osgirl / alice Goto Github PK

Vulnerable Library - mime-1.2.11.tgz

A comprehensive library for mime-type mapping

path: /tmp/git/alice/node_modules/bower/node_modules/request/node_modules/mime/package.json

Library home page: http://registry.npmjs.org/mime/-/mime-1.2.11.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • bower-registry-client-0.1.4.tgz
    • request-2.27.0.tgz
      • ❌ mime-1.2.11.tgz (Vulnerable Library)

Vulnerability Details

Affected version of mime (1.0.0 throw 1.4.0 and 2.0.0 throw 2.0.2), are vulnerable to regular expression denial of service.

Publish Date: 2017-09-27

URL: WS-2017-0330

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Vulnerable Library - growl-1.7.0.tgz

Growl unobtrusive notifications

path: /tmp/git/alice/node_modules/mocha/node_modules/growl/package.json

Library home page: http://registry.npmjs.org/growl/-/growl-1.7.0.tgz

Dependency Hierarchy:

• mocha-1.12.0.tgz (Root Library)
  • ❌ growl-1.7.0.tgz (Vulnerable Library)

Vulnerability Details

Growl adds growl notification support to nodejs. Growl before 1.10.2 does not properly sanitize input before passing it to exec, allowing for arbitrary command execution.

Publish Date: 2018-06-04

URL: CVE-2017-16042

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/146

Release Date: 2017-07-05

Fix Resolution: Update to version 1.10.2 or later.

Vulnerable Library - open-0.0.4.tgz

open a file or url in the user's preferred application

path: /tmp/git/alice/node_modules/bower/node_modules/open/package.json

Library home page: http://registry.npmjs.org/open/-/open-0.0.4.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • ❌ open-0.0.4.tgz (Vulnerable Library)

Vulnerability Details

All versions of open are vulnerable to command injection when unsanitized user input is passed in.

Publish Date: 2018-05-16

URL: WS-2018-0107

CVSS 2 Score Details (10.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/663

Release Date: 2018-05-16

Fix Resolution: No fix is currently available for this vulnerability. It is our recommendation to not install or use this module until a fix is available.

Vulnerable Library - node-uuid-1.4.1.tgz

Rigorous implementation of RFC4122 (v1 and v4) UUIDs.

path: /tmp/git/alice/node_modules/bower/node_modules/bower-registry-client/node_modules/request/node_modules/node-uuid/package.json

Library home page: http://registry.npmjs.org/node-uuid/-/node-uuid-1.4.1.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • bower-registry-client-0.1.4.tgz
    • request-2.27.0.tgz
      • ❌ node-uuid-1.4.1.tgz (Vulnerable Library)

Vulnerability Details

Node-uuid prior to 1.4.4 contained a bug that caused it to consistently fall back to using Math.random instead of a more cryptographically sound source of entropy, the native crypto module.

Publish Date: 2016-03-28

URL: WS-2016-0013

CVSS 2 Score Details (4.2)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/93

Release Date: 2016-03-28

Fix Resolution: Upgrade to version 1.4.4 or greater

Vulnerable Library - growl-1.7.0.tgz

Growl unobtrusive notifications

path: /tmp/git/alice/node_modules/mocha/node_modules/growl/package.json

Library home page: http://registry.npmjs.org/growl/-/growl-1.7.0.tgz

Dependency Hierarchy:

• mocha-1.12.0.tgz (Root Library)
  • ❌ growl-1.7.0.tgz (Vulnerable Library)

Vulnerability Details

Affected versions of the package are vulnerable to Arbitrary Code Injection.

Publish Date: 2017-05-01

URL: WS-2017-0236

CVSS 2 Score Details (5.6)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: tj/node-growl@d9f6ea2

Release Date: 2016-09-05

Fix Resolution: Replace or update the following files: package.json, growl.js

Vulnerable Library - ms-0.3.0.tgz

Tiny ms conversion utility

path: /tmp/git/alice/node_modules/mocha/node_modules/ms/package.json

Library home page: http://registry.npmjs.org/ms/-/ms-0.3.0.tgz

Dependency Hierarchy:

• mocha-1.12.0.tgz (Root Library)
  • ❌ ms-0.3.0.tgz (Vulnerable Library)

Vulnerability Details

Ms is vulnerable to regular expression denial of service (ReDoS) when extremely long version strings are parsed.

Publish Date: 2015-10-24

URL: WS-2015-0015

CVSS 2 Score Details (5.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/46

Release Date: 2015-10-24

Fix Resolution: Update to version 0.7.1 or greater. An alternative would be to limit the input length of the user input before passing it into ms.

Vulnerable Library - uglify-js-2.3.6.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

path: /tmp/git/alice/node_modules/bower/node_modules/handlebars/node_modules/uglify-js/package.json

Library home page: http://registry.npmjs.org/uglify-js/-/uglify-js-2.3.6.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • handlebars-1.0.12.tgz
    • ❌ uglify-js-2.3.6.tgz (Vulnerable Library)

Vulnerability Details

The uglify-js package before 2.4.24 for Node.js does not properly account for non-boolean values when rewriting boolean expressions, which might allow attackers to bypass security mechanisms or possibly have unspecified other impact by leveraging improperly rewritten Javascript.

Publish Date: 2017-01-23

URL: CVE-2015-8857

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8858

Release Date: 2018-12-15

Fix Resolution: v2.4.24

Vulnerability Details

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-03-30

URL: CVE-2018-3728

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Change files

Origin: hapijs/hoek@623667e

Release Date: 2018-02-15

Fix Resolution: Replace or update the following files: index.js, index.js

Vulnerable Library - tunnel-agent-0.3.0.tgz

HTTP proxy tunneling agent. Formerly part of mikeal/request, now a standalone module.

path: /tmp/git/alice/node_modules/bower/node_modules/bower-registry-client/node_modules/request/node_modules/tunnel-agent/package.json

Library home page: http://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.3.0.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • bower-registry-client-0.1.4.tgz
    • request-2.27.0.tgz
      • ❌ tunnel-agent-0.3.0.tgz (Vulnerable Library)

Vulnerability Details

Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Publish Date: 2018-04-25

URL: WS-2018-0076

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/598

Release Date: 2018-01-27

Fix Resolution: 0.6.0

Vulnerable Library - tar-0.1.18.tgz

tar for node

path: /tmp/git/alice/node_modules/bower/node_modules/tar/package.json

Library home page: http://registry.npmjs.org/tar/-/tar-0.1.18.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • ❌ tar-0.1.18.tgz (Vulnerable Library)

Vulnerability Details

The tar module earlier than version 2.0.0 allow for archives to contain symbolic links that will overwrite targets outside the expected path for extraction.

Publish Date: 2015-11-03

URL: WS-2015-0025

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/57

Release Date: 2015-11-03

Fix Resolution: Update to a version 2.0.0 or greater

Vulnerable Library - qs-0.6.5.tgz

querystring parser

path: /tmp/git/alice/node_modules/bower/node_modules/bower-registry-client/node_modules/request/node_modules/qs/package.json

Library home page: http://registry.npmjs.org/qs/-/qs-0.6.5.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • bower-registry-client-0.1.4.tgz
    • request-2.27.0.tgz
      • ❌ qs-0.6.5.tgz (Vulnerable Library)

Vulnerability Details

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.

Publish Date: 2014-10-19

URL: CVE-2014-7191

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/qs_dos_memory_exhaustion

Release Date: 2014-08-06

Fix Resolution: Update qs to version 1.0.0 or greater

Vulnerable Library - http-signature-0.10.0.tgz

Reference implementation of Joyent's HTTP Signature Scheme

path: /tmp/git/alice/node_modules/bower/node_modules/bower-registry-client/node_modules/request/node_modules/http-signature/package.json

Library home page: http://registry.npmjs.org/http-signature/-/http-signature-0.10.0.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • bower-registry-client-0.1.4.tgz
    • request-2.27.0.tgz
      • ❌ http-signature-0.10.0.tgz (Vulnerable Library)

Vulnerability Details

Affected versions (before 1.0.0) of the http-signature package are vulnerable to Timing Attacks.

Publish Date: 2017-06-28

URL: WS-2017-0266

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: TritonDataCenter/node-http-signature@78ab1da

Release Date: 2015-09-21

Fix Resolution: Replace or update the following file: verify.js

Vulnerability Details

Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.

Publish Date: 2016-04-13

URL: CVE-2016-2515

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/77

Release Date: 2016-01-19

Fix Resolution: Update to hawk version 4.1.1 or greater.

Vulnerable Library - qs-0.6.5.tgz

querystring parser

path: /tmp/git/alice/node_modules/bower/node_modules/bower-registry-client/node_modules/request/node_modules/qs/package.json

Library home page: http://registry.npmjs.org/qs/-/qs-0.6.5.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • bower-registry-client-0.1.4.tgz
    • request-2.27.0.tgz
      • ❌ qs-0.6.5.tgz (Vulnerable Library)

Vulnerability Details

Denial-of-Service Extended Event Loop Blocking.The qs module does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time

Publish Date: 2014-08-06

URL: WS-2014-0005

CVSS 2 Score Details (6.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking

Release Date: 2014-08-06

Fix Resolution: Update qs to version 1.0.0 or greater

Vulnerability Details

Request is an http client. If a request is made using multipart, and the body type is a number, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.

Publish Date: 2018-06-04

URL: CVE-2017-16026

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/309

Release Date: 2017-04-14

Fix Resolution: Update to version 2.68.0 or later

Vulnerable Library - minimatch-0.2.12.tgz

a glob matcher in javascript

path: /tmp/git/alice/node_modules/bower/node_modules/glob/node_modules/minimatch/package.json

Library home page: http://registry.npmjs.org/minimatch/-/minimatch-0.2.12.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • fstream-ignore-0.0.7.tgz
    • ❌ minimatch-0.2.12.tgz (Vulnerable Library)

Vulnerability Details

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.

Publish Date: 2018-05-31

URL: CVE-2016-10540

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/118

Release Date: 2016-06-20

Fix Resolution: Update to version 3.0.2 or later.

Vulnerable Library - tar-0.1.18.tgz

tar for node

path: /tmp/git/alice/node_modules/bower/node_modules/tar/package.json

Library home page: http://registry.npmjs.org/tar/-/tar-0.1.18.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • ❌ tar-0.1.18.tgz (Vulnerable Library)

Vulnerability Details

The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Publish Date: 2017-01-23

URL: CVE-2015-8860

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Change files

Origin: isaacs/node-tar@a5337a6

Release Date: 2015-03-27

Fix Resolution: Replace or update the following files: extract.js, dir-normalization.tar, dir-normalization.js

Vulnerable Library - deep-extend-0.2.5.tgz

Recursive object extending.

path: /tmp/git/alice/node_modules/bower/node_modules/bower-json/node_modules/deep-extend/package.json

Library home page: http://registry.npmjs.org/deep-extend/-/deep-extend-0.2.5.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • bower-json-0.4.0.tgz
    • ❌ deep-extend-0.2.5.tgz (Vulnerable Library)

Vulnerability Details

The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.

Publish Date: 2018-07-03

URL: CVE-2018-3750

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750

Release Date: 2019-01-24

Fix Resolution: 0.5.1

Vulnerability Details

In the node_module "lodash" before version 4.17.11 the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects.

Publish Date: 2018-11-25

URL: WS-2018-0210

CVSS 2 Score Details (3.5)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: lodash/lodash@90e6199

Release Date: 2018-08-31

Fix Resolution: Replace or update the following files: lodash.js, test.js

Vulnerable Library - debug-0.7.2.tgz

small debugging utility

path: /tmp/git/alice/node_modules/mocha/node_modules/debug/package.json

Library home page: http://registry.npmjs.org/debug/-/debug-0.7.2.tgz

Dependency Hierarchy:

• mocha-1.12.0.tgz (Root Library)
  • ❌ debug-0.7.2.tgz (Vulnerable Library)

Vulnerability Details

The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.

Publish Date: 2018-06-07

URL: CVE-2017-16137

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/534

Release Date: 2017-09-27

Fix Resolution: Version 2.x.x: Update to version 2.6.9 or later. Version 3.x.x: Update to version 3.1.0 or later.

Vulnerable Library - cli-0.4.5.tgz

A tool for rapidly building command line apps

path: /tmp/git/alice/node_modules/grunt-contrib-jshint/node_modules/jshint/node_modules/cli/package.json

Library home page: http://registry.npmjs.org/cli/-/cli-0.4.5.tgz

Dependency Hierarchy:

• grunt-contrib-jshint-0.6.3.tgz (Root Library)
  • jshint-2.1.10.tgz
    • ❌ cli-0.4.5.tgz (Vulnerable Library)

Vulnerability Details

The package node-cli before 1.0.0 insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.

Publish Date: 2018-05-31

URL: CVE-2016-10538

CVSS 3 Score Details (3.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/95

Release Date: 2016-06-15

Fix Resolution: Update to version 1.0.0 or later.

Vulnerable Library - uglify-js-2.3.6.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

path: /tmp/git/alice/node_modules/bower/node_modules/handlebars/node_modules/uglify-js/package.json

Library home page: http://registry.npmjs.org/uglify-js/-/uglify-js-2.3.6.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • handlebars-1.0.12.tgz
    • ❌ uglify-js-2.3.6.tgz (Vulnerable Library)

Vulnerability Details

Uglify-js is vulnerable to regular expression denial of service (ReDoS) when certain types of input is passed into .parse().

Publish Date: 2015-10-24

URL: WS-2015-0017

CVSS 2 Score Details (5.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/48

Release Date: 2015-10-24

Fix Resolution: Update to version 2.6.0 or later

Vulnerable Library - mime-1.2.11.tgz

A comprehensive library for mime-type mapping

path: /tmp/git/alice/node_modules/bower/node_modules/request/node_modules/mime/package.json

Library home page: http://registry.npmjs.org/mime/-/mime-1.2.11.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • bower-registry-client-0.1.4.tgz
    • request-2.27.0.tgz
      • ❌ mime-1.2.11.tgz (Vulnerable Library)

Vulnerability Details

The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

Publish Date: 2018-06-07

URL: CVE-2017-16138

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5

Vulnerable Library - cryptiles-0.2.2.tgz

General purpose crypto utilities

path: /tmp/git/alice/node_modules/bower/node_modules/update-notifier/node_modules/request/node_modules/hawk/node_modules/cryptiles/package.json

Library home page: http://registry.npmjs.org/cryptiles/-/cryptiles-0.2.2.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • bower-registry-client-0.1.4.tgz
    • request-2.27.0.tgz
      • hawk-1.0.0.tgz
        • ❌ cryptiles-0.2.2.tgz (Vulnerable Library)

Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Vulnerable Library - uglify-js-2.3.6.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

path: /tmp/git/alice/node_modules/bower/node_modules/handlebars/node_modules/uglify-js/package.json

Library home page: http://registry.npmjs.org/uglify-js/-/uglify-js-2.3.6.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • handlebars-1.0.12.tgz
    • ❌ uglify-js-2.3.6.tgz (Vulnerable Library)

Vulnerability Details

UglifyJS versions 2.4.23 and earlier are affected by a vulnerability which allows a specially crafted Javascript file to have altered functionality after minification.

Publish Date: 2015-08-24

URL: WS-2015-0024

CVSS 2 Score Details (8.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: mishoo/UglifyJS@905b601

Release Date: 2017-01-31

Fix Resolution: v2.4.24

Vulnerable Library - uglify-js-2.3.6.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

path: /tmp/git/alice/node_modules/bower/node_modules/handlebars/node_modules/uglify-js/package.json

Library home page: http://registry.npmjs.org/uglify-js/-/uglify-js-2.3.6.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • handlebars-1.0.12.tgz
    • ❌ uglify-js-2.3.6.tgz (Vulnerable Library)

Vulnerability Details

The uglify-js package before 2.6.0 for Node.js allows attackers to cause a denial of service (CPU consumption) via crafted input in a parse call, aka a "regular expression denial of service (ReDoS)."

Publish Date: 2017-01-23

URL: CVE-2015-8858

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8858

Release Date: 2018-12-15

Fix Resolution: v2.6.0

Vulnerable Library - qs-0.6.5.tgz

querystring parser

path: /tmp/git/alice/node_modules/bower/node_modules/bower-registry-client/node_modules/request/node_modules/qs/package.json

Library home page: http://registry.npmjs.org/qs/-/qs-0.6.5.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • bower-registry-client-0.1.4.tgz
    • request-2.27.0.tgz
      • ❌ qs-0.6.5.tgz (Vulnerable Library)

Vulnerability Details

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.

Publish Date: 2018-05-31

URL: CVE-2014-10064

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/28

Release Date: 2014-08-06

Fix Resolution: Update to version 1.0.0 or later

Vulnerable Library - handlebars-1.0.12.tgz

Extension of the Mustache logicless template language

path: /tmp/git/alice/node_modules/bower/node_modules/handlebars/package.json

Library home page: http://registry.npmjs.org/handlebars/-/handlebars-1.0.12.tgz

Dependency Hierarchy:

• bower-1.2.1.tgz (Root Library)
  • ❌ handlebars-1.0.12.tgz (Vulnerable Library)

Vulnerability Details

Quoteless Attributes in Templates can lead to Content Injection

Publish Date: 2015-12-14

URL: WS-2015-0003

CVSS 2 Score Details (5.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/61

Release Date: 2015-12-14

Fix Resolution: If you are unable to upgrade to version 4.0.0 or greater you can add quotes to your attributes in your handlebar templates.

Vulnerability Details

Semver is vulnerable to regular expression denial of service (ReDoS) when extremely long version strings are parsed.

Publish Date: 2015-04-04

URL: WS-2015-0018

CVSS 2 Score Details (5.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/31

Release Date: 2015-04-04

Fix Resolution: Update to a version 4.3.2 or greater

Vulnerable Library - ms-0.3.0.tgz

Tiny ms conversion utility

path: /tmp/git/alice/node_modules/mocha/node_modules/ms/package.json

Library home page: http://registry.npmjs.org/ms/-/ms-0.3.0.tgz

Dependency Hierarchy:

• mocha-1.12.0.tgz (Root Library)
  • ❌ ms-0.3.0.tgz (Vulnerable Library)

Vulnerability Details

Affected versions of this package are vulnerable to Regular Expression Denial of Service (ReDoS).

Publish Date: 2017-05-15

URL: WS-2017-0247

CVSS 2 Score Details (3.4)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: vercel/ms@305f2dd

Release Date: 2017-04-12

Fix Resolution: Replace or update the following file: index.js

Vulnerable Library - cli-0.4.5.tgz

A tool for rapidly building command line apps

path: /tmp/git/alice/node_modules/grunt-contrib-jshint/node_modules/jshint/node_modules/cli/package.json

Library home page: http://registry.npmjs.org/cli/-/cli-0.4.5.tgz

Dependency Hierarchy:

• grunt-contrib-jshint-0.6.3.tgz (Root Library)
  • jshint-2.1.10.tgz
    • ❌ cli-0.4.5.tgz (Vulnerable Library)

Vulnerability Details

The package node-cli insecurely uses the lock_file and log_file. Both of these are temporary, but it allows the starting user to overwrite any file they have access to.

Publish Date: 2016-06-15

URL: WS-2016-0036

CVSS 2 Score Details (1.9)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: node-js-libs/cli@fd6bc4d

Release Date: 2017-01-31

Fix Resolution: 1.0.0

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11