Bulk vulnerability fix - Lockfile fix #253
Open
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Bulk vulnerability fix - Lockfile fix
This pull request will update your transitive dependencies within the allowed version intervals provided by your direct dependencies.
Fixed vulnerabilities:
CVE–2019–10744![debricked](https://camo.githubusercontent.com/8bf901398d15f9e5110f0766fe7a8c53f83e9db809c89735f56951fbc56b2880/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f637269746963616c332d322d30312e737667)
Description
NVD
GitHub
CVSS details -
9.1
References
CVE-2019-10744 Lodash Vulnerability in NetApp Products | NetApp Product Security![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Red Hat Customer Portal - Access to 24x7 support and knowledge
CONFIRM
Oracle Critical Patch Update Advisory - October 2020
Oracle Critical Patch Update Advisory - January 2021
CVE–2020–8203![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Allocation of Resources Without Limits or Throttling
NVD
CVSS details -
7.4
References
HackerOne![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
CVE-2020-8203 Lodash Vulnerability in NetApp Products | NetApp Product Security
CVE-2020-8203 is not modified in /.internal/baseSet.js · Issue #4874 · lodash/lodash · GitHub
Oracle Critical Patch Update Advisory - April 2021
CVE–2020–28500![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
NVD
CVSS details -
5.3
References
CONFIRM![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
perf: improve performance of
toNumber
,trim
andtrimEnd
on large input strings by falsyvalues · Pull Request #5065 · lodash/lodash · GitHubFebruary 2021 Lodash Vulnerabilities in NetApp Products | NetApp Product Security
CVE–2021–23337![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Improper Neutralization of Special Elements used in a Command ('Command Injection')
NVD
GitHub
CVSS details -
7.2
References
MISC![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
February 2021 Lodash Vulnerabilities in NetApp Products | NetApp Product Security
lodash/lodash.js at ddfd9b11a0126db2302cb70ec9973b66baec0975 · lodash/lodash · GitHub
NVD - CVE-2021-23337
Prevent command injection through
_.template
'svariable
option · lodash/lodash@3469357 · GitHubCommand Injection in lodash · CVE-2021-23337 · GitHub Advisory Database · GitHub
CVE–2021–23343![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
NVD
CVSS details -
7.5
References
ReDoS in path-parse · Issue #8 · jbgutierrez/path-parse · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Pony Mail!
CVE–2020–7598![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
Improper Input Validation
NVD
GitHub
CVSS details -
5.6
References
[security-announce] openSUSE-SU-2020:0802-1: critical: Security update for nodejs8 - openSUSE Security Announce - openSUSE Mailing Lists![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
NVD - CVE-2020-7598
even more aggressive checks for protocol pollution · substack/minimist@38a4d1c · GitHub
Prototype Pollution in minimist · CVE-2020-7598 · GitHub Advisory Database · GitHub
don't assign onto proto · substack/minimist@63e7ed0 · GitHub
CVE–2021–29060![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
Allocation of Resources Without Limits or Throttling
NVD
GitHub
CVSS details -
5.3
References
SaveResults/color-string.js at main · yetingli/SaveResults · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
PoCs/Color-String.md at main · yetingli/PoCs · GitHub
fix ReDos in hwb() parser (low-severity) · Qix-/color-string@0789e21 · GitHub
color-string - npm
CVE–2020–7774![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Improper Input Validation
NVD
CVSS details -
7.3
References
Prototype pollution · Issue #96 · yargs/y18n · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
fix: address prototype pollution issue by bcoe · Pull Request #108 · yargs/y18n · GitHub
Oracle Critical Patch Update Advisory - April 2021
CVE–2020–7733![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Improper Neutralization of Special Elements used in an Expression Language Statement ('Expression Language Injection')
NVD
GitHub
CVSS details -
7.5
References
Fix potential ReDoS vulnerability · faisalman/ua-parser-js@233d3ba · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
NVD - CVE-2020-7733
GitHub - faisalman/ua-parser-js: UAParser.js - Detect Browser, Engine, OS, CPU, and Device type/model from User-Agent data. Supports browser & node.js environment.
Regular Expression Denial of Service in ua-parser-js · CVE-2020-7733 · GitHub Advisory Database · GitHub
GitHub - faisalman/ua-parser-js: UAParser.js - Detect Browser, Engine, OS, CPU, and Device type/model from User-Agent data. Supports browser & node.js environment.
CVE–2020–7793![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Uncontrolled Resource Consumption
NVD
CVSS details -
7.5
References
Fix ReDoS vulnerabilities reported by Snyk · faisalman/ua-parser-js@6d1f26d · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
CVE–2021–27292![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
NVD
GitHub
CVSS details -
7.5
References
cve-2021-27292 · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Fix several exponential/cubic complexity regexes found by Ben Caller/… · pygments/pygments@2e7e8c4 · GitHub
Fix potential ReDoS vulnerability as reported by Doyensec · faisalman/ua-parser-js@809439e · GitHub
Regular Expression Denial of Service (ReDoS) in ua-parser-js · CVE-2021-27292 · GitHub Advisory Database · GitHub
NVD - CVE-2021-27292
CVE–2021–23368![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
NVD
CVSS details -
5.3
References
Fix unsafe regexp · postcss/postcss@8682b1e · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Fix unsafe regexp in getAnnotationURL() too · postcss/postcss@b6f3e4d · GitHub
Pony Mail!
Pony Mail!
Pony Mail!
Pony Mail!
Pony Mail!
Pony Mail!
CVE–2020–8116![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Direct Request ('Forced Browsing')
NVD
GitHub
CVSS details -
7.3
References
HackerOne![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Prototype Pollution in dot-prop · CVE-2020-8116 · GitHub Advisory Database · GitHub
GitHub - sindresorhus/dot-prop at v4
NVD - CVE-2020-8116
Please backport CVE-2020-8116 security fix to 4.x. · Issue #63 · sindresorhus/dot-prop · GitHub
CVE–2021–28092![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
NVD
GitHub
CVSS details -
7.5
References
Releases · sindresorhus/is-svg · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Release v4.2.2 · sindresorhus/is-svg · GitHub
is-svg - npm
CVE-2021-28092 Node.js Vulnerability in NetApp Products | NetApp Product Security
CVE–2021–29059![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Allocation of Resources Without Limits or Throttling
NVD
CVSS details -
7.5
References
SaveResults/is-svg.js at main · yetingli/SaveResults · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
is-svg - npm
Release v4.3.0 · sindresorhus/is-svg · GitHub
PoCs/IS-SVG.md at main · yetingli/PoCs · GitHub
CVE–2019–10747![debricked](https://camo.githubusercontent.com/8bf901398d15f9e5110f0766fe7a8c53f83e9db809c89735f56951fbc56b2880/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f637269746963616c332d322d30312e737667)
Description
Uncontrolled Resource Consumption
NVD
GitHub
CVSS details -
9.8
References
Pony Mail!![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
[SECURITY] Fedora 30 Update: nodejs-set-value-2.0.1-1.fc30 - package-announce - Fedora Mailing-Lists
[SECURITY] Fedora 31 Update: nodejs-set-value-2.0.1-1.fc31 - package-announce - Fedora Mailing-Lists
disallow proto keys · jonschlinkert/set-value@95e9d99 · GitHub
NVD - CVE-2019-10747
GitHub - jonschlinkert/set-value: Set nested properties on an object using dot-notation.
Prototype Pollution in set-value · CVE-2019-10747 · GitHub Advisory Database · GitHub
CVE–2021–25949![debricked](https://camo.githubusercontent.com/8bf901398d15f9e5110f0766fe7a8c53f83e9db809c89735f56951fbc56b2880/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f637269746963616c332d322d30312e737667)
Description
NVD
CVSS details -
9.8
References
CVE-2021-25949 | WhiteSource Vulnerability Database![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
set-getter/index.js at 5bc2750fe1c3db9651d936131be187744111378d · doowb/set-getter · GitHub
CVE–2019–10746![debricked](https://camo.githubusercontent.com/8bf901398d15f9e5110f0766fe7a8c53f83e9db809c89735f56951fbc56b2880/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f637269746963616c332d322d30312e737667)
Description
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')
NVD
GitHub
CVSS details -
9.8
References
[SECURITY] Fedora 30 Update: nodejs-mixin-deep-1.3.2-1.fc30 - package-announce - Fedora Mailing-Lists![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
[SECURITY] Fedora 31 Update: nodejs-mixin-deep-1.3.2-1.fc31 - package-announce - Fedora Mailing-Lists
Prototype Pollution in mixin-deep · CVE-2019-10746 · GitHub Advisory Database · GitHub
disallow constructor and prototype keys · jonschlinkert/mixin-deep@8f464c8 · GitHub
NVD - CVE-2019-10746
GitHub - jonschlinkert/mixin-deep: Deeply mix the properties of objects into the first object, while also mixing-in child objects.
debricked–124
Description
GitHub
CVSS details
No information
References
security fix for 6.x versions · Issue #929 · acornjs/acorn · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Regular Expression Denial of Service in Acorn · GHSA-6chw-6frg-f759 · GitHub Advisory Database · GitHub
CVE–2019–20149![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Exposure of Resource to Wrong Sphere
NVD
GitHub
CVSS details -
7.5
References
type checking · Issue #30 · jonschlinkert/kind-of · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
fix type checking vul in ctorName by xiaofen9 · Pull Request #31 · jonschlinkert/kind-of · GitHub
Validation Bypass in kind-of · CVE-2019-20149 · GitHub Advisory Database · GitHub
NVD - CVE-2019-20149
CVE–2020–13822![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Integer Overflow or Wraparound
NVD
GitHub
CVSS details -
7.7
References
Lack of encoding checks allows a certain degree of signature malleability in ECDSA signatures · Issue #226 · indutny/elliptic · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Malleability-Attack: Why It Matters | by Herman Schoenfeld | Medium
elliptic - npm
How Not to Use ECDSA – Learning Words
NVD - CVE-2020-13822
GitHub - indutny/elliptic: Fast Elliptic Curve Cryptography in plain javascript
Signature Malleabillity in elliptic · CVE-2020-13822 · GitHub Advisory Database · GitHub
CVE–2020–28498![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
Use of a Broken or Risky Cryptographic Algorithm
NVD
GitHub
CVSS details -
6.8
References
blog/secp256k1_twist_attacks.md at master · christianlundkvist/blog · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
ec: validate that a point before deriving keys · indutny/elliptic@441b742 · GitHub
Use of a Broken or Risky Cryptographic Algorithm · CVE-2020-28498 · GitHub Advisory Database · GitHub
Private by kdenhartog · Pull Request #244 · indutny/elliptic · GitHub
NVD - CVE-2020-28498
CVE–2020–7608![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
Improper Input Validation
NVD
NVD
CVSS details -
5.3
References
THIRD PARTY![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
fix: proto will now be replaced with proto in parse (#258) · yargs/yargs-parser@63810ca · GitHub
debricked–149739
Description
GitHub
CVSS details
No information
References
fix: proto will now be replaced with proto in parse (#258) · yargs/yargs-parser@63810ca · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Prototype Pollution in yargs-parser · CVE-2020-7608 · GitHub Advisory Database · GitHub
CVE–2021–23329![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
NVD
GitHub
CVSS details -
7.5
References
Security Fix for Prototype Pollution - huntr.dev by huntr-helper · Pull Request #11 · Geta/NestedObjectAssign · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
NVD - CVE-2021-23329
Prototype pollution in nested-object-assign · CVE-2021-23329 · GitHub Advisory Database · GitHub
CVE–2018–3774![debricked](https://camo.githubusercontent.com/8bf901398d15f9e5110f0766fe7a8c53f83e9db809c89735f56951fbc56b2880/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f637269746963616c332d322d30312e737667)
Description
URL Redirection to Untrusted Site ('Open Redirect')
NVD
GitHub
CVSS details -
10
References
[security] Sanitize paths, hosts before parsing. · unshiftio/url-parse@53b1794 · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
[security] Added missing SECURITY.md · unshiftio/url-parse@d7b582e · GitHub
HackerOne
NVD - CVE-2018-3774
Open Redirect in url-parse · CVE-2018-3774 · GitHub Advisory Database · GitHub
CVE–2020–8124![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
Improper Input Validation
NVD
NVD
CVSS details -
5.3
References
THIRD PARTY![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
HackerOne
CVE–2021–27515![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
NVD
GitHub
CVSS details -
5.3
References
[security] More backslash fixes (#197) · unshiftio/url-parse@d1e7e88 · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Comparing 1.4.7...1.5.0 · unshiftio/url-parse · GitHub
[security] More backslash fixes by 3rd-Eden · Pull Request #197 · unshiftio/url-parse · GitHub
MISC
NVD - CVE-2021-27515
Path traversal in url-parse · CVE-2021-27515 · GitHub Advisory Database · GitHub
CVE–2020–7662![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
NVD
GitHub
CVSS details -
7.5
References
ReDoS vulnerability in websocket-extensions – The If Works![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Remove ReDoS vulnerability in the Sec-WebSocket-Extensions header parser · faye/websocket-extensions-node@29496f6 · GitHub
ReDoS vulnerability in Sec-WebSocket-Extensions parser · Advisory · faye/websocket-extensions-node · GitHub
Regular Expression Denial of Service in websocket-extensions (NPM package) · CVE-2020-7662 · GitHub Advisory Database · GitHub
NVD - CVE-2020-7662
Remove ReDoS vulnerability in the Sec-WebSocket-Extensions header parser · faye/websocket-extensions-ruby@aa156a4 · GitHub
CVE–2021–26707![debricked](https://camo.githubusercontent.com/8bf901398d15f9e5110f0766fe7a8c53f83e9db809c89735f56951fbc56b2880/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f637269746963616c332d322d30312e737667)
Description
NVD
GitHub
CVSS details -
9.8
References
add isValidKey function to ensure only valid keys are merged · jonschlinkert/merge-deep@11e5dd5 · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
merge-deep - npm
GHSL-2020-160: Prototype pollution in Merge-deep | GitHub Security Lab
CVE–2021–23362![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
NVD
GitHub
CVSS details -
5.3
References
Commits · npm/hosted-git-info · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
fix: backport regex fix from #76 · npm/hosted-git-info@29adfe5 · GitHub
chore(release): 2.8.9 · npm/hosted-git-info@8d4b369 · GitHub
fix: simplify the regular expression for shortcut matching · npm/hosted-git-info@bede0dc · GitHub
NVD - CVE-2021-23362
Regular Expression Denial of Service in hosted-git-info · CVE-2021-23362 · GitHub Advisory Database · GitHub
CVE–2021–23358![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Improper Control of Generation of Code ('Code Injection')
NVD
GitHub
CVSS details -
7.2
References
MISC![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
[SECURITY] [DLA 2613-1] underscore security update
Debian -- Security Information -- DSA-4883-1 underscore
Pony Mail!
Pony Mail!
Pony Mail!
Pony Mail!
Pony Mail!
underscore/template.js at master · jashkenas/underscore · GitHub
NVD - CVE-2021-23358
underscore/template.js at cb5f6fc6c2400649d942f1e36f9e5191fb7a1bf1 · jashkenas/underscore · GitHub
Arbitrary Code Execution in underscore · CVE-2021-23358 · GitHub Advisory Database · GitHub
Fix #2911 · jashkenas/underscore@4c73526 · GitHub
CVE–2019–15657![debricked](https://camo.githubusercontent.com/8bf901398d15f9e5110f0766fe7a8c53f83e9db809c89735f56951fbc56b2880/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f637269746963616c332d322d30312e737667)
Description
NVD
GitHub
CVSS details -
9.8
References
'getStaticValue' function can execute arbitrary code · Advisory · mysticatea/eslint-utils · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
NVD - CVE-2019-15657
Arbitrary Code Execution in eslint-utils · CVE-2019-15657 · GitHub Advisory Database · GitHub
CVE–2019–20922![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Loop with Unreachable Exit Condition ('Infinite Loop')
NVD
CVSS details -
7.5
References
fix: non-eager matching raw-block-contents · handlebars-lang/handlebars.js@8d5530e · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
npm
CVE–2019–20920![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Improper Control of Generation of Code ('Code Injection')
NVD
CVSS details -
8.1
References
npm![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
npm
CVE–2021–23369![debricked](https://camo.githubusercontent.com/8bf901398d15f9e5110f0766fe7a8c53f83e9db809c89735f56951fbc56b2880/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f637269746963616c332d322d30312e737667)
Description
NVD
GitHub
CVSS details -
9.8
References
CVE-2021-23369 Node.js Vulnerability in NetApp Products | NetApp Product Security![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
fix: check prototype property access in strict-mode (#1736) · handlebars-lang/handlebars.js@b6d3de7 · GitHub
fix: escape property names in compat mode (#1736) · handlebars-lang/handlebars.js@f058970 · GitHub
CVE–2021–23383![debricked](https://camo.githubusercontent.com/8bf901398d15f9e5110f0766fe7a8c53f83e9db809c89735f56951fbc56b2880/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f637269746963616c332d322d30312e737667)
Description
NVD
CVSS details -
9.8
References
fix: escape property names in compat mode (#1736) · handlebars-lang/handlebars.js@f058970 · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
CVE-2021-23383 Node.js Vulnerability in NetApp Products | NetApp Product Security
CVE–2018–16469![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Improper Input Validation
NVD
GitHub
CVSS details -
7.5
References
HackerOne![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Prototype Pollution in merge · CVE-2018-16469 · GitHub Advisory Database · GitHub
NVD - CVE-2018-16469
CVE–2020–28499![debricked](https://camo.githubusercontent.com/8bf901398d15f9e5110f0766fe7a8c53f83e9db809c89735f56951fbc56b2880/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f637269746963616c332d322d30312e737667)
Description
NVD
GitHub
CVSS details -
9.8
References
CVE-2020-28499 | merge Package Prototype _recursiveMerge code injection (SNYK-JS-MERGE-1042987)![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
CONFIRM
CVE–2017–16028![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)
NVD
GitHub
CVSS details -
5.3
References
nodesecurity.io - nodesecurity Resources and Information.![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
react-native-meteor-oauth/meteor-oauth.js at a7eb738b74c469f5db20296b44b7cae4e2337435 · tableflip/react-native-meteor-oauth · GitHub
use cryptographically secure random function · jonschlinkert/randomatic@4a52695 · GitHub
NVD - CVE-2017-16028
Cryptographically Weak PRNG in randomatic · CVE-2017-16028 · GitHub Advisory Database · GitHub
CVE–2018–14732![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Improper Input Validation
NVD
GitHub
CVSS details -
7.5
References
crblog![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
check origin header for websocket connection · webpack/webpack-dev-server@f18e5ad · GitHub
A vulnerability found in webpack-dev-server · Issue #1445 · webpack/webpack-dev-server · GitHub
NVD - CVE-2018-14732
Missing Origin Validation in webpack-dev-server · CVE-2018-14732 · GitHub Advisory Database · GitHub
CVE–2021–23386![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
Exposure of Sensitive Information to an Unauthorized Actor
NVD
GitHub
CVSS details -
6.5
References
HackerOne![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
do trim on encodingLength as well · mafintosh/dns-packet@25f15dd · GitHub
debricked–149740
Description
GitHub
CVSS details
No information
References
Denial of Service in http-proxy · GHSA-6x33-pw7p-hmpq · GitHub Advisory Database · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Skip sending the proxyReq event when the expect header is present by jsmylnycky · Pull Request #1447 · http-party/node-http-proxy · GitHub
CVE–2020–7720![debricked](https://camo.githubusercontent.com/17301c3d03e976e0a3b68994145618b4a57d1bddde5da8260cde05abca29dcb6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f68696768332d322d30312e737667)
Description
Improper Input Validation
NVD
GitHub
CVSS details -
7.3
References
forge/CHANGELOG.md at master · digitalbazaar/forge · GitHub![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
NVD - CVE-2020-7720
Prototype Pollution in node-forge · CVE-2020-7720 · GitHub Advisory Database · GitHub
GitHub - digitalbazaar/forge: A native implementation of TLS in Javascript and tools to write crypto-based and network-heavy webapps
CVE–2020–7693![debricked](https://camo.githubusercontent.com/17285c0c5510856ee37fd1f800c1eadb839a446cfc4e720113cd4580ca6043b6/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6d656469756d332d322d30312e737667)
Description
Improper Input Validation
NVD
GitHub
CVSS details -
5.3
References
GitHub - andsnw/sockjs-dos-py: CVE-2020-7693: SockJS 0.3.19 Denial of Service POC![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
![link](https://camo.githubusercontent.com/cd903ee5b5dc5ad9d0d066b7e984f0eaae944c17e8b77a94cb2bfa44086efb4e/68747470733a2f2f6170702e6465627269636b65642e636f6d2f6d656469612f696d616765732f64656661756c745f696d616765732f6d61726b646f776e2f70756c6c5f726571756573742f6c696e6b2d70722d30312e737667)
Merge pull request #266 from cakoose/backport-writeHead-fix · sockjs/sockjs-node@dd7e642 · GitHub
ERR_STREAM_WRITE_AFTER_END when issuing upgrade request on non-existent URL · Issue #252 · sockjs/sockjs-node · GitHub
Call res.write instead of res.end in writeHead by brycekahle · Pull Request #265 · sockjs/sockjs-node · GitHub
NVD - CVE-2020-7693
Improper Input Validation in SocksJS-Node · CVE-2020-7693 · GitHub Advisory Database · GitHub
Related information
📌 Remember! Check the changes to ensure they don't introduce any breaking changes.
📚 Read more at Debricked