tgz

Path to dependency file: /EmpirEqual/src/package.json

Path to vulnerable library: /src/frontend/node_modules/react-scripts/node_modules/url-parse/package.json,/src/frontend/node_modules/react-scripts/node_modules/url-parse/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • react-dev-utils-5.0.1.tgz
      • sockjs-client-1.1.4.tgz
        • url-parse-1.4.1.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.

Publish Date: 2020-02-04

URL: CVE-2020-8124

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8124

Release Date: 2020-02-18

Fix Resolution (url-parse): 1.4.5

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

WS-2020-0091 (High) detected in http-proxy-1.17.0.tgz

WS-2020-0091 - High Severity Vulnerability

Vulnerable Library - http-proxy-1.17.0.tgz

HTTP proxying for the masses

Library home page: https://registry.npmjs.org/http-proxy/-/http-proxy-1.17.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/http-proxy/package.json,/src/node_modules/http-proxy/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • webpack-dev-server-2.9.4.tgz
      • http-proxy-middleware-0.17.4.tgz
        • http-proxy-1.17.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.

Publish Date: 2020-05-14

URL: WS-2020-0091

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1486

Release Date: 2020-05-14

Fix Resolution (http-proxy): 1.18.1

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

CVE-2019-10744 (Critical) detected in lodash.template-4.4.0.tgz, lodash-4.17.10.tgz

CVE-2019-10744 - Critical Severity Vulnerability

Vulnerable Libraries - lodash.template-4.4.0.tgz, lodash-4.17.10.tgz

lodash.template-4.4.0.tgz

The lodash method `_.template` exported as a module.

Library home page: https://registry.npmjs.org/lodash.template/-/lodash.template-4.4.0.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/lodash.template/package.json,/src/node_modules/lodash.template/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • sw-precache-webpack-plugin-0.11.4.tgz
      • sw-precache-5.2.1.tgz
        • lodash.template-4.4.0.tgz (Vulnerable Library)
lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json

Dependency Hierarchy:

  • lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: 95570e41b1fabd86612a9a88d0ca4afa85bd659b

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-26

Fix Resolution (lodash.template): 4.5.0

Direct dependency fix Resolution (react-scripts): 1.1.5


Step up your Open Source Security Game with Mend here

WS-2018-0236 (Medium) detected in mem-1.1.0.tgz - autoclosed

WS-2018-0236 - Medium Severity Vulnerability

Vulnerable Library - mem-1.1.0.tgz

Memoize functions - An optimization used to speed up consecutive function calls by caching the result of calls with identical input

Library home page: https://registry.npmjs.org/mem/-/mem-1.1.0.tgz

Path to dependency file: /tmp/ws-scm/EmpirEqual/src/frontend/package.json

Path to vulnerable library: /tmp/ws-scm/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/mem/package.json,/tmp/ws-scm/EmpirEqual/src/frontend/node_modules/react-scripts/node_modules/mem/package.json

Dependency Hierarchy:

  • react-scripts-1.1.4.tgz (Root Library)
    • webpack-3.8.1.tgz
      • yargs-8.0.2.tgz
        • os-locale-2.1.0.tgz
          • mem-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 95570e41b1fabd86612a9a88d0ca4afa85bd659b

Vulnerability Details

In nodejs-mem before version 4.0.0 there is a memory leak due to old results not being removed from the cache despite reaching maxAge. Exploitation of this can lead to exhaustion of memory and subsequent denial of service.

Publish Date: 2019-05-30

URL: WS-2018-0236

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1623744

Release Date: 2019-05-30

Fix Resolution: 4.0.0


Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (Medium) detected in lodash-4.17.10.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /EmpirEqual/src/frontend/package.json

Path to vulnerable library: /src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json,/src/node_modules/lodash/package.json

Dependency Hierarchy:

  • lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: eb9cabab175c510b8a4d2acd94ab88c04172d471

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/380873

Release Date: 2019-02-01

Fix Resolution: 4.17.11


Step up your Open Source Security Game with Mend here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.