The nextjs-enterprise-boilerplate from tuanductran

release-notes-generator-11.0.3.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - release-notes-generator-11.0.3.tgz

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (release-notes-generator version)	Remediation Available
CVE-2022-25883	Medium	5.3	semver-6.3.0.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-25883

Vulnerable Library - semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Dependency Hierarchy:

release-notes-generator-11.0.3.tgz (Root Library)
- conventional-changelog-writer-6.0.0.tgz
  - ❌ semver-6.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-06-21

Fix Resolution: semver - 7.5.2

Step up your Open Source Security Game with Mend here

otel-0.3.0.tgz: 1 vulnerabilities (highest severity is: 5.5)

Vulnerable Library - otel-0.3.0.tgz

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (otel version)	Remediation Available
CVE-2023-36665	Medium	5.5	protobufjs-7.2.3.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2023-36665

Vulnerable Library - protobufjs-7.2.3.tgz

Library home page: https://registry.npmjs.org/protobufjs/-/protobufjs-7.2.3.tgz

Dependency Hierarchy:

otel-0.3.0.tgz (Root Library)
- exporter-trace-otlp-grpc-0.38.0.tgz
  - otlp-grpc-exporter-base-0.38.0.tgz
    - proto-loader-0.7.7.tgz
      - ❌ protobufjs-7.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Found in base branch: main

Vulnerability Details

protobuf.js (aka protobufjs) 6.10.0 through 7.x before 7.2.4 allows Prototype Pollution, a different vulnerability than CVE-2022-25878. A user-controlled protobuf message can be used by an attacker to pollute the prototype of Object.prototype by adding and overwriting its data and functions. Exploitation can involve: (1) using the function parse to parse protobuf messages on the fly, (2) loading .proto files by using load/loadSync functions, or (3) providing untrusted input to the functions ReflectionObject.setParsedOption and util.setProperty. NOTE: this CVE Record is about "Object.constructor.prototype. = ...;" whereas CVE-2022-25878 was about "Object.proto. = ...;" instead.

Publish Date: 2023-07-05

URL: CVE-2023-36665

CVSS 3 Score Details (5.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.code-intelligence.com/blog/cve-protobufjs-prototype-pollution-cve-2023-36665

Release Date: 2023-07-05

Fix Resolution: protobufjs - 7.2.4

Step up your Open Source Security Game with Mend here

npm-10.0.4.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - npm-10.0.4.tgz

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (npm version)	Remediation Available
CVE-2022-25883	Medium	5.3	semver-7.5.1.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-25883

Vulnerable Library - semver-7.5.1.tgz

Library home page: https://registry.npmjs.org/semver/-/semver-7.5.1.tgz

Dependency Hierarchy:

npm-10.0.4.tgz (Root Library)
- ❌ semver-7.5.1.tgz (Vulnerable Library)

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-06-21

Fix Resolution: semver - 7.5.2

Step up your Open Source Security Game with Mend here

commit-analyzer-10.0.1.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - commit-analyzer-10.0.1.tgz

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (commit-analyzer version)	Remediation Available
CVE-2022-25883	Medium	5.3	semver-5.7.1.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-25883

Vulnerable Library - semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Dependency Hierarchy:

commit-analyzer-10.0.1.tgz (Root Library)
- conventional-commits-parser-4.0.0.tgz
  - meow-8.1.2.tgz
    - read-pkg-up-7.0.1.tgz
      - read-pkg-5.2.0.tgz
        
        normalize-package-data-2.5.0.tgz
        
        ❌ semver-5.7.1.tgz (Vulnerable Library)

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-06-21

Fix Resolution: semver - 7.5.2

Step up your Open Source Security Game with Mend here

release-notes-generator-11.0.4.tgz: 1 vulnerabilities (highest severity is: 5.3)

Vulnerable Library - release-notes-generator-11.0.4.tgz

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (release-notes-generator version)	Remediation Available
CVE-2022-25883	Medium	5.3	semver-6.3.0.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-25883

Vulnerable Library - semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Dependency Hierarchy:

release-notes-generator-11.0.4.tgz (Root Library)
- conventional-changelog-writer-6.0.0.tgz
  - ❌ semver-6.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Found in base branch: main

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-06-21

Fix Resolution: semver - 7.5.2

Step up your Open Source Security Game with Mend here

Dependency Dashboard

This issue lists Renovate updates and detected dependencies. Read the Dependency Dashboard docs to learn more.

Rate-Limited

These updates are currently rate-limited. Click on a checkbox below to force their creation now.

Open

These updates have all been created already. Click a checkbox below to force a retry/rebase of any.

Detected dependencies

github-actions

.github/workflows/codeql.yml

actions/checkout v4

github/codeql-action v2

github/codeql-action v2

github/codeql-action v2

npm

package.json

@next/bundle-analyzer ^14.0.0

@radix-ui/react-accordion ^1.1.1

@radix-ui/react-checkbox ^1.0.3

@radix-ui/react-dialog ^1.0.3

@radix-ui/react-dropdown-menu ^2.0.4

@radix-ui/react-form ^0.0.3

@radix-ui/react-label ^2.0.1

@radix-ui/react-popover ^1.0.5

@radix-ui/react-radio-group ^1.1.2

@radix-ui/react-scroll-area ^1.0.3

@radix-ui/react-select 2.0.0

@radix-ui/react-slider ^1.1.1

@radix-ui/react-switch ^1.0.2

@radix-ui/react-tabs ^1.0.3

@radix-ui/react-toggle-group ^1.0.3

@radix-ui/react-tooltip ^1.0.5

@semantic-release/changelog ^6.0.3

@semantic-release/commit-analyzer ^11.0.0

@semantic-release/git ^10.0.1

@semantic-release/github ^9.0.0

@semantic-release/npm ^11.0.0

@semantic-release/release-notes-generator ^12.0.0

@t3-oss/env-nextjs ^0.7.0

@vercel/otel ^0.3.0

class-variance-authority ^0.7.0

lodash ^4.17.21

next ^14.0.0

next-compose-plugins ^2.2.1

react ^18.2.0

react-dom ^18.2.0

tailwind-merge ^2.0.0

zod ^3.21.4

@babel/core ^7.0.0

@jest/globals ^29.5.0

@opentelemetry/api ^1.4.1

@playwright/test ^1.32.3

@storybook/addon-essentials ^7.0.5

@storybook/addon-interactions ^7.0.5

@storybook/addon-links ^7.0.5

@storybook/blocks ^7.0.5

@storybook/nextjs ^7.0.5

@storybook/react ^7.0.5

@storybook/test-runner ^0.16.0

@storybook/testing-library ^0.2.0

@testing-library/jest-dom ^6.0.0

@testing-library/react ^14.0.0

@total-typescript/ts-reset ^0.5.0

@types/node ^20.3.3

@types/react ^18.0.37

@types/react-dom ^18.0.11

@typescript-eslint/eslint-plugin ^6.0.0

@typescript-eslint/parser ^6.0.0

all-contributors-cli ^6.24.0

autoprefixer ^10.4.14

cross-env ^7.0.3

eslint 8.56.0

eslint-config-next 14.0.3

eslint-config-prettier ^9.0.0

eslint-config-react-app ^7.0.1

eslint-plugin-import ^2.29.0

eslint-plugin-react 7.33.2

eslint-plugin-storybook ^0.6.11

eslint-plugin-tailwindcss ^3.12.1

fetch-mock ^9.11.0

jest ^29.5.0

jest-environment-jsdom ^29.5.0

patch-package ^8.0.0

postcss ^8.4.21

postinstall-postinstall ^2.1.0

prettier-plugin-tailwindcss ^0.5.0

semantic-release ^22.0.0

storybook ^7.0.5

tailwindcss ^3.2.7

ts-jest ^29.1.0

tsc ^2.0.4

typescript 5.3.2

vitest ^0.34.0

node >=18.15.0

yarn 1.22.21

Check this box to trigger a request for Renovate to run again on this repository

next-13.5.2.tgz: 2 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - next-13.5.2.tgz

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (next version)	Remediation Possible**
CVE-2023-4316	High	7.5	zod-3.21.4.tgz	Transitive	N/A*	❌
CVE-2023-44270	Medium	5.3	postcss-8.4.14.tgz	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-4316

Vulnerable Library - zod-3.21.4.tgz

Library home page: https://registry.npmjs.org/zod/-/zod-3.21.4.tgz

Dependency Hierarchy:

next-13.5.2.tgz (Root Library)
- ❌ zod-3.21.4.tgz (Vulnerable Library)

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Found in base branch: main

Vulnerability Details

Zod in version 3.22.2 allows an attacker to perform a denial of service while validating emails

Publish Date: 2023-09-28

URL: CVE-2023-4316

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-mvrp-3cvx-c325

Release Date: 2023-09-28

Fix Resolution: zod - 3.22.3

Step up your Open Source Security Game with Mend here

CVE-2023-44270

Vulnerable Library - postcss-8.4.14.tgz

Tool for transforming styles with JS plugins

Library home page: https://registry.npmjs.org/postcss/-/postcss-8.4.14.tgz

Dependency Hierarchy:

next-13.5.2.tgz (Root Library)
- ❌ postcss-8.4.14.tgz (Vulnerable Library)

Found in HEAD commit: 00e1d64fd7d51c73f9c82e63a3aa3f78df8752c6

Found in base branch: main

Vulnerability Details

An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

Publish Date: 2023-09-29

URL: CVE-2023-44270

CVSS 3 Score Details (5.3)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-44270

Release Date: 2023-09-29

Fix Resolution: postcss - 8.4.31

Step up your Open Source Security Game with Mend here

zod-3.22.2.tgz: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - zod-3.22.2.tgz

Library home page: https://registry.npmjs.org/zod/-/zod-3.22.2.tgz

Found in HEAD commit: 44c39cf0440487751726e328272d3e9b2a348f09

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (zod version)	Remediation Possible**
CVE-2023-4316	High	7.5	zod-3.22.2.tgz	Direct	zod - 3.22.3	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-4316

Vulnerable Library - zod-3.22.2.tgz

Library home page: https://registry.npmjs.org/zod/-/zod-3.22.2.tgz

Dependency Hierarchy:

❌ zod-3.22.2.tgz (Vulnerable Library)

Found in HEAD commit: 44c39cf0440487751726e328272d3e9b2a348f09

Found in base branch: main

Vulnerability Details

Zod in version 3.22.2 allows an attacker to perform a denial of service while validating emails

Publish Date: 2023-09-28

URL: CVE-2023-4316

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-mvrp-3cvx-c325

Release Date: 2023-09-28

Fix Resolution: zod - 3.22.3

Step up your Open Source Security Game with Mend here

tuanductran / nextjs-enterprise-boilerplate Goto Github PK

nextjs-enterprise-boilerplate's Introduction

About Me

GitHub Stats

Let's Connect

Skills

nextjs-enterprise-boilerplate's People

Contributors

Stargazers

Watchers

nextjs-enterprise-boilerplate's Issues

Vulnerabilities

Details

Vulnerable Library - semver-6.3.0.tgz

Vulnerability Details

CVSS 3 Score Details (5.3)

Suggested Fix

Vulnerabilities

Details

Vulnerable Library - protobufjs-7.2.3.tgz

Vulnerability Details

CVSS 3 Score Details (5.5)

Suggested Fix

Vulnerabilities

Details

Vulnerable Library - semver-7.5.1.tgz

Vulnerability Details

CVSS 3 Score Details (5.3)

Suggested Fix

Vulnerabilities

Details

Vulnerable Library - semver-5.7.1.tgz

Vulnerability Details

CVSS 3 Score Details (5.3)

Suggested Fix

Vulnerabilities

Details

Vulnerable Library - semver-6.3.0.tgz

Vulnerability Details

CVSS 3 Score Details (5.3)

Suggested Fix

Rate-Limited

Open

Detected dependencies

Vulnerabilities

Details

Vulnerable Library - zod-3.21.4.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - postcss-8.4.14.tgz

Vulnerability Details

CVSS 3 Score Details (5.3)

Suggested Fix

Vulnerabilities

Details

Vulnerable Library - zod-3.22.2.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Recommend Projects

Recommend Topics

Recommend Org