|
|
@@ -0,0 +1,3802 @@
|
|
|
+{
|
|
|
+ "auditReportVersion": 2,
|
|
|
+ "vulnerabilities": {
|
|
|
+ "@dcloudio/uni-template-compiler": {
|
|
|
+ "name": "@dcloudio/uni-template-compiler",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": true,
|
|
|
+ "via": [
|
|
|
+ "vue-template-compiler"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@dcloudio/uni-template-compiler"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "@dcloudio/vue-cli-plugin-uni": {
|
|
|
+ "name": "@dcloudio/vue-cli-plugin-uni",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": true,
|
|
|
+ "via": [
|
|
|
+ "postcss-import",
|
|
|
+ "postcss-selector-parser"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@dcloudio/vue-cli-plugin-uni"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "@intervolga/optimize-cssnano-plugin": {
|
|
|
+ "name": "@intervolga/optimize-cssnano-plugin",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "cssnano",
|
|
|
+ "cssnano-preset-default",
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@intervolga/optimize-cssnano-plugin"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "@jest/core": {
|
|
|
+ "name": "@jest/core",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "@jest/reporters",
|
|
|
+ "@jest/transform",
|
|
|
+ "jest-config",
|
|
|
+ "jest-haste-map",
|
|
|
+ "jest-resolve-dependencies",
|
|
|
+ "jest-runner",
|
|
|
+ "jest-runtime",
|
|
|
+ "jest-snapshot"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "jest"
|
|
|
+ ],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@jest/core"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "@jest/reporters": {
|
|
|
+ "name": "@jest/reporters",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "@jest/transform",
|
|
|
+ "jest-haste-map",
|
|
|
+ "node-notifier"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@jest/core"
|
|
|
+ ],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@jest/reporters"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "@jest/test-sequencer": {
|
|
|
+ "name": "@jest/test-sequencer",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "jest-haste-map",
|
|
|
+ "jest-runner",
|
|
|
+ "jest-runtime"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "jest-config"
|
|
|
+ ],
|
|
|
+ "range": "<=26.6.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@jest/test-sequencer"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "@jest/transform": {
|
|
|
+ "name": "@jest/transform",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "jest-haste-map"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "babel-jest",
|
|
|
+ "jest-runtime"
|
|
|
+ ],
|
|
|
+ "range": "<=26.6.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@jest/transform"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "@tootallnate/once": {
|
|
|
+ "name": "@tootallnate/once",
|
|
|
+ "severity": "low",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1119438,
|
|
|
+ "name": "@tootallnate/once",
|
|
|
+ "dependency": "@tootallnate/once",
|
|
|
+ "title": "@tootallnate/once vulnerable to Incorrect Control Flow Scoping",
|
|
|
+ "url": "https://github.com/advisories/GHSA-vpq2-c234-7xj6",
|
|
|
+ "severity": "low",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-705"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 3.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": "<2.0.1"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "http-proxy-agent"
|
|
|
+ ],
|
|
|
+ "range": "<2.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@tootallnate/once"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "@types/webpack-dev-server": {
|
|
|
+ "name": "@types/webpack-dev-server",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "http-proxy-middleware"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "3.11.2 - 4.0.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@types/webpack-dev-server"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "@vue/babel-plugin-jsx": {
|
|
|
+ "name": "@vue/babel-plugin-jsx",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "@vue/babel-plugin-resolve-type"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "1.2.0-alpha.0 - 1.2.0 || 1.5.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@vue/babel-plugin-jsx"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "@vue/babel-plugin-resolve-type": {
|
|
|
+ "name": "@vue/babel-plugin-resolve-type",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "@vue/compiler-sfc"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@vue/babel-plugin-jsx"
|
|
|
+ ],
|
|
|
+ "range": "<=1.2.0-beta.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@vue/babel-plugin-resolve-type"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "@vue/cli-plugin-babel": {
|
|
|
+ "name": "@vue/cli-plugin-babel",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": true,
|
|
|
+ "via": [
|
|
|
+ "@vue/cli-shared-utils",
|
|
|
+ "webpack"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "3.4.0 - 4.5.19",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@vue/cli-plugin-babel"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "@vue/cli-plugin-babel",
|
|
|
+ "version": "5.0.9",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "@vue/cli-plugin-router": {
|
|
|
+ "name": "@vue/cli-plugin-router",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "@vue/cli-shared-utils"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@vue/cli-service"
|
|
|
+ ],
|
|
|
+ "range": "<=4.5.19",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@vue/cli-plugin-router"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "@vue/cli-service": {
|
|
|
+ "name": "@vue/cli-service",
|
|
|
+ "severity": "critical",
|
|
|
+ "isDirect": true,
|
|
|
+ "via": [
|
|
|
+ "@intervolga/optimize-cssnano-plugin",
|
|
|
+ "@vue/cli-plugin-router",
|
|
|
+ "@vue/cli-shared-utils",
|
|
|
+ "@vue/component-compiler-utils",
|
|
|
+ "autoprefixer",
|
|
|
+ "copy-webpack-plugin",
|
|
|
+ "css-loader",
|
|
|
+ "cssnano",
|
|
|
+ "globby",
|
|
|
+ "html-webpack-plugin",
|
|
|
+ "postcss-loader",
|
|
|
+ "terser-webpack-plugin",
|
|
|
+ "vue-loader",
|
|
|
+ "webpack",
|
|
|
+ "webpack-dev-server"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@vue/cli-service"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "@vue/cli-shared-utils": {
|
|
|
+ "name": "@vue/cli-shared-utils",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "request"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@vue/cli-plugin-babel",
|
|
|
+ "@vue/cli-plugin-router"
|
|
|
+ ],
|
|
|
+ "range": "<=4.5.19",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@vue/cli-shared-utils"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "@vue/compiler-sfc": {
|
|
|
+ "name": "@vue/compiler-sfc",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": true,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@vue/babel-plugin-resolve-type",
|
|
|
+ "vue"
|
|
|
+ ],
|
|
|
+ "range": "3.0.0-alpha.0 - 3.0.5",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@vue/compiler-sfc"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "vue",
|
|
|
+ "version": "3.5.44",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "@vue/component-compiler-utils": {
|
|
|
+ "name": "@vue/component-compiler-utils",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss",
|
|
|
+ "postcss-selector-parser"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@vue/cli-service",
|
|
|
+ "vue-loader"
|
|
|
+ ],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/@vue/component-compiler-utils"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "anymatch": {
|
|
|
+ "name": "anymatch",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "micromatch"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "chokidar",
|
|
|
+ "sane"
|
|
|
+ ],
|
|
|
+ "range": "1.2.0 - 2.0.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/sane/node_modules/anymatch",
|
|
|
+ "node_modules/watchpack-chokidar2/node_modules/anymatch",
|
|
|
+ "node_modules/webpack-dev-server/node_modules/anymatch"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "autoprefixer": {
|
|
|
+ "name": "autoprefixer",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "1.0.20131222 - 9.8.8",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/autoprefixer"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "babel-jest": {
|
|
|
+ "name": "babel-jest",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": true,
|
|
|
+ "via": [
|
|
|
+ "@jest/transform"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "jest-config"
|
|
|
+ ],
|
|
|
+ "range": "24.2.0-alpha.0 - 26.6.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/babel-jest"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "babel-jest",
|
|
|
+ "version": "30.5.2",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "body-parser": {
|
|
|
+ "name": "body-parser",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1243073,
|
|
|
+ "name": "body-parser",
|
|
|
+ "dependency": "body-parser",
|
|
|
+ "title": "body-parser vulnerable to Denial of Service via trailing bytes after a compressed request body",
|
|
|
+ "url": "https://github.com/advisories/GHSA-27r3-jxmh-p828",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-248"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<1.20.9"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<1.20.9",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/body-parser"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "brace-expansion": {
|
|
|
+ "name": "brace-expansion",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1240100,
|
|
|
+ "name": "brace-expansion",
|
|
|
+ "dependency": "brace-expansion",
|
|
|
+ "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
|
|
|
+ "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-407"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": "<1.1.21"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1240101,
|
|
|
+ "name": "brace-expansion",
|
|
|
+ "dependency": "brace-expansion",
|
|
|
+ "title": "brace-expansion: Quadratic-time expansion of the `{a},b}` rewrite causes CPU denial of service",
|
|
|
+ "url": "https://github.com/advisories/GHSA-q2hr-2g5m-vwhr",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-407"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": ">=2.0.0 <2.1.7"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1240104,
|
|
|
+ "name": "brace-expansion",
|
|
|
+ "dependency": "brace-expansion",
|
|
|
+ "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
|
|
|
+ "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-674"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<1.1.20"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1240105,
|
|
|
+ "name": "brace-expansion",
|
|
|
+ "dependency": "brace-expansion",
|
|
|
+ "title": "brace-expansion: DoS via uncontrolled recursion on nested brace groups causing stack exhaustion",
|
|
|
+ "url": "https://github.com/advisories/GHSA-qhr7-859c-m2p7",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-674"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": ">=2.0.0 <2.1.6"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1240108,
|
|
|
+ "name": "brace-expansion",
|
|
|
+ "dependency": "brace-expansion",
|
|
|
+ "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
|
|
|
+ "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-674"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<1.1.19"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1240109,
|
|
|
+ "name": "brace-expansion",
|
|
|
+ "dependency": "brace-expansion",
|
|
|
+ "title": "brace-expansion: DoS via uncontrolled recursion in parseCommaParts causing stack exhaustion",
|
|
|
+ "url": "https://github.com/advisories/GHSA-6j4f-fj2g-mc7p",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-674"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": ">=2.0.0 <2.1.5"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=1.1.20 || 2.0.0 - 2.1.6",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/brace-expansion",
|
|
|
+ "node_modules/filelist/node_modules/brace-expansion"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "braces": {
|
|
|
+ "name": "braces",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1098094,
|
|
|
+ "name": "braces",
|
|
|
+ "dependency": "braces",
|
|
|
+ "title": "Uncontrolled resource consumption in braces",
|
|
|
+ "url": "https://github.com/advisories/GHSA-grv7-fg5c-xmjg",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-1050"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<3.0.3"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "chokidar",
|
|
|
+ "micromatch"
|
|
|
+ ],
|
|
|
+ "range": "<3.0.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/globby/node_modules/braces",
|
|
|
+ "node_modules/sane/node_modules/braces",
|
|
|
+ "node_modules/watchpack-chokidar2/node_modules/braces",
|
|
|
+ "node_modules/webpack-dev-server/node_modules/braces",
|
|
|
+ "node_modules/webpack/node_modules/braces"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "browserify-sign": {
|
|
|
+ "name": "browserify-sign",
|
|
|
+ "severity": "low",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "elliptic"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "crypto-browserify"
|
|
|
+ ],
|
|
|
+ "range": ">=2.4.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/browserify-sign"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "chokidar": {
|
|
|
+ "name": "chokidar",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "anymatch",
|
|
|
+ "braces",
|
|
|
+ "readdirp"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "watchpack-chokidar2",
|
|
|
+ "webpack-dev-server"
|
|
|
+ ],
|
|
|
+ "range": "1.3.0 - 2.1.8",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/watchpack-chokidar2/node_modules/chokidar",
|
|
|
+ "node_modules/webpack-dev-server/node_modules/chokidar"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "compression": {
|
|
|
+ "name": "compression",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1241221,
|
|
|
+ "name": "compression",
|
|
|
+ "dependency": "compression",
|
|
|
+ "title": "compression vulnerable to Denial of Service via memory leak on premature response close",
|
|
|
+ "url": "https://github.com/advisories/GHSA-vc2v-76pw-4v95",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-401",
|
|
|
+ "CWE-459"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<1.8.2"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<1.8.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/compression"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "copy-webpack-plugin": {
|
|
|
+ "name": "copy-webpack-plugin",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": true,
|
|
|
+ "via": [
|
|
|
+ "serialize-javascript",
|
|
|
+ "webpack-log"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "4.3.0 - 13.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/copy-webpack-plugin"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "copy-webpack-plugin",
|
|
|
+ "version": "14.0.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "create-ecdh": {
|
|
|
+ "name": "create-ecdh",
|
|
|
+ "severity": "low",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "elliptic"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "crypto-browserify"
|
|
|
+ ],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/create-ecdh"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "crypto-browserify": {
|
|
|
+ "name": "crypto-browserify",
|
|
|
+ "severity": "low",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "browserify-sign",
|
|
|
+ "create-ecdh"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "node-libs-browser"
|
|
|
+ ],
|
|
|
+ "range": ">=3.4.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/crypto-browserify"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "css-declaration-sorter": {
|
|
|
+ "name": "css-declaration-sorter",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=5.1.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/css-declaration-sorter"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "css-loader": {
|
|
|
+ "name": "css-loader",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "icss-utils",
|
|
|
+ "postcss",
|
|
|
+ "postcss-modules-extract-imports",
|
|
|
+ "postcss-modules-local-by-default",
|
|
|
+ "postcss-modules-scope",
|
|
|
+ "postcss-modules-values"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@vue/cli-service"
|
|
|
+ ],
|
|
|
+ "range": "0.15.0 - 4.3.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/css-loader"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "css-select": {
|
|
|
+ "name": "css-select",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "nth-check"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "svgo"
|
|
|
+ ],
|
|
|
+ "range": "<=3.1.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/svgo/node_modules/css-select"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "cssnano": {
|
|
|
+ "name": "cssnano",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "cssnano-preset-default",
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@intervolga/optimize-cssnano-plugin",
|
|
|
+ "@vue/cli-service"
|
|
|
+ ],
|
|
|
+ "range": "<=4.1.11",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/cssnano"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "cssnano-preset-default": {
|
|
|
+ "name": "cssnano-preset-default",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "css-declaration-sorter",
|
|
|
+ "cssnano-util-raw-cache",
|
|
|
+ "postcss",
|
|
|
+ "postcss-calc",
|
|
|
+ "postcss-colormin",
|
|
|
+ "postcss-convert-values",
|
|
|
+ "postcss-discard-comments",
|
|
|
+ "postcss-discard-duplicates",
|
|
|
+ "postcss-discard-empty",
|
|
|
+ "postcss-discard-overridden",
|
|
|
+ "postcss-merge-longhand",
|
|
|
+ "postcss-merge-rules",
|
|
|
+ "postcss-minify-font-values",
|
|
|
+ "postcss-minify-gradients",
|
|
|
+ "postcss-minify-params",
|
|
|
+ "postcss-minify-selectors",
|
|
|
+ "postcss-normalize-charset",
|
|
|
+ "postcss-normalize-display-values",
|
|
|
+ "postcss-normalize-positions",
|
|
|
+ "postcss-normalize-repeat-style",
|
|
|
+ "postcss-normalize-string",
|
|
|
+ "postcss-normalize-timing-functions",
|
|
|
+ "postcss-normalize-unicode",
|
|
|
+ "postcss-normalize-url",
|
|
|
+ "postcss-normalize-whitespace",
|
|
|
+ "postcss-ordered-values",
|
|
|
+ "postcss-reduce-initial",
|
|
|
+ "postcss-reduce-transforms",
|
|
|
+ "postcss-svgo",
|
|
|
+ "postcss-unique-selectors"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "cssnano"
|
|
|
+ ],
|
|
|
+ "range": "<=4.0.8",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/cssnano-preset-default"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "cssnano-util-raw-cache": {
|
|
|
+ "name": "cssnano-util-raw-cache",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/cssnano-util-raw-cache"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "decode-uri-component": {
|
|
|
+ "name": "decode-uri-component",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1147955,
|
|
|
+ "name": "decode-uri-component",
|
|
|
+ "dependency": "decode-uri-component",
|
|
|
+ "title": "decode-uri-component: Denial of service via exponential decoding of malformed percent-encoded input",
|
|
|
+ "url": "https://github.com/advisories/GHSA-vcc3-ghjq-m6fr",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-405",
|
|
|
+ "CWE-407",
|
|
|
+ "CWE-1176"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<=0.4.2"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1243857,
|
|
|
+ "name": "decode-uri-component",
|
|
|
+ "dependency": "decode-uri-component",
|
|
|
+ "title": "decode-uri-component vulnerable to denial of service via quadratic replacement of percent-encoded runs",
|
|
|
+ "url": "https://github.com/advisories/GHSA-qr28-fpjm-wq7f",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-407"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<=0.5.0"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "source-map-resolve"
|
|
|
+ ],
|
|
|
+ "range": "<=0.5.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/decode-uri-component"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "deepmerge": {
|
|
|
+ "name": "deepmerge",
|
|
|
+ "severity": "low",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1243505,
|
|
|
+ "name": "deepmerge",
|
|
|
+ "dependency": "deepmerge",
|
|
|
+ "title": "deepmerge mergeObject() allows prototype poisoning of returned objects",
|
|
|
+ "url": "https://github.com/advisories/GHSA-gcqx-w48m-w2h4",
|
|
|
+ "severity": "low",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-1321"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": ">=4.2.0 <=4.3.1"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "jest-config"
|
|
|
+ ],
|
|
|
+ "range": ">=4.2.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/deepmerge"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "editorconfig": {
|
|
|
+ "name": "editorconfig",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "minimatch"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "js-beautify"
|
|
|
+ ],
|
|
|
+ "range": ">=1.0.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/editorconfig"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "elliptic": {
|
|
|
+ "name": "elliptic",
|
|
|
+ "severity": "low",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1112030,
|
|
|
+ "name": "elliptic",
|
|
|
+ "dependency": "elliptic",
|
|
|
+ "title": "Elliptic Uses a Cryptographic Primitive with a Risky Implementation",
|
|
|
+ "url": "https://github.com/advisories/GHSA-848j-6mx2-7j84",
|
|
|
+ "severity": "low",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-1240"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.6,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L"
|
|
|
+ },
|
|
|
+ "range": "<=6.6.1"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "browserify-sign",
|
|
|
+ "create-ecdh"
|
|
|
+ ],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/elliptic"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "fast-glob": {
|
|
|
+ "name": "fast-glob",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "micromatch"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "globby"
|
|
|
+ ],
|
|
|
+ "range": "<=2.2.7",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/globby/node_modules/fast-glob"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "follow-redirects": {
|
|
|
+ "name": "follow-redirects",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1242604,
|
|
|
+ "name": "follow-redirects",
|
|
|
+ "dependency": "follow-redirects",
|
|
|
+ "title": "follow-redirects array-form headers bypass cross-origin credential stripping",
|
|
|
+ "url": "https://github.com/advisories/GHSA-q3jh-wrc6-jgq8",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-200",
|
|
|
+ "CWE-212"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": ">=1.16.0 <1.16.1"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1242605,
|
|
|
+ "name": "follow-redirects",
|
|
|
+ "dependency": "follow-redirects",
|
|
|
+ "title": "follow-redirects sensitiveHeaders regex escaping can expose credential headers",
|
|
|
+ "url": "https://github.com/advisories/GHSA-8r9p-f939-6h3c",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-185",
|
|
|
+ "CWE-200"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": ">=1.16.0 <1.16.1"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244003,
|
|
|
+ "name": "follow-redirects",
|
|
|
+ "dependency": "follow-redirects",
|
|
|
+ "title": "follow-redirects: Cross-realm sensitiveHeaders arrays are discarded and custom credentials can follow redirects",
|
|
|
+ "url": "https://github.com/advisories/GHSA-mrwp-f3q8-3g9p",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-201"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.9,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N"
|
|
|
+ },
|
|
|
+ "range": ">=1.16.0 <=1.16.1"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "1.16.0 - 1.16.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/follow-redirects"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "form-data": {
|
|
|
+ "name": "form-data",
|
|
|
+ "severity": "critical",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1109540,
|
|
|
+ "name": "form-data",
|
|
|
+ "dependency": "form-data",
|
|
|
+ "title": "form-data uses unsafe random function in form-data for choosing boundary",
|
|
|
+ "url": "https://github.com/advisories/GHSA-fjxv-7rqg-78g4",
|
|
|
+ "severity": "critical",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-330"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<2.5.4"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1120745,
|
|
|
+ "name": "form-data",
|
|
|
+ "dependency": "form-data",
|
|
|
+ "title": "form-data: CRLF injection in form-data via unescaped multipart field names and filenames",
|
|
|
+ "url": "https://github.com/advisories/GHSA-hmw2-7cc7-3qxx",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-93"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<2.5.6"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "request"
|
|
|
+ ],
|
|
|
+ "range": "<=2.5.5",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/request/node_modules/form-data"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "glob": {
|
|
|
+ "name": "glob",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1244013,
|
|
|
+ "name": "glob",
|
|
|
+ "dependency": "glob",
|
|
|
+ "title": "Glob: AbortSignal cancellation bypass allows post-timeout filesystem traversal",
|
|
|
+ "url": "https://github.com/advisories/GHSA-3g3m-2fjr-6pw4",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": ">=9.0.0 <=14.0.1"
|
|
|
+ },
|
|
|
+ "minimatch"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "js-beautify"
|
|
|
+ ],
|
|
|
+ "range": "9.0.0 - 14.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/js-beautify/node_modules/glob"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "globby": {
|
|
|
+ "name": "globby",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "fast-glob"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "8.0.0 - 9.2.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/globby"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "html-minifier": {
|
|
|
+ "name": "html-minifier",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1105440,
|
|
|
+ "name": "html-minifier",
|
|
|
+ "dependency": "html-minifier",
|
|
|
+ "title": "kangax html-minifier REDoS vulnerability",
|
|
|
+ "url": "https://github.com/advisories/GHSA-pfq8-rq6v-vf5m",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-1333"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<=4.0.0"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "html-webpack-plugin"
|
|
|
+ ],
|
|
|
+ "range": "<=4.0.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/html-minifier"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "html-webpack-plugin": {
|
|
|
+ "name": "html-webpack-plugin",
|
|
|
+ "severity": "critical",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "html-minifier",
|
|
|
+ "loader-utils"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@vue/cli-service"
|
|
|
+ ],
|
|
|
+ "range": "1.4.0 - 4.0.0-beta.14",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/html-webpack-plugin"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "http-proxy-agent": {
|
|
|
+ "name": "http-proxy-agent",
|
|
|
+ "severity": "low",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "@tootallnate/once"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "jsdom"
|
|
|
+ ],
|
|
|
+ "range": "4.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/http-proxy-agent"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "http-proxy-middleware": {
|
|
|
+ "name": "http-proxy-middleware",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1100223,
|
|
|
+ "name": "http-proxy-middleware",
|
|
|
+ "dependency": "http-proxy-middleware",
|
|
|
+ "title": "Denial of service in http-proxy-middleware",
|
|
|
+ "url": "https://github.com/advisories/GHSA-c7qv-q95q-8v27",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<2.0.7"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1104105,
|
|
|
+ "name": "http-proxy-middleware",
|
|
|
+ "dependency": "http-proxy-middleware",
|
|
|
+ "title": "http-proxy-middleware allows fixRequestBody to proceed even if bodyParser has failed",
|
|
|
+ "url": "https://github.com/advisories/GHSA-9gqv-wp59-fq42",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-754"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 4,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": ">=1.3.0 <2.0.9"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1104106,
|
|
|
+ "name": "http-proxy-middleware",
|
|
|
+ "dependency": "http-proxy-middleware",
|
|
|
+ "title": "http-proxy-middleware can call writeBody twice because \"else if\" is not used",
|
|
|
+ "url": "https://github.com/advisories/GHSA-4www-5p9h-95mh",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-670"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 4,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": ">=1.3.0 <2.0.8"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1121360,
|
|
|
+ "name": "http-proxy-middleware",
|
|
|
+ "dependency": "http-proxy-middleware",
|
|
|
+ "title": "http-proxy-middleware `router` host+path substring matching allows Host-header-driven backend routing bypass",
|
|
|
+ "url": "https://github.com/advisories/GHSA-64mm-vxmg-q3vj",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-20",
|
|
|
+ "CWE-187"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": ">=0.16.0 <2.0.10"
|
|
|
+ },
|
|
|
+ "micromatch"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@types/webpack-dev-server",
|
|
|
+ "webpack-dev-server"
|
|
|
+ ],
|
|
|
+ "range": "<=2.0.10-beta.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/http-proxy-middleware",
|
|
|
+ "node_modules/webpack-dev-server/node_modules/http-proxy-middleware"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "icss-utils": {
|
|
|
+ "name": "icss-utils",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "css-loader",
|
|
|
+ "postcss-modules-local-by-default",
|
|
|
+ "postcss-modules-values"
|
|
|
+ ],
|
|
|
+ "range": "<=4.1.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/icss-utils"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "ip": {
|
|
|
+ "name": "ip",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1101851,
|
|
|
+ "name": "ip",
|
|
|
+ "dependency": "ip",
|
|
|
+ "title": "ip SSRF improper categorization in isPublic",
|
|
|
+ "url": "https://github.com/advisories/GHSA-2p57-rm9w-gvfp",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-918"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 8.1,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
|
|
+ },
|
|
|
+ "range": "<=2.0.1"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "webpack-dev-server"
|
|
|
+ ],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/ip"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "jest": {
|
|
|
+ "name": "jest",
|
|
|
+ "severity": "low",
|
|
|
+ "isDirect": true,
|
|
|
+ "via": [
|
|
|
+ "@jest/core",
|
|
|
+ "jest-cli"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": ">=25.2.0-alpha.86",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/jest"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "jest-cli": {
|
|
|
+ "name": "jest-cli",
|
|
|
+ "severity": "low",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "@jest/core",
|
|
|
+ "jest-config"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": ">=25.2.0-alpha.86",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/jest-cli"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "jest-config": {
|
|
|
+ "name": "jest-config",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "@jest/test-sequencer",
|
|
|
+ "babel-jest",
|
|
|
+ "deepmerge",
|
|
|
+ "jest-jasmine2"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@jest/core",
|
|
|
+ "jest-cli",
|
|
|
+ "jest-runner",
|
|
|
+ "jest-runtime"
|
|
|
+ ],
|
|
|
+ "range": ">=24.2.0-alpha.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/jest-config"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "jest-haste-map": {
|
|
|
+ "name": "jest-haste-map",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "sane"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@jest/core",
|
|
|
+ "@jest/reporters",
|
|
|
+ "@jest/test-sequencer",
|
|
|
+ "@jest/transform",
|
|
|
+ "jest-runner",
|
|
|
+ "jest-runtime",
|
|
|
+ "jest-snapshot"
|
|
|
+ ],
|
|
|
+ "range": "24.0.0-alpha.0 - 26.6.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/jest-haste-map"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "jest-jasmine2": {
|
|
|
+ "name": "jest-jasmine2",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "jest-runtime",
|
|
|
+ "jest-snapshot"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "25.2.0-alpha.86 - 26.6.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/jest-jasmine2"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "jest-resolve-dependencies": {
|
|
|
+ "name": "jest-resolve-dependencies",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "jest-snapshot"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "26.1.0 - 26.6.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/jest-resolve-dependencies"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "jest-runner": {
|
|
|
+ "name": "jest-runner",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "jest-config",
|
|
|
+ "jest-haste-map",
|
|
|
+ "jest-runtime"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@jest/core",
|
|
|
+ "@jest/test-sequencer"
|
|
|
+ ],
|
|
|
+ "range": "24.0.0-alpha.0 - 27.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/jest-runner"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "jest-runtime": {
|
|
|
+ "name": "jest-runtime",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "@jest/transform",
|
|
|
+ "jest-config",
|
|
|
+ "jest-haste-map",
|
|
|
+ "jest-snapshot"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "jest-jasmine2",
|
|
|
+ "jest-runner"
|
|
|
+ ],
|
|
|
+ "range": "24.0.0-alpha.0 - 26.6.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/jest-runtime"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "jest-snapshot": {
|
|
|
+ "name": "jest-snapshot",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "jest-haste-map"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@jest/core",
|
|
|
+ "jest-jasmine2",
|
|
|
+ "jest-resolve-dependencies",
|
|
|
+ "jest-runtime"
|
|
|
+ ],
|
|
|
+ "range": "24.2.0-alpha.0 - 24.5.0 || 26.1.0 - 26.6.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/jest-snapshot"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "js-beautify": {
|
|
|
+ "name": "js-beautify",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "editorconfig",
|
|
|
+ "glob"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": ">=1.14.9",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/js-beautify"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "js-yaml": {
|
|
|
+ "name": "js-yaml",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1138114,
|
|
|
+ "name": "js-yaml",
|
|
|
+ "dependency": "js-yaml",
|
|
|
+ "title": "JS-YAML: Quadratic CPU consumption in !!omap resolution (3.x and 4.x) — CVE-2026-59870 fix not backported",
|
|
|
+ "url": "https://github.com/advisories/GHSA-5p4m-2wfm-xmqj",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-407"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": ">=3.0.0 <3.15.1"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1193726,
|
|
|
+ "name": "js-yaml",
|
|
|
+ "dependency": "js-yaml",
|
|
|
+ "title": "js-yaml: maxTotalMergeKeys does not limit CPU use for empty merge sources",
|
|
|
+ "url": "https://github.com/advisories/GHSA-2883-xcg3-v3hh",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-407"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": ">=3.0.0 <3.15.2"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "3.0.0 - 3.15.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/js-yaml"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "jsdom": {
|
|
|
+ "name": "jsdom",
|
|
|
+ "severity": "low",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "http-proxy-agent"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "16.6.0 - 17.0.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/jsdom"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "json5": {
|
|
|
+ "name": "json5",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1096543,
|
|
|
+ "name": "json5",
|
|
|
+ "dependency": "json5",
|
|
|
+ "title": "Prototype Pollution in JSON5 via Parse Method",
|
|
|
+ "url": "https://github.com/advisories/GHSA-9c47-m6qq-7p4h",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-1321"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.1,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H"
|
|
|
+ },
|
|
|
+ "range": "<1.0.2"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "loader-utils"
|
|
|
+ ],
|
|
|
+ "range": "<1.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/html-webpack-plugin/node_modules/json5"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "launch-editor": {
|
|
|
+ "name": "launch-editor",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1242627,
|
|
|
+ "name": "launch-editor",
|
|
|
+ "dependency": "launch-editor",
|
|
|
+ "title": "launch-editor: escapeCmdArgs() omits % escaping on Windows",
|
|
|
+ "url": "https://github.com/advisories/GHSA-698v-4r3x-3vcv",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-78"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<=2.14.1"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1242656,
|
|
|
+ "name": "launch-editor",
|
|
|
+ "dependency": "launch-editor",
|
|
|
+ "title": "launch-editor: Editor CLI flag misinterpretation causing arbitrary command execution for some editors",
|
|
|
+ "url": "https://github.com/advisories/GHSA-r825-w8mm-5pxw",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-88"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<=2.14.1"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1242663,
|
|
|
+ "name": "launch-editor",
|
|
|
+ "dependency": "launch-editor",
|
|
|
+ "title": "launch-editor: `fs.existsSync()` existence check can be bypassed on Windows",
|
|
|
+ "url": "https://github.com/advisories/GHSA-587h-7wmj-h5pm",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-77"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<=2.14.1"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=2.14.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/launch-editor"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "loader-utils": {
|
|
|
+ "name": "loader-utils",
|
|
|
+ "severity": "critical",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1094088,
|
|
|
+ "name": "loader-utils",
|
|
|
+ "dependency": "loader-utils",
|
|
|
+ "title": "Prototype pollution in webpack loader-utils",
|
|
|
+ "url": "https://github.com/advisories/GHSA-76p3-8jx3-jpfq",
|
|
|
+ "severity": "critical",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-1321"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 9.8,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
|
|
+ },
|
|
|
+ "range": "<1.4.1"
|
|
|
+ },
|
|
|
+ "json5"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "html-webpack-plugin"
|
|
|
+ ],
|
|
|
+ "range": "<=1.4.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/html-webpack-plugin/node_modules/loader-utils"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "micromatch": {
|
|
|
+ "name": "micromatch",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1098681,
|
|
|
+ "name": "micromatch",
|
|
|
+ "dependency": "micromatch",
|
|
|
+ "title": "Regular Expression Denial of Service (ReDoS) in micromatch",
|
|
|
+ "url": "https://github.com/advisories/GHSA-952p-6rrq-rcjv",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-1333"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": "<4.0.8"
|
|
|
+ },
|
|
|
+ "braces"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "anymatch",
|
|
|
+ "fast-glob",
|
|
|
+ "http-proxy-middleware",
|
|
|
+ "readdirp",
|
|
|
+ "sane",
|
|
|
+ "webpack"
|
|
|
+ ],
|
|
|
+ "range": "<=4.0.7",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/globby/node_modules/micromatch",
|
|
|
+ "node_modules/sane/node_modules/micromatch",
|
|
|
+ "node_modules/watchpack-chokidar2/node_modules/micromatch",
|
|
|
+ "node_modules/webpack-dev-server/node_modules/micromatch",
|
|
|
+ "node_modules/webpack/node_modules/micromatch"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "minimatch": {
|
|
|
+ "name": "minimatch",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1244623,
|
|
|
+ "name": "minimatch",
|
|
|
+ "dependency": "minimatch",
|
|
|
+ "title": "minimatch has potential denial of service via globparts amplification",
|
|
|
+ "url": "https://github.com/advisories/GHSA-g3hv-75wg-m249",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-405"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": ">=7.0.0 <11.0.1"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "editorconfig",
|
|
|
+ "glob"
|
|
|
+ ],
|
|
|
+ "range": "7.0.0 - 11.0.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/editorconfig/node_modules/minimatch",
|
|
|
+ "node_modules/js-beautify/node_modules/minimatch"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "node-forge": {
|
|
|
+ "name": "node-forge",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1088227,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Prototype Pollution in node-forge debug API.",
|
|
|
+ "url": "https://github.com/advisories/GHSA-5rrq-pxf6-6jx5",
|
|
|
+ "severity": "low",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-1321"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<1.0.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1088229,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "URL parsing in node-forge could lead to undesired behavior.",
|
|
|
+ "url": "https://github.com/advisories/GHSA-gf8q-jrpm-jvxq",
|
|
|
+ "severity": "low",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-601"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<1.0.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1088746,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Improper Verification of Cryptographic Signature in `node-forge`",
|
|
|
+ "url": "https://github.com/advisories/GHSA-2r2c-g63r-vccr",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-347"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": "<1.3.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1093719,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Open Redirect in node-forge",
|
|
|
+ "url": "https://github.com/advisories/GHSA-8fr3-hfg3-gpgp",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-601"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 6.1,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": "<1.0.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1102321,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Improper Verification of Cryptographic Signature in node-forge",
|
|
|
+ "url": "https://github.com/advisories/GHSA-x4jg-mjrx-434g",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-347"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<1.3.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1102322,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Improper Verification of Cryptographic Signature in node-forge",
|
|
|
+ "url": "https://github.com/advisories/GHSA-cfm4-qjh2-4765",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-347"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<1.3.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1110996,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "node-forge has ASN.1 Unbounded Recursion",
|
|
|
+ "url": "https://github.com/advisories/GHSA-554w-wpv2-vw27",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-674"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<1.3.2"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1110998,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "node-forge has an Interpretation Conflict vulnerability via its ASN.1 Validator Desynchronization",
|
|
|
+ "url": "https://github.com/advisories/GHSA-5gfm-wpxj-wjgq",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-436"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 8.6,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<1.3.2"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1111068,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "node-forge is vulnerable to ASN.1 OID Integer Truncation",
|
|
|
+ "url": "https://github.com/advisories/GHSA-65ch-62r8-g69g",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-190"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<1.3.2"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1115545,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge has a basicConstraints bypass in its certificate chain verification (RFC 5280 violation)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-2328-f5f3-gj25",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-295"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.4,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=1.3.3"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1115546,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge has signature forgery in Ed25519 due to missing S > L check",
|
|
|
+ "url": "https://github.com/advisories/GHSA-q67f-28xg-22rw",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-347"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1115548,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge has Denial of Service via Infinite Loop in BigInteger.modInverse() with Zero Input",
|
|
|
+ "url": "https://github.com/advisories/GHSA-5m6q-g25r-mvwx",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-835"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1115612,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge has signature forgery in RSA-PKCS due to ASN.1 extra field ",
|
|
|
+ "url": "https://github.com/advisories/GHSA-ppp5-5v6c-4jwp",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-20",
|
|
|
+ "CWE-347"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1240912,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "node-forge RSA PKCS#1 v1.5 signature verification accepts extra nested DigestAlgorithm elements",
|
|
|
+ "url": "https://github.com/advisories/GHSA-86w9-cpqp-85rv",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-347"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244014,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge: ASN.1 OID first arc truncation in asn1.oidToDer",
|
|
|
+ "url": "https://github.com/advisories/GHSA-4642-5mcj-2rqw",
|
|
|
+ "severity": "low",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-190"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 3.7,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244015,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge: Prototype Pollution in forge.http cookie handling via a malicious Set-Cookie",
|
|
|
+ "url": "https://github.com/advisories/GHSA-6wvx-3r32-xmcg",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-1321"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 4.8,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244016,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge: TLS client crash when the server sends no certificate",
|
|
|
+ "url": "https://github.com/advisories/GHSA-525v-9gp9-w22h",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-476"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.9,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244017,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge: Regular expression denial of service in PEM decoding (pem.decode)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-7wch-p9px-956x",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-1333"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244018,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge: Denial of Service via infinite loop in BigInteger.modInverse() with negative input (incomplete fix of CVE-2026-33891)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-h6cr-wjv9-3cpp",
|
|
|
+ "severity": "low",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-835"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 2.9,
|
|
|
+ "vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244019,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge: verifyCertificateChain() removes trusted CA certificates with the same subject from the CA store",
|
|
|
+ "url": "https://github.com/advisories/GHSA-4487-j8r4-4g2f",
|
|
|
+ "severity": "low",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-295",
|
|
|
+ "CWE-471"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 3.7,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244020,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge: AES-GCM authentication bypass via unvalidated tagLength option",
|
|
|
+ "url": "https://github.com/advisories/GHSA-5cwg-6vw7-rj6p",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-354",
|
|
|
+ "CWE-1284"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.9,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244021,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge: PKCS#12 MAC forgery and constant-key PBE via zero iteration count",
|
|
|
+ "url": "https://github.com/advisories/GHSA-jc66-7q78-782g",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-354",
|
|
|
+ "CWE-1284"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244022,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge: Denial of service in TLS record processing via a record interleaved with a fragmented handshake message",
|
|
|
+ "url": "https://github.com/advisories/GHSA-8hrf-8g6f-7xwp",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-248",
|
|
|
+ "CWE-476"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244023,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge: Denial of service in TLS record processing via call stack exhaustion",
|
|
|
+ "url": "https://github.com/advisories/GHSA-hqq3-7jhf-c5jx",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-674"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1244024,
|
|
|
+ "name": "node-forge",
|
|
|
+ "dependency": "node-forge",
|
|
|
+ "title": "Forge: X.509 basicConstraints bypass in verifyCertificateChain() via deprecated extension OIDs 2.5.29.10 and 2.5.29.13",
|
|
|
+ "url": "https://github.com/advisories/GHSA-5x38-2vff-x55p",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-295",
|
|
|
+ "CWE-436"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.4,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=1.4.0"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "selfsigned"
|
|
|
+ ],
|
|
|
+ "range": "<=1.4.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/node-forge"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "node-libs-browser": {
|
|
|
+ "name": "node-libs-browser",
|
|
|
+ "severity": "low",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "crypto-browserify"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "webpack"
|
|
|
+ ],
|
|
|
+ "range": "0.4.2 || >=1.0.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/node-libs-browser"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "node-notifier": {
|
|
|
+ "name": "node-notifier",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "uuid"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@jest/reporters"
|
|
|
+ ],
|
|
|
+ "range": "7.0.0 - 10.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/node-notifier"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "nth-check": {
|
|
|
+ "name": "nth-check",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1095141,
|
|
|
+ "name": "nth-check",
|
|
|
+ "dependency": "nth-check",
|
|
|
+ "title": "Inefficient Regular Expression Complexity in nth-check",
|
|
|
+ "url": "https://github.com/advisories/GHSA-rp65-9cf3-cjxr",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-1333"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<2.0.1"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "css-select"
|
|
|
+ ],
|
|
|
+ "range": "<2.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/svgo/node_modules/nth-check"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "pbkdf2": {
|
|
|
+ "name": "pbkdf2",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1241333,
|
|
|
+ "name": "pbkdf2",
|
|
|
+ "dependency": "pbkdf2",
|
|
|
+ "title": "pbkdf2 rehashes long passwords on every iteration, enabling denial of service",
|
|
|
+ "url": "https://github.com/advisories/GHSA-477h-4r7f-fvrx",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 3.7,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": "<=3.1.6"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=3.1.6",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/pbkdf2"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss": {
|
|
|
+ "name": "postcss",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": true,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1109574,
|
|
|
+ "name": "postcss",
|
|
|
+ "dependency": "postcss",
|
|
|
+ "title": "PostCSS line return parsing error",
|
|
|
+ "url": "https://github.com/advisories/GHSA-7fh5-64p2-3v2j",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-74",
|
|
|
+ "CWE-144"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": "<8.4.31"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1117015,
|
|
|
+ "name": "postcss",
|
|
|
+ "dependency": "postcss",
|
|
|
+ "title": "PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
|
|
|
+ "url": "https://github.com/advisories/GHSA-qx2v-qp2m-jg93",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-79"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 6.1,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": "<8.5.10"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1124252,
|
|
|
+ "name": "postcss",
|
|
|
+ "dependency": "postcss",
|
|
|
+ "title": "PostCSS: Arbitrary file read and information disclosure via attacker-controlled sourceMappingURL in CSS comments",
|
|
|
+ "url": "https://github.com/advisories/GHSA-6g55-p6wh-862q",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-22",
|
|
|
+ "CWE-200"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=8.5.11"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1130709,
|
|
|
+ "name": "postcss",
|
|
|
+ "dependency": "postcss",
|
|
|
+ "title": "PostCSS: incomplete fix of GHSA-6g55-p6wh-862q — attacker-controlled sourceMappingURL reads arbitrary .map files when `from` is unset",
|
|
|
+ "url": "https://github.com/advisories/GHSA-fxqj-rqcc-2cmp",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-22",
|
|
|
+ "CWE-200"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<=8.5.22"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1139510,
|
|
|
+ "name": "postcss",
|
|
|
+ "dependency": "postcss",
|
|
|
+ "title": "PostCSS: Path Traversal in Previous Source Map Auto-Loading (sourceMappingURL) leads to Arbitrary .map File Disclosure",
|
|
|
+ "url": "https://github.com/advisories/GHSA-r28c-9q8g-f849",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-22"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=8.5.17"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@intervolga/optimize-cssnano-plugin",
|
|
|
+ "@vue/compiler-sfc",
|
|
|
+ "@vue/component-compiler-utils",
|
|
|
+ "autoprefixer",
|
|
|
+ "css-declaration-sorter",
|
|
|
+ "css-loader",
|
|
|
+ "cssnano",
|
|
|
+ "cssnano-preset-default",
|
|
|
+ "cssnano-util-raw-cache",
|
|
|
+ "icss-utils",
|
|
|
+ "postcss-calc",
|
|
|
+ "postcss-colormin",
|
|
|
+ "postcss-convert-values",
|
|
|
+ "postcss-discard-comments",
|
|
|
+ "postcss-discard-duplicates",
|
|
|
+ "postcss-discard-empty",
|
|
|
+ "postcss-discard-overridden",
|
|
|
+ "postcss-import",
|
|
|
+ "postcss-loader",
|
|
|
+ "postcss-merge-longhand",
|
|
|
+ "postcss-merge-rules",
|
|
|
+ "postcss-minify-font-values",
|
|
|
+ "postcss-minify-gradients",
|
|
|
+ "postcss-minify-params",
|
|
|
+ "postcss-minify-selectors",
|
|
|
+ "postcss-modules-extract-imports",
|
|
|
+ "postcss-modules-local-by-default",
|
|
|
+ "postcss-modules-scope",
|
|
|
+ "postcss-modules-values",
|
|
|
+ "postcss-normalize-charset",
|
|
|
+ "postcss-normalize-display-values",
|
|
|
+ "postcss-normalize-positions",
|
|
|
+ "postcss-normalize-repeat-style",
|
|
|
+ "postcss-normalize-string",
|
|
|
+ "postcss-normalize-timing-functions",
|
|
|
+ "postcss-normalize-unicode",
|
|
|
+ "postcss-normalize-url",
|
|
|
+ "postcss-normalize-whitespace",
|
|
|
+ "postcss-ordered-values",
|
|
|
+ "postcss-reduce-initial",
|
|
|
+ "postcss-reduce-transforms",
|
|
|
+ "postcss-svgo",
|
|
|
+ "postcss-unique-selectors",
|
|
|
+ "stylehacks"
|
|
|
+ ],
|
|
|
+ "range": "<=8.5.22",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "postcss-calc": {
|
|
|
+ "name": "postcss-calc",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss",
|
|
|
+ "postcss-selector-parser"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "4.1.0 - 7.0.5",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-calc"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-colormin": {
|
|
|
+ "name": "postcss-colormin",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-colormin"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-convert-values": {
|
|
|
+ "name": "postcss-convert-values",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-convert-values"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-discard-comments": {
|
|
|
+ "name": "postcss-discard-comments",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-discard-comments"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-discard-duplicates": {
|
|
|
+ "name": "postcss-discard-duplicates",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "1.1.0 - 4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-discard-duplicates"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-discard-empty": {
|
|
|
+ "name": "postcss-discard-empty",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "1.1.0 - 4.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-discard-empty"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-discard-overridden": {
|
|
|
+ "name": "postcss-discard-overridden",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-discard-overridden"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-import": {
|
|
|
+ "name": "postcss-import",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@dcloudio/vue-cli-plugin-uni"
|
|
|
+ ],
|
|
|
+ "range": "<=12.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-import"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "postcss-loader": {
|
|
|
+ "name": "postcss-loader",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-loader"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-merge-longhand": {
|
|
|
+ "name": "postcss-merge-longhand",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss",
|
|
|
+ "stylehacks"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.11",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-merge-longhand"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-merge-rules": {
|
|
|
+ "name": "postcss-merge-rules",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss",
|
|
|
+ "postcss-selector-parser"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-merge-rules"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-minify-font-values": {
|
|
|
+ "name": "postcss-minify-font-values",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-minify-font-values"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-minify-gradients": {
|
|
|
+ "name": "postcss-minify-gradients",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-minify-gradients"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-minify-params": {
|
|
|
+ "name": "postcss-minify-params",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-minify-params"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-minify-selectors": {
|
|
|
+ "name": "postcss-minify-selectors",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss",
|
|
|
+ "postcss-selector-parser"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=5.0.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-minify-selectors"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-modules-extract-imports": {
|
|
|
+ "name": "postcss-modules-extract-imports",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=2.0.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-modules-extract-imports"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-modules-local-by-default": {
|
|
|
+ "name": "postcss-modules-local-by-default",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "icss-utils",
|
|
|
+ "postcss",
|
|
|
+ "postcss-selector-parser"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.0-rc.4",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-modules-local-by-default"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-modules-scope": {
|
|
|
+ "name": "postcss-modules-scope",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss",
|
|
|
+ "postcss-selector-parser"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=2.2.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-modules-scope"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-modules-values": {
|
|
|
+ "name": "postcss-modules-values",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "icss-utils",
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "css-loader"
|
|
|
+ ],
|
|
|
+ "range": "<=4.0.0-rc.5",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-modules-values"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "postcss-normalize-charset": {
|
|
|
+ "name": "postcss-normalize-charset",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-normalize-charset"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-normalize-display-values": {
|
|
|
+ "name": "postcss-normalize-display-values",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-normalize-display-values"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-normalize-positions": {
|
|
|
+ "name": "postcss-normalize-positions",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-normalize-positions"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-normalize-repeat-style": {
|
|
|
+ "name": "postcss-normalize-repeat-style",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-normalize-repeat-style"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-normalize-string": {
|
|
|
+ "name": "postcss-normalize-string",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-normalize-string"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-normalize-timing-functions": {
|
|
|
+ "name": "postcss-normalize-timing-functions",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-normalize-timing-functions"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-normalize-unicode": {
|
|
|
+ "name": "postcss-normalize-unicode",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-normalize-unicode"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-normalize-url": {
|
|
|
+ "name": "postcss-normalize-url",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "1.1.0 - 4.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-normalize-url"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-normalize-whitespace": {
|
|
|
+ "name": "postcss-normalize-whitespace",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-normalize-whitespace"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-ordered-values": {
|
|
|
+ "name": "postcss-ordered-values",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.1.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-ordered-values"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-reduce-initial": {
|
|
|
+ "name": "postcss-reduce-initial",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-reduce-initial"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-reduce-transforms": {
|
|
|
+ "name": "postcss-reduce-transforms",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-reduce-transforms"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-selector-parser": {
|
|
|
+ "name": "postcss-selector-parser",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1243379,
|
|
|
+ "name": "postcss-selector-parser",
|
|
|
+ "dependency": "postcss-selector-parser",
|
|
|
+ "title": "PostCSS: Quadratic complexity in flat selector parsing allows CPU exhaustion",
|
|
|
+ "url": "https://github.com/advisories/GHSA-rj75-hqrm-r3gf",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-400",
|
|
|
+ "CWE-407"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.9,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": "<6.1.5"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@dcloudio/vue-cli-plugin-uni",
|
|
|
+ "@vue/component-compiler-utils",
|
|
|
+ "postcss-calc",
|
|
|
+ "postcss-merge-rules",
|
|
|
+ "postcss-minify-selectors",
|
|
|
+ "postcss-modules-local-by-default",
|
|
|
+ "postcss-modules-scope"
|
|
|
+ ],
|
|
|
+ "range": "<6.1.5",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-selector-parser"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "postcss-svgo": {
|
|
|
+ "name": "postcss-svgo",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss",
|
|
|
+ "svgo"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=5.0.0-rc.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-svgo"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "postcss-unique-selectors": {
|
|
|
+ "name": "postcss-unique-selectors",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "<=4.0.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/postcss-unique-selectors"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "proxy-addr": {
|
|
|
+ "name": "proxy-addr",
|
|
|
+ "severity": "critical",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1241210,
|
|
|
+ "name": "proxy-addr",
|
|
|
+ "dependency": "proxy-addr",
|
|
|
+ "title": "proxy-addr vulnerable to IP spoofing via IPv4-mapped IPv6 trust subnet",
|
|
|
+ "url": "https://github.com/advisories/GHSA-jqcg-44mw-7w3h",
|
|
|
+ "severity": "critical",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-290",
|
|
|
+ "CWE-348",
|
|
|
+ "CWE-697"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 9.1,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": ">=1.1.0 <2.0.8"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "1.1.0 - 2.0.7",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/proxy-addr"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "qs": {
|
|
|
+ "name": "qs",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1113719,
|
|
|
+ "name": "qs",
|
|
|
+ "dependency": "qs",
|
|
|
+ "title": "qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion",
|
|
|
+ "url": "https://github.com/advisories/GHSA-6rw7-vpxm-498p",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-20"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 3.7,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": "<6.14.1"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1158506,
|
|
|
+ "name": "qs",
|
|
|
+ "dependency": "qs",
|
|
|
+ "title": "qs array-limit bypass via bracket-key comma parsing",
|
|
|
+ "url": "https://github.com/advisories/GHSA-x5fp-wj9c-mxmx",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-770"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 3.7,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": ">=6.14.2 <=6.15.3"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1158507,
|
|
|
+ "name": "qs",
|
|
|
+ "dependency": "qs",
|
|
|
+ "title": "qs: Denial of Service via Attacker Controlled isBuffer",
|
|
|
+ "url": "https://github.com/advisories/GHSA-4mjr-xmp4-gh2g",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-248",
|
|
|
+ "CWE-703"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": ">=2.2.5 <6.16.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1243687,
|
|
|
+ "name": "qs",
|
|
|
+ "dependency": "qs",
|
|
|
+ "title": "qs : qs.stringify with arrayFormat 'comma' throws an uncaught TypeError on array elements carrying a non-callable own toString (DoS)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-6pq8-jhm2-2vcw",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-248",
|
|
|
+ "CWE-704"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": ">=6.7.0 <=6.16.0"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "request"
|
|
|
+ ],
|
|
|
+ "range": "<=6.16.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/body-parser/node_modules/qs",
|
|
|
+ "node_modules/express/node_modules/qs",
|
|
|
+ "node_modules/qs",
|
|
|
+ "node_modules/url/node_modules/qs"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "readdirp": {
|
|
|
+ "name": "readdirp",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "micromatch"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "chokidar"
|
|
|
+ ],
|
|
|
+ "range": "2.2.0 - 2.2.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/watchpack-chokidar2/node_modules/readdirp",
|
|
|
+ "node_modules/webpack-dev-server/node_modules/readdirp"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "request": {
|
|
|
+ "name": "request",
|
|
|
+ "severity": "critical",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1096727,
|
|
|
+ "name": "request",
|
|
|
+ "dependency": "request",
|
|
|
+ "title": "Server-Side Request Forgery in Request",
|
|
|
+ "url": "https://github.com/advisories/GHSA-p8p7-x288-28g6",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-918"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 6.1,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=2.88.2"
|
|
|
+ },
|
|
|
+ "form-data",
|
|
|
+ "qs",
|
|
|
+ "tough-cookie",
|
|
|
+ "uuid"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@vue/cli-shared-utils"
|
|
|
+ ],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/request"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "sane": {
|
|
|
+ "name": "sane",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "anymatch",
|
|
|
+ "micromatch"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "jest-haste-map"
|
|
|
+ ],
|
|
|
+ "range": "1.5.0 - 4.1.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/sane"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "selfsigned": {
|
|
|
+ "name": "selfsigned",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "node-forge"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "webpack-dev-server"
|
|
|
+ ],
|
|
|
+ "range": "1.1.1 - 1.10.14",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/selfsigned"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "serialize-javascript": {
|
|
|
+ "name": "serialize-javascript",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1113686,
|
|
|
+ "name": "serialize-javascript",
|
|
|
+ "dependency": "serialize-javascript",
|
|
|
+ "title": "Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
|
|
|
+ "url": "https://github.com/advisories/GHSA-5c6j-r48x-rmvq",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-96"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 8.1,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
|
|
+ },
|
|
|
+ "range": "<=7.0.2"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1243082,
|
|
|
+ "name": "serialize-javascript",
|
|
|
+ "dependency": "serialize-javascript",
|
|
|
+ "title": "Serialize JavaScript: Cross-site scripting (XSS) via unescaped </script at the end of a serialized function body",
|
|
|
+ "url": "https://github.com/advisories/GHSA-m5mm-p8h7-m29v",
|
|
|
+ "severity": "low",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-79"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 0,
|
|
|
+ "vectorString": null
|
|
|
+ },
|
|
|
+ "range": "<7.1.3"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "copy-webpack-plugin",
|
|
|
+ "terser-webpack-plugin"
|
|
|
+ ],
|
|
|
+ "range": "<=7.1.2",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/serialize-javascript"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "shell-quote": {
|
|
|
+ "name": "shell-quote",
|
|
|
+ "severity": "critical",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1241332,
|
|
|
+ "name": "shell-quote",
|
|
|
+ "dependency": "shell-quote",
|
|
|
+ "title": "shell-quote: `quote()` command injection via a line terminator in a token after a `{ comment }` token",
|
|
|
+ "url": "https://github.com/advisories/GHSA-pqg4-j6r4-53mv",
|
|
|
+ "severity": "critical",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-78"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 8.1,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H"
|
|
|
+ },
|
|
|
+ "range": ">=1.8.4 <1.11.0"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "1.8.4 - 1.10.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/shell-quote"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "sockjs": {
|
|
|
+ "name": "sockjs",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "uuid"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "webpack-dev-server"
|
|
|
+ ],
|
|
|
+ "range": ">=0.3.17",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/sockjs"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "source-map-js": {
|
|
|
+ "name": "source-map-js",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1241209,
|
|
|
+ "name": "source-map-js",
|
|
|
+ "dependency": "source-map-js",
|
|
|
+ "title": "source-map-js allows event-loop denial of service through indexed source-map section offsets",
|
|
|
+ "url": "https://github.com/advisories/GHSA-68fv-2mgg-jv7q",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-1284"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
|
|
+ },
|
|
|
+ "range": ">=1.0.0 <1.2.2"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "1.0.0 - 1.2.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/source-map-js"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "source-map-resolve": {
|
|
|
+ "name": "source-map-resolve",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "decode-uri-component"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": ">=0.5.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/source-map-resolve"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "stylehacks": {
|
|
|
+ "name": "stylehacks",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "postcss",
|
|
|
+ "postcss-selector-parser"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "postcss-merge-longhand"
|
|
|
+ ],
|
|
|
+ "range": "<=4.0.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/stylehacks"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "svgo": {
|
|
|
+ "name": "svgo",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1139520,
|
|
|
+ "name": "svgo",
|
|
|
+ "dependency": "svgo",
|
|
|
+ "title": "SVGO removeScripts plugin leaves some executable scripts intact",
|
|
|
+ "url": "https://github.com/advisories/GHSA-2p49-hgcm-8545",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-79",
|
|
|
+ "CWE-184"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 8.2,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": ">=1.0.0 <2.8.3"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1193740,
|
|
|
+ "name": "svgo",
|
|
|
+ "dependency": "svgo",
|
|
|
+ "title": "SVGO: removeScripts incompletely sanitizes executable HTML in SVG foreignObject elements",
|
|
|
+ "url": "https://github.com/advisories/GHSA-4vpr-x523-8j87",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-79"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 6.1,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": ">=1.0.0 <2.8.4"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1243426,
|
|
|
+ "name": "svgo",
|
|
|
+ "dependency": "svgo",
|
|
|
+ "title": "SVGO: removeScripts allows executable links through namespace and control-character bypasses",
|
|
|
+ "url": "https://github.com/advisories/GHSA-w27v-7q3p-w38r",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-79",
|
|
|
+ "CWE-184"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 8.2,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": ">=1.0.0 <2.8.4"
|
|
|
+ },
|
|
|
+ "css-select"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "postcss-svgo"
|
|
|
+ ],
|
|
|
+ "range": "1.0.0 - 2.8.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/svgo"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "terser-webpack-plugin": {
|
|
|
+ "name": "terser-webpack-plugin",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "serialize-javascript"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@vue/cli-service",
|
|
|
+ "webpack"
|
|
|
+ ],
|
|
|
+ "range": "<=5.3.16",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/terser-webpack-plugin"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "tough-cookie": {
|
|
|
+ "name": "tough-cookie",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1097682,
|
|
|
+ "name": "tough-cookie",
|
|
|
+ "dependency": "tough-cookie",
|
|
|
+ "title": "tough-cookie Prototype Pollution vulnerability",
|
|
|
+ "url": "https://github.com/advisories/GHSA-72xf-g2v4-qvf3",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-1321"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 6.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": "<4.1.3"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "request"
|
|
|
+ ],
|
|
|
+ "range": "<4.1.3",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/request/node_modules/tough-cookie"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "uuid": {
|
|
|
+ "name": "uuid",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1119441,
|
|
|
+ "name": "uuid",
|
|
|
+ "dependency": "uuid",
|
|
|
+ "title": "uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
|
|
|
+ "url": "https://github.com/advisories/GHSA-w5hq-g745-h8pq",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-787",
|
|
|
+ "CWE-1285"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N"
|
|
|
+ },
|
|
|
+ "range": "<11.1.1"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "node-notifier",
|
|
|
+ "request",
|
|
|
+ "sockjs",
|
|
|
+ "webpack-log"
|
|
|
+ ],
|
|
|
+ "range": "<11.1.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/request/node_modules/uuid",
|
|
|
+ "node_modules/uuid",
|
|
|
+ "node_modules/webpack-log/node_modules/uuid"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "jest",
|
|
|
+ "version": "25.1.0",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "vue": {
|
|
|
+ "name": "vue",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": true,
|
|
|
+ "via": [
|
|
|
+ "@vue/compiler-sfc",
|
|
|
+ {
|
|
|
+ "source": 1100238,
|
|
|
+ "name": "vue",
|
|
|
+ "dependency": "vue",
|
|
|
+ "title": "ReDoS vulnerability in vue package that is exploitable through inefficient regex evaluation in the parseHTML function",
|
|
|
+ "url": "https://github.com/advisories/GHSA-5j4c-8p2g-v4jx",
|
|
|
+ "severity": "low",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-1333"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 3.7,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": ">=2.0.0-alpha.1 <3.0.0-alpha.0"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "2.0.0-alpha.1 - 2.7.16 || 3.5.36",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/vue"
|
|
|
+ ],
|
|
|
+ "fixAvailable": {
|
|
|
+ "name": "vue",
|
|
|
+ "version": "3.5.44",
|
|
|
+ "isSemVerMajor": true
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "vue-loader": {
|
|
|
+ "name": "vue-loader",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "@vue/component-compiler-utils"
|
|
|
+ ],
|
|
|
+ "effects": [],
|
|
|
+ "range": "15.0.0-beta.1 - 15.11.1",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/vue-loader"
|
|
|
+ ],
|
|
|
+ "fixAvailable": true
|
|
|
+ },
|
|
|
+ "vue-template-compiler": {
|
|
|
+ "name": "vue-template-compiler",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1111772,
|
|
|
+ "name": "vue-template-compiler",
|
|
|
+ "dependency": "vue-template-compiler",
|
|
|
+ "title": "vue-template-compiler vulnerable to client-side Cross-Site Scripting (XSS)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-g3ch-rx76-35fx",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-79"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 4.2,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
|
|
|
+ },
|
|
|
+ "range": ">=2.0.0 <3.0.0"
|
|
|
+ }
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@dcloudio/uni-template-compiler"
|
|
|
+ ],
|
|
|
+ "range": ">=2.0.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/vue-template-compiler"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "watchpack": {
|
|
|
+ "name": "watchpack",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "watchpack-chokidar2"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "webpack"
|
|
|
+ ],
|
|
|
+ "range": "1.7.2 - 1.7.5",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/watchpack"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "watchpack-chokidar2": {
|
|
|
+ "name": "watchpack-chokidar2",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "chokidar"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "watchpack"
|
|
|
+ ],
|
|
|
+ "range": "*",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/watchpack-chokidar2"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "webpack": {
|
|
|
+ "name": "webpack",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "micromatch",
|
|
|
+ "node-libs-browser",
|
|
|
+ "terser-webpack-plugin",
|
|
|
+ "watchpack"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@vue/cli-plugin-babel",
|
|
|
+ "@vue/cli-service"
|
|
|
+ ],
|
|
|
+ "range": "2.0.0-beta - 5.1.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/webpack"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "webpack-dev-middleware": {
|
|
|
+ "name": "webpack-dev-middleware",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1096729,
|
|
|
+ "name": "webpack-dev-middleware",
|
|
|
+ "dependency": "webpack-dev-middleware",
|
|
|
+ "title": "Path traversal in webpack-dev-middleware",
|
|
|
+ "url": "https://github.com/advisories/GHSA-wr3j-pwj9-hqq6",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-22"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.4,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=5.3.3"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1240027,
|
|
|
+ "name": "webpack-dev-middleware",
|
|
|
+ "dependency": "webpack-dev-middleware",
|
|
|
+ "title": "webpack-dev-middleware vulnerable to Path Traversal via non-slash-terminated publicPath",
|
|
|
+ "url": "https://github.com/advisories/GHSA-g84c-rxfj-3j2c",
|
|
|
+ "severity": "high",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-22"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 7.4,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N"
|
|
|
+ },
|
|
|
+ "range": "<7.4.5"
|
|
|
+ },
|
|
|
+ "webpack-log"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "webpack-dev-server"
|
|
|
+ ],
|
|
|
+ "range": "<=7.4.4",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/webpack-dev-middleware"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "webpack-dev-server": {
|
|
|
+ "name": "webpack-dev-server",
|
|
|
+ "severity": "high",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ {
|
|
|
+ "source": 1108429,
|
|
|
+ "name": "webpack-dev-server",
|
|
|
+ "dependency": "webpack-dev-server",
|
|
|
+ "title": "webpack-dev-server users' source code may be stolen when they access a malicious web site with non-Chromium based browser",
|
|
|
+ "url": "https://github.com/advisories/GHSA-9jgg-88mc-972h",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-346"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 6.5,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=5.2.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1108430,
|
|
|
+ "name": "webpack-dev-server",
|
|
|
+ "dependency": "webpack-dev-server",
|
|
|
+ "title": "webpack-dev-server users' source code may be stolen when they access a malicious web site",
|
|
|
+ "url": "https://github.com/advisories/GHSA-4v9v-hfq4-rm2v",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-749"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=5.2.0"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1119074,
|
|
|
+ "name": "webpack-dev-server",
|
|
|
+ "dependency": "webpack-dev-server",
|
|
|
+ "title": "webpack-dev-server vulnerable to cross-origin source code exposure on non-HTTPS origins",
|
|
|
+ "url": "https://github.com/advisories/GHSA-79cf-xcqc-c78w",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-749"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
|
|
|
+ },
|
|
|
+ "range": "<=5.2.3"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1121087,
|
|
|
+ "name": "webpack-dev-server",
|
|
|
+ "dependency": "webpack-dev-server",
|
|
|
+ "title": "webpack-dev-server vulnerable to HMR WebSocket interception via permissive user proxies",
|
|
|
+ "url": "https://github.com/advisories/GHSA-mx8g-39q3-5c79",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-346",
|
|
|
+ "CWE-441"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": "<5.2.5"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1123965,
|
|
|
+ "name": "webpack-dev-server",
|
|
|
+ "dependency": "webpack-dev-server",
|
|
|
+ "title": "webpack-dev-server vulnerable to cross-site request forgery via internal developer endpoints",
|
|
|
+ "url": "https://github.com/advisories/GHSA-f5vj-f2hx-8m93",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-352",
|
|
|
+ "CWE-749"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 4.7,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": "<=5.2.5"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "source": 1123966,
|
|
|
+ "name": "webpack-dev-server",
|
|
|
+ "dependency": "webpack-dev-server",
|
|
|
+ "title": "webpack-dev-server vulnerable to denial of service via a malformed Host or Origin header",
|
|
|
+ "url": "https://github.com/advisories/GHSA-m28w-2pqf-7qgj",
|
|
|
+ "severity": "moderate",
|
|
|
+ "cwe": [
|
|
|
+ "CWE-20",
|
|
|
+ "CWE-248"
|
|
|
+ ],
|
|
|
+ "cvss": {
|
|
|
+ "score": 5.3,
|
|
|
+ "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
|
|
+ },
|
|
|
+ "range": "<=5.2.5"
|
|
|
+ },
|
|
|
+ "chokidar",
|
|
|
+ "http-proxy-middleware",
|
|
|
+ "ip",
|
|
|
+ "selfsigned",
|
|
|
+ "sockjs",
|
|
|
+ "webpack-dev-middleware",
|
|
|
+ "webpack-log"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "@vue/cli-service"
|
|
|
+ ],
|
|
|
+ "range": "<=5.2.7",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/webpack-dev-server"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ },
|
|
|
+ "webpack-log": {
|
|
|
+ "name": "webpack-log",
|
|
|
+ "severity": "moderate",
|
|
|
+ "isDirect": false,
|
|
|
+ "via": [
|
|
|
+ "uuid"
|
|
|
+ ],
|
|
|
+ "effects": [
|
|
|
+ "copy-webpack-plugin",
|
|
|
+ "webpack-dev-middleware",
|
|
|
+ "webpack-dev-server"
|
|
|
+ ],
|
|
|
+ "range": "1.1.0 - 2.0.0",
|
|
|
+ "nodes": [
|
|
|
+ "node_modules/webpack-log"
|
|
|
+ ],
|
|
|
+ "fixAvailable": false
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "metadata": {
|
|
|
+ "vulnerabilities": {
|
|
|
+ "info": 0,
|
|
|
+ "low": 11,
|
|
|
+ "moderate": 82,
|
|
|
+ "high": 32,
|
|
|
+ "critical": 7,
|
|
|
+ "total": 132
|
|
|
+ },
|
|
|
+ "dependencies": {
|
|
|
+ "prod": 64,
|
|
|
+ "dev": 1633,
|
|
|
+ "optional": 31,
|
|
|
+ "peer": 0,
|
|
|
+ "peerOptional": 0,
|
|
|
+ "total": 1696
|
|
|
+ }
|
|
|
+ }
|
|
|
+}
|