Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • istanbul-api-1.3.1.tgz
        • istanbul-reports-1.3.0.tgz
          • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Arbitrary Code Execution vulnerability found in handlebars before 4.5.3. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.It is due to an incomplete fix for a WS-2019-0331.

Publish Date: 2019-11-17

URL: WS-2019-0332

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1324

Release Date: 2019-12-05

Fix Resolution: handlebars - 4.5.3

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.7.1.min.js

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

Vulnerable Library - mem-1.1.0.tgz

Memoize functions - An optimization used to speed up consecutive function calls by caching the result of calls with identical input

Library home page: https://registry.npmjs.org/mem/-/mem-1.1.0.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • webpack-3.8.1.tgz
    • yargs-8.0.2.tgz
      • os-locale-2.1.0.tgz
        • ❌ mem-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Denial of Service (DoS) vulnerability found in mem before 4.0.0. There is a failure in removal of old values from the cache. As a result, attacker may exhaust the system's memory.

Publish Date: 2018-08-27

URL: WS-2019-0307

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1084

Release Date: 2019-12-01

Fix Resolution: mem - 4.0.0

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • istanbul-api-1.3.1.tgz
        • istanbul-reports-1.3.0.tgz
          • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Publish Date: 2019-12-20

URL: CVE-2019-19919

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1164

Release Date: 2019-12-20

Fix Resolution: 4.3.0

Vulnerable Library - merge-1.2.0.tgz

Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.

Library home page: https://registry.npmjs.org/merge/-/merge-1.2.0.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/merge/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • jest-haste-map-20.0.5.tgz
        • sane-1.6.0.tgz
          • exec-sh-0.2.2.tgz
            • ❌ merge-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

The merge.recursive function in the merge package <1.2.1 can be tricked into adding or modifying properties of the Object prototype. These properties will be present on all objects allowing for a denial of service attack.

Publish Date: 2018-10-30

URL: CVE-2018-16469

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-16469

Release Date: 2018-10-30

Fix Resolution: v1.2.1

Vulnerable Library - bson-1.0.9.tgz

A bson parser for node.js and the browser

Library home page: https://registry.npmjs.org/bson/-/bson-1.0.9.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/bson/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/bson/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/bson/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/bson/package.json

Dependency Hierarchy:

• mongoose-5.1.6.tgz (Root Library)
  • ❌ bson-1.0.9.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

All versions of bson before 1.1.4 are vulnerable to Deserialization of Untrusted Data. The package will ignore an unknown value for an object's _bsotype, leading to cases where an object is serialized as a document rather than the intended BSON type.

Publish Date: 2020-03-30

URL: CVE-2020-7610

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://github.com/mongodb/js-bson/releases/tag/v1.1.4

Release Date: 2020-03-30

Fix Resolution: bson - 1.1.4

Vulnerable Library - react-dom-16.4.1.tgz

React package for working with the DOM.

Library home page: https://registry.npmjs.org/react-dom/-/react-dom-16.4.1.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-redux-todos/package.json

Path to vulnerable library: /advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dom/package.json

Dependency Hierarchy:

• ❌ react-dom-16.4.1.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

React applications which rendered to HTML using the ReactDOMServer API were not escaping user-supplied attribute names at render-time. That lack of escaping could lead to a cross-site scripting vulnerability. This issue affected minor releases 16.0.x, 16.1.x, 16.2.x, 16.3.x, and 16.4.x. It was fixed in 16.0.1, 16.1.2, 16.2.1, 16.3.3, and 16.4.2.

Publish Date: 2018-12-31

URL: CVE-2018-6341

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6341

Release Date: 2019-01-24

Fix Resolution: 16.0.1,16.1.2,16.2.1,16.3.3,16.4.2

Vulnerable Libraries - mongoose-5.1.6.tgz, mongoose-5.2.4.tgz, mongoose-5.2.5.tgz

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Automattic Mongoose through 5.7.4 allows attackers to bypass access control (in some applications) because any query object with a _bsontype attribute is ignored. For example, adding "_bsontype":"a" can sometimes interfere with a query filter. NOTE: this CVE is about Mongoose's failure to work around this _bsontype special case that exists in older versions of the bson parser (aka the mongodb/js-bson project).

Publish Date: 2019-10-10

URL: CVE-2019-17426

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-17426

Release Date: 2019-10-10

Fix Resolution: 5.7.5

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • istanbul-api-1.3.1.tgz
        • istanbul-reports-1.3.0.tgz
          • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Versions of handlebars prior to 4.0.14 are vulnerable to Prototype Pollution. Templates may alter an Objects' prototype, thus allowing an attacker to execute arbitrary code on the server.

Publish Date: 2019-01-30

URL: WS-2019-0064

CVSS 2 Score Details (8.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/755/versions

Release Date: 2019-04-30

Fix Resolution: 1.0.6-2,4.0.14,4.1.2

Vulnerable Libraries - jquery-3.3.1.min.js, jquery-2.1.4.min.js, jquery-3.3.1.js

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0

Vulnerable Libraries - set-value-2.0.0.tgz, set-value-0.4.3.tgz

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Publish Date: 2019-08-23

URL: CVE-2019-10747

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: jonschlinkert/set-value@95e9d99

Release Date: 2019-07-24

Fix Resolution: 2.0.1,3.0.1

Vulnerable Libraries - minimist-0.0.8.tgz, minimist-1.2.0.tgz

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json

Dependency Hierarchy:

• react-redux-5.0.7.tgz (Root Library)
  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

All versions of lodash are vulnerable to Prototype Pollution. The function zipObjectDeep allows a malicious user to modify the prototype of Object if the property identifiers are user-supplied. Being affected by this issue requires zipping objects based on user-provided property arrays. This vulnerability may lead to Denial of Service or Code Execution.

Publish Date: 2020-04-28

URL: WS-2020-0070

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • istanbul-api-1.3.1.tgz
        • istanbul-reports-1.3.0.tgz
          • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

A Denial of Service vulnerability found in handlebars 4.x before 4.4.5.While processing specially-crafted templates, the parser may be forced into endless loop. Attackers may exhaust system resources.

Publish Date: 2019-10-20

URL: WS-2019-0318

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1300

Release Date: 2019-12-01

Fix Resolution: handlebars - 4.4.5

Vulnerable Library - url-parse-1.4.1.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.1.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • react-dev-utils-5.0.1.tgz
    • sockjs-client-1.1.4.tgz
      • ❌ url-parse-1.4.1.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Insufficient validation and sanitization of user input exists in url-parse npm package version 1.4.4 and earlier may allow attacker to bypass security checks.

Publish Date: 2020-02-04

URL: CVE-2020-8124

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8124

Release Date: 2020-02-04

Fix Resolution: url-parse - 1.4.5

Vulnerable Library - websocket-extensions-0.1.3.tgz

Generic extension manager for WebSocket connections

Library home page: https://registry.npmjs.org/websocket-extensions/-/websocket-extensions-0.1.3.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/websocket-extensions/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • react-dev-utils-5.0.1.tgz
    • sockjs-client-1.1.4.tgz
      • faye-websocket-0.11.1.tgz
        • websocket-driver-0.7.0.tgz
          • ❌ websocket-extensions-0.1.3.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

websocket-extensions npm module prior to 1.0.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

Publish Date: 2020-06-02

URL: CVE-2020-7662

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7662

Release Date: 2020-06-02

Fix Resolution: websocket-extensions:0.1.4

Vulnerable Library - eslint-4.10.0.tgz

An AST-based pattern checker for JavaScript.

Library home page: https://registry.npmjs.org/eslint/-/eslint-4.10.0.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/eslint/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • ❌ eslint-4.10.0.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

A vulnerability was descovered in eslint before 4.18.2. One of the regexes in eslint is vulnerable to catastrophic backtracking.

Publish Date: 2018-02-27

URL: WS-2018-0347

CVSS 3 Score Details (4.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: eslint/eslint#10002

Release Date: 2019-06-16

Fix Resolution: 4.18.2

Vulnerable Libraries - yargs-parser-7.0.0.tgz, yargs-parser-4.2.1.tgz, yargs-parser-5.0.0.tgz

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7608

Release Date: 2020-03-16

Fix Resolution: v18.1.1;13.1.2;15.0.1

Vulnerable Library - morgan-1.9.0.tgz

HTTP request logger middleware for node.js

Library home page: https://registry.npmjs.org/morgan/-/morgan-1.9.0.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/package.json

Path to vulnerable library: /advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/morgan/package.json

Dependency Hierarchy:

• ❌ morgan-1.9.0.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

An attacker can use the format parameter to inject arbitrary commands in the npm package morgan < 1.9.1.

Publish Date: 2019-03-21

URL: CVE-2019-5413

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/390881

Release Date: 2019-03-21

Fix Resolution: 1.9.1

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • istanbul-api-1.3.1.tgz
        • istanbul-reports-1.3.0.tgz
          • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Handlebars.js before 4.1.0 has Remote Code Execution (RCE)

Publish Date: 2019-01-30

URL: WS-2019-0103

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: handlebars-lang/handlebars.js@edc6220

Release Date: 2019-05-30

Fix Resolution: 4.1.0

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json

Dependency Hierarchy:

• react-redux-5.0.7.tgz (Root Library)
  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11

Vulnerable Library - elliptic-6.4.0.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.4.0.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • webpack-3.8.1.tgz
    • node-libs-browser-2.1.0.tgz
      • crypto-browserify-3.12.0.tgz
        • browserify-sign-4.0.4.tgz
          • ❌ elliptic-6.4.0.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Publish Date: 2020-06-04

URL: CVE-2020-13822

CVSS 3 Score Details (7.7)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: https://github.com/indutny/elliptic/tree/v6.5.3

Release Date: 2020-06-04

Fix Resolution: v6.5.3

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • istanbul-api-1.3.1.tgz
        • istanbul-reports-1.3.0.tgz
          • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Arbitrary Code Execution vulnerability found in handlebars before 4.5.2. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.

Publish Date: 2019-11-13

URL: WS-2019-0331

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1316

Release Date: 2019-12-05

Fix Resolution: handlebars - 4.5.2

Vulnerable Library - webpack-dev-server-2.9.4.tgz

Serves a webpack app. Updates the browser on changes.

Library home page: https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-2.9.4.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/webpack-dev-server/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • ❌ webpack-dev-server-2.9.4.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

Publish Date: 2018-09-21

URL: CVE-2018-14732

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14732

Release Date: 2018-09-21

Fix Resolution: 3.1.6

Vulnerable Library - chownr-1.0.1.tgz

like `chown -R`

Library home page: https://registry.npmjs.org/chownr/-/chownr-1.0.1.tgz

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • fsevents-1.2.4.tgz
    • node-pre-gyp-0.10.0.tgz
      • tar-4.4.1.tgz
        • ❌ chownr-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

A TOCTOU issue in the chownr package before 1.1.0 for Node.js 10.10 could allow a local attacker to trick it into descending into unintended directories via symlink attacks.

Publish Date: 2020-06-15

URL: CVE-2017-18869

CVSS 3 Score Details (2.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: High
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18869

Release Date: 2020-06-15

Fix Resolution: 1.1.0

Vulnerable Libraries - js-yaml-3.7.0.tgz, js-yaml-3.12.0.tgz

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-20

URL: WS-2019-0032

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-20

Fix Resolution: js-yaml - 3.13.0

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/hapi/html/index.html

Path to vulnerable library: /advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/helloworld/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/helloworld/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-redux-todos/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/helloworld/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/helloworld/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/helloworld/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/sockjs/examples/multiplex/index.html

Dependency Hierarchy:

• ❌ jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/kind-of/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • babel-jest-20.0.3.tgz
    • babel-plugin-istanbul-4.1.6.tgz
      • test-exclude-4.2.1.tgz
        • micromatch-3.1.10.tgz
          • ❌ kind-of-6.0.2.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149

Release Date: 2019-12-30

Fix Resolution: 6.0.3

Vulnerable Library - mpath-0.4.1.tgz

{G,S}et object values using MongoDB-like path notation

Library home page: https://registry.npmjs.org/mpath/-/mpath-0.4.1.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos_api/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/mpath/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/mpath/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/mpath/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/mpath/package.json

Dependency Hierarchy:

• mongoose-5.1.6.tgz (Root Library)
  • ❌ mpath-0.4.1.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Mpath, versions 0.0.1--0.0.5, have a Prototype Pollution Vulnerability. An attacker can specify a path that include the prototype object.

Publish Date: 2018-08-30

URL: WS-2018-0224

CVSS 2 Score Details (6.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/390860

Release Date: 2018-12-13

Fix Resolution: 0.5.1

Vulnerable Libraries - js-yaml-3.7.0.tgz, js-yaml-3.12.0.tgz

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-05

URL: WS-2019-0063

CVSS 2 Score Details (8.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-05

Fix Resolution: js-yaml - 3.13.1

Vulnerable Library - extend-3.0.1.tgz

Port of jQuery.extend for node.js and the browser

Library home page: https://registry.npmjs.org/extend/-/extend-3.0.1.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/extend/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/extend/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/extend/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/extend/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/extend/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/extend/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/extend/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/extend/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/extend/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/extend/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • jest-environment-jsdom-20.0.3.tgz
        • jsdom-9.12.0.tgz
          • request-2.87.0.tgz
            • ❌ extend-3.0.1.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16492

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/381185

Release Date: 2019-02-01

Fix Resolution: extend - v3.0.2,v2.0.2

Vulnerable Library - mixin-deep-1.3.1.tgz

Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.

Library home page: https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mixin-deep/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • babel-jest-20.0.3.tgz
    • babel-plugin-istanbul-4.1.6.tgz
      • test-exclude-4.2.1.tgz
        • micromatch-3.1.10.tgz
          • snapdragon-0.8.2.tgz
            • base-0.11.2.tgz
              • ❌ mixin-deep-1.3.1.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-08-23

URL: CVE-2019-10746

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: jonschlinkert/mixin-deep@8f464c8

Release Date: 2019-07-11

Fix Resolution: 1.3.2,2.0.1

Vulnerable Library - axios-0.18.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.18.0.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/package.json

Path to vulnerable library: /advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/node_modules/axios/package.json

Dependency Hierarchy:

• ❌ axios-0.18.0.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.

Publish Date: 2019-05-07

URL: CVE-2019-10742

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: axios/axios#1098

Release Date: 2019-05-31

Fix Resolution: 0.19.0

Vulnerable Library - mem-1.1.0.tgz

Memoize functions - An optimization used to speed up consecutive function calls by caching the result of calls with identical input

Library home page: https://registry.npmjs.org/mem/-/mem-1.1.0.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/mem/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • webpack-3.8.1.tgz
    • yargs-8.0.2.tgz
      • os-locale-2.1.0.tgz
        • ❌ mem-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

In nodejs-mem before version 4.0.0 there is a memory leak due to old results not being removed from the cache despite reaching maxAge. Exploitation of this can lead to exhaustion of memory and subsequent denial of service.

Publish Date: 2018-08-27

URL: WS-2018-0236

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1623744

Release Date: 2019-05-30

Fix Resolution: 4.0.0

Vulnerable Library - mpath-0.4.1.tgz

{G,S}et object values using MongoDB-like path notation

Library home page: https://registry.npmjs.org/mpath/-/mpath-0.4.1.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos_api/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/mpath/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/mpath/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/mpath/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-todos-backend/node_modules/mpath/package.json

Dependency Hierarchy:

• mongoose-5.1.6.tgz (Root Library)
  • ❌ mpath-0.4.1.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

A prototype pollution vulnerability was found in module mpath <0.5.1 that allows an attacker to inject arbitrary properties onto Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16490

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/390860

Release Date: 2019-02-01

Fix Resolution: 0.5.1

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • istanbul-api-1.3.1.tgz
        • istanbul-reports-1.3.0.tgz
          • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Prototype Pollution vulnerability found in handlebars 1.0.6 before 4.5.3. It is possible to add or modify properties to the Object prototype through a malicious template. Attacker may crash the application or execute Arbitrary Code in specific conditions.

Publish Date: 2019-11-18

URL: WS-2019-0333

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1325

Release Date: 2019-12-05

Fix Resolution: handlebars - 4.5.3

Vulnerable Library - url-parse-1.4.1.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.1.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/url-parse/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • react-dev-utils-5.0.1.tgz
    • sockjs-client-1.1.4.tgz
      • ❌ url-parse-1.4.1.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Incorrect parsing in url-parse <1.4.3 returns wrong hostname which leads to multiple vulnerabilities such as SSRF, Open Redirect, Bypass Authentication Protocol.

Publish Date: 2018-08-12

URL: CVE-2018-3774

CVSS 3 Score Details (10.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3774

Release Date: 2018-08-12

Fix Resolution: 1.4.3

Vulnerable Library - content-type-parser-1.0.2.tgz

Parse the value of the Content-Type header

Library home page: https://registry.npmjs.org/content-type-parser/-/content-type-parser-1.0.2.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/content-type-parser/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • jest-environment-jsdom-20.0.3.tgz
        • jsdom-9.12.0.tgz
          • ❌ content-type-parser-1.0.2.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

all versions prior to 2.0.0 of content-type-parser npm package are vulnerable to ReDoS via the user agent parser. the vulnerability was fixed by reintroducing a new parser and deleting the old one.

Publish Date: 2017-12-10

URL: WS-2017-3757

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

Suggested Fix

Type: Upgrade version

Origin: jsdom/whatwg-mimetype#3

Release Date: 2020-04-30

Fix Resolution: v2.0.0

Vulnerable Library - http-proxy-1.17.0.tgz

HTTP proxying for the masses

Library home page: https://registry.npmjs.org/http-proxy/-/http-proxy-1.17.0.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • webpack-dev-server-2.9.4.tgz
    • http-proxy-middleware-0.17.4.tgz
      • ❌ http-proxy-1.17.0.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.

Publish Date: 2020-05-14

URL: WS-2020-0091

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1486

Release Date: 2020-05-26

Fix Resolution: http-proxy - 1.18.1

Vulnerable Library - elliptic-6.4.0.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.4.0.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/elliptic/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • webpack-3.8.1.tgz
    • node-libs-browser-2.1.0.tgz
      • crypto-browserify-3.12.0.tgz
        • browserify-sign-4.0.4.tgz
          • ❌ elliptic-6.4.0.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

all versions of elliptic are vulnerable to Timing Attack through side-channels.

Publish Date: 2019-11-13

URL: WS-2019-0424

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Adjacent
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: High
  • Availability Impact: None

Vulnerable Libraries - jquery-3.3.1.min.js, jquery-2.1.4.min.js, jquery-3.3.1.js, jquery-1.7.1.min.js

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json

Dependency Hierarchy:

• react-redux-5.0.7.tgz (Root Library)
  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11

Vulnerable Library - bcrypt-3.0.0.tgz

A bcrypt library for NodeJS.

Library home page: https://registry.npmjs.org/bcrypt/-/bcrypt-3.0.0.tgz

Dependency Hierarchy:

• ❌ bcrypt-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Data is truncated wrong when its length is greater than 255 bytes.

Publish Date: 2020-07-01

URL: CVE-2020-7689

CVSS 3 Score Details (5.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: N/A
  • Attack Complexity: N/A
  • Privileges Required: N/A
  • User Interaction: N/A
  • Scope: N/A
• Impact Metrics:
  • Confidentiality Impact: N/A
  • Integrity Impact: N/A
  • Availability Impact: N/A

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7689

Release Date: 2020-07-01

Fix Resolution: 5.0.0

Vulnerable Library - react-dev-utils-5.0.1.tgz

Webpack utilities used by Create React App

Library home page: https://registry.npmjs.org/react-dev-utils/-/react-dev-utils-5.0.1.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/react-dev-utils/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • ❌ react-dev-utils-5.0.1.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

react-dev-utils on Windows allows developers to run a local webserver for accepting various commands, including a command to launch an editor. The input to that command was not properly sanitized, allowing an attacker who can make a network request to the server (either via CSRF or by direct request) to execute arbitrary commands on the targeted system. This issue affects multiple branches: 1.x.x prior to 1.0.4, 2.x.x prior to 2.0.2, 3.x.x prior to 3.1.2, 4.x.x prior to 4.2.2, and 5.x.x prior to 5.0.2.

Publish Date: 2018-12-31

URL: CVE-2018-6342

CVSS 3 Score Details (8.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-6342

Release Date: 2018-12-31

Fix Resolution: 1.0.4,2.0.2,3.1.2,4.2.2,5.0.2

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-redux-todos/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/http-proxy-middleware/node_modules/braces/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • webpack-dev-server-2.9.4.tgz
    • chokidar-1.7.0.tgz
      • anymatch-1.3.2.tgz
        • micromatch-2.3.11.tgz
          • ❌ braces-1.8.5.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2018-02-16

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1

Vulnerable Library - dot-prop-4.2.0.tgz

Get, set, or delete a property from a nested object using a dot path

Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-redux-todos/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/dot-prop/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • sw-precache-webpack-plugin-0.11.4.tgz
    • sw-precache-5.2.1.tgz
      • update-notifier-2.5.0.tgz
        • configstore-3.1.2.tgz
          • ❌ dot-prop-4.2.0.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Prototype pollution vulnerability in dot-prop npm package version 5.1.0 and earlier allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Publish Date: 2020-02-04

URL: CVE-2020-8116

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116

Release Date: 2020-02-04

Fix Resolution: dot-prop - 5.1.1

Vulnerable Library - handlebars-4.0.11.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.0.11.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/handlebars/package.json

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • jest-20.0.4.tgz
    • jest-cli-20.0.4.tgz
      • istanbul-api-1.3.1.tgz
        • istanbul-reports-1.3.0.tgz
          • ❌ handlebars-4.0.11.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Prototype Pollution vulnerability found in handlebars.js before 4.5.3. Attacker may use Remote-Code-Execution exploits.

Publish Date: 2019-11-17

URL: WS-2019-0369

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: https://github.com/wycats/handlebars.js/blob/master/release-notes.md#v453---november-18th-2019

Release Date: 2020-01-08

Fix Resolution: handlebars - 4.5.3

Vulnerable Library - lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/package.json

Path to vulnerable library: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json,/tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/lodash/package.json

Dependency Hierarchy:

• react-redux-5.0.7.tgz (Root Library)
  • ❌ lodash-4.17.10.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@a01e4fa

Release Date: 2019-07-08

Fix Resolution: 4.17.12

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/hapi/html/index.html

Path to vulnerable library: /advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/recipe-app-with-state/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/hacker-news/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/helloworld/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/helloworld/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section30-Building-A-FullStack-App-With-React/fullstack-todo-app/todos-react-frontent/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section33-In-Depth-Redux-Code-Walkthrough/react-redux-todos/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/random-boxes-starter/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/helloworld/node_modules/sockjs/examples/multiplex/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/helloworld/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/helloworld/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section34-37-Warbler-Final-Project/warbler/warbler-client/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section28-The-Virtual-DOM-Events-and-Forms/memory-game-exercise/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/sockjs/examples/hapi/html/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section29-Component-LifeCycle-Methods/flag-guessing-game/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/node_modules/sockjs/examples/echo/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/sockjs/examples/express/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/sockjs/examples/express-3.x/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/pass-state-to-props-demo/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section27-State/update-complex-state/node_modules/vm-browserify/example/run/index.html,/advanced-web-developer-bootcamp-notes-examples-and-exercises/Section26-Create-React-App-and-Props/recipe-props-starter/node_modules/sockjs/examples/multiplex/index.html

Dependency Hierarchy:

• ❌ jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Publish Date: 2020-05-19

URL: CVE-2020-7656

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: rails/jquery-rails@8f601cb

Release Date: 2020-05-19

Fix Resolution: jquery-rails - 2.2.0

Vulnerable Library - tar-4.4.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-4.4.1.tgz

Dependency Hierarchy:

• react-scripts-1.1.4.tgz (Root Library)
  • fsevents-1.2.4.tgz
    • node-pre-gyp-0.10.0.tgz
      • ❌ tar-4.4.1.tgz (Vulnerable Library)

Found in HEAD commit: d80f181a2f4dd1169fbef38813309ffdd4ad82d4

Vulnerability Details

A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).

Publish Date: 2019-04-30

URL: CVE-2018-20834

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20834

Release Date: 2019-04-30

Fix Resolution: tar - 2.2.2,4.4.2