scriptex / 2048 Goto Github PK

View Code? Open in Web Editor NEW

10.0 10.0 4.0 6.61 MB

A TypeScript implementation of the popular game

Home Page: https://2048.atanas.info

License: MIT License

TypeScript 57.19% JavaScript 8.22% HTML 9.86% SCSS 24.73%

2048-clone 2048-game game typescript typescript-game

2048's Introduction

Hi, I'm Atanas 👋

Javascript/Typescript engineer doing Web and Mobile front-end development since 2011
Lead front-end developer at dmarcian
Former senior software developer and mentor at Three11
Former lead front-end engineer in the E.ON Home project
Former senior web and desktop applications developer at Kinetik Automotive
Former senior front-end engineer and mentor at 2create
Former senior front-end developer at htmlBurger
Former senior front-end developer at htmlBoutique
Former front-end developer at HTML Lab
Part of "the top 3% in the world" at Toptal
Founding talent member at Braintrust
Senior front-end engineer at Andela
Freelance Javascript/Typescript Engineer at Upwork
Freelance Javascript/Typescript Engineer at Freelancer
Freelance front-end engineer at 9am
Freelance front-end developer at Wellfound
Senior front-end engineer at People Per Hour
Freelance front-end developer at FlexWork
Freelance front-end developer at Arc.dev
Freelance front-end developer at Codementor
Open source software maintainer - check my projects.
Author of web components at WebComponents.org
Author of browser extensions for Google Chrome and Mozilla Firefox
Google developer

My open source software is published on NPM and has been downloaded this many times in the past year:

Here is a bit more detailed graph showing my open source contributions in the past year:

Wondering how to pronounce my name? Not anymore!

Connect with me:

Support and sponsor my work:

2048's People

Contributors

Stargazers

Watchers

Forkers

delta94 dennispigithub kellarosaa

2048's Issues

CVE-2012-6708 (Medium) detected in jquery-1.7.1.min.js

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/vm-browserify/example/run/index.html

Path to vulnerable library: /2048/node_modules/vm-browserify/example/run/index.html

Dependency Hierarchy:

❌ jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 3d66aea58ebd85a879a52006b5f871dc73085b72

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

Step up your Open Source Security Game with WhiteSource here

CVE-2018-11693 (High) detected in node-sass-v4.11.0

CVE-2018-11693 - High Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skip_over_scopes which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.

Publish Date: 2018-06-04

URL: CVE-2018-11693

CVSS 3 Score Details (8.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

WS-2019-0047 (Medium) detected in tar-2.2.1.tgz

WS-2019-0047 - Medium Severity Vulnerability

Vulnerable Library - tar-2.2.1.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.1.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/node-gyp/node_modules/tar/package.json

Dependency Hierarchy:

node-sass-4.12.0.tgz (Root Library)
- node-gyp-3.8.0.tgz
  - ❌ tar-2.2.1.tgz (Vulnerable Library)

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Vulnerability Details

Versions of node-tar prior to 4.4.2 are vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink will overwrite the system's file with the contents of the extracted file.

Publish Date: 2019-04-05

URL: WS-2019-0047

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/803

Release Date: 2019-04-05

Fix Resolution: 4.4.2

Step up your Open Source Security Game with WhiteSource here

CVE-2013-0340 (Medium) detected in src-73.0.3635.0

CVE-2013-0340 - Medium Severity Vulnerability

Vulnerable Library - src73.0.3635.0

Library home page: https://chromium.googlesource.com/chromium/src

Found in HEAD commit: 9969343c85789025474cf57fb2a5ca085e8e3ab6

Library Source Files (51)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/expat_external.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xpathInternals.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/catalog.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/SAX.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/encoding.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xmlwriter.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/pattern.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/schematron.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/c14n.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xinclude.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/dict.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/xmlmemory.h
/2048/node_modules/sharp/vendor/include/webp/encode.h
/2048/node_modules/sharp/vendor/include/webp/mux.h
/2048/node_modules/sharp/vendor/include/expat.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/webp/demux.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/parserInternals.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/xmlschemas.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xmlregexp.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/parser.h
/2048/node_modules/sharp/vendor/include/webp/mux_types.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/schemasInternals.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/relaxng.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/webp/types.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/xmlmodule.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/nanohttp.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xmlsave.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xmlunicode.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xmlschemastypes.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/DOCBparser.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/hash.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/xmlstring.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/SAX2.h
/2048/node_modules/sharp/vendor/include/libpng16/pngconf.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/uri.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/xmlIO.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/valid.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/debugXML.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xpointer.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/chvalid.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/threads.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/HTMLparser.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xmlreader.h
/2048/node_modules/sharp/vendor/include/libpng16/png.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/HTMLtree.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xmlautomata.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/nanoftp.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xlink.h
/2048/node_modules/create-pwa/node_modules/sharp/vendor/include/libxml2/libxml/xmlerror.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/xpath.h
/2048/node_modules/sharp/vendor/include/libxml2/libxml/list.h

Vulnerability Details

expat 2.1.0 and earlier does not properly handle entities expansion unless an application developer uses the XML_SetEntityDeclHandler function, which allows remote attackers to cause a denial of service (resource consumption), send HTTP requests to intranet servers, or read arbitrary files via a crafted XML document, aka an XML External Entity (XXE) issue. NOTE: it could be argued that because expat already provides the ability to disable external entity expansion, the responsibility for resolving this issue lies with application developers; according to this argument, this entry should be REJECTed, and each affected application would need its own CVE.

Publish Date: 2014-01-21

URL: CVE-2013-0340

CVSS 2 Score Details (6.8)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://security.gentoo.org/glsa/201701-21

Release Date: 2017-01-11

Fix Resolution: All Expat users should upgrade to the latest version >= expat-2.2.0-r1

Step up your Open Source Security Game with WhiteSource here

CVE-2019-20149 (Medium) detected in multiple libraries

CVE-2019-20149 - Medium Severity Vulnerability

Vulnerable Libraries - kind-of-3.2.2.tgz, kind-of-4.0.0.tgz, kind-of-6.0.2.tgz, kind-of-5.1.0.tgz

kind-of-3.2.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/snapdragon-util/node_modules/kind-of/package.json

Dependency Hierarchy:

awesome-typescript-loader-5.2.1.tgz (Root Library)
- micromatch-3.1.10.tgz
  - snapdragon-0.8.2.tgz
    - base-0.11.2.tgz
      - class-utils-0.3.6.tgz
        
        static-extend-0.1.2.tgz
        
        object-copy-0.1.0.tgz
        
        ❌ kind-of-3.2.2.tgz (Vulnerable Library)

kind-of-4.0.0.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-4.0.0.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/has-values/node_modules/kind-of/package.json

Dependency Hierarchy:

awesome-typescript-loader-5.2.1.tgz (Root Library)
- micromatch-3.1.10.tgz
  - snapdragon-0.8.2.tgz
    - base-0.11.2.tgz
      - cache-base-1.0.1.tgz
        
        has-value-1.0.0.tgz
        
        has-values-1.0.0.tgz
        
        ❌ kind-of-4.0.0.tgz (Vulnerable Library)

kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/kind-of/package.json

Dependency Hierarchy:

awesome-typescript-loader-5.2.1.tgz (Root Library)
- micromatch-3.1.10.tgz
  - ❌ kind-of-6.0.2.tgz (Vulnerable Library)

kind-of-5.1.0.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-5.1.0.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/is-descriptor/node_modules/kind-of/package.json

Dependency Hierarchy:

awesome-typescript-loader-5.2.1.tgz (Root Library)
- micromatch-3.1.10.tgz
  - snapdragon-0.8.2.tgz
    - define-property-0.2.5.tgz
      - is-descriptor-0.1.6.tgz
        
        ❌ kind-of-5.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 43e5f2a9f7776866ffdc3d7f0180d1b87aab5035

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Step up your Open Source Security Game with WhiteSource here

CVE-2018-16487 (High) detected in multiple libraries

CVE-2018-16487 - High Severity Vulnerability

Vulnerable Libraries - lodash-4.17.10.tgz, lodash-3.10.1.tgz, lodash-2.4.2.tgz

lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/asset-resolver/node_modules/lodash/package.json

Dependency Hierarchy:

critical-1.3.4.tgz (Root Library)
- postcss-image-inliner-2.0.0.tgz
  - asset-resolver-1.0.3.tgz
    - ❌ lodash-4.17.10.tgz (Vulnerable Library)

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/oust/node_modules/lodash/package.json

Dependency Hierarchy:

critical-1.3.4.tgz (Root Library)
- oust-0.4.0.tgz
  - cheerio-0.19.0.tgz
    - ❌ lodash-3.10.1.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/cave/node_modules/lodash/package.json

Dependency Hierarchy:

critical-1.3.4.tgz (Root Library)
- inline-critical-4.0.7.tgz
  - cave-2.0.0.tgz
    - ❌ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11

Step up your Open Source Security Game with WhiteSource here

CVE-2018-19839 (Medium) detected in node-sass-v4.11.0

CVE-2018-19839 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

In LibSass prior to 3.5.5, the function handle_error in sass_context.cpp allows attackers to cause a denial-of-service resulting from a heap-based buffer over-read via a crafted sass file.

Publish Date: 2018-12-04

URL: CVE-2018-19839

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19839

Fix Resolution: 3.5.5

Step up your Open Source Security Game with WhiteSource here

CVE-2018-19826 (Medium) detected in node-sass-v4.11.0

CVE-2018-19826 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::String_Quoted*) stack frame) may cause a Denial of Service via crafted sass input files with stray '&' or '/' characters.

Publish Date: 2018-12-03

URL: CVE-2018-19826

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2020-8244 (High) detected in bl-1.2.2.tgz

CVE-2020-8244 - High Severity Vulnerability

Vulnerable Library - bl-1.2.2.tgz

Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!

Library home page: https://registry.npmjs.org/bl/-/bl-1.2.2.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/bl/package.json

Dependency Hierarchy:

optisize-1.1.0.tgz (Root Library)
- imagemin-gifsicle-7.0.0.tgz
  - gifsicle-5.1.0.tgz
    - bin-build-3.0.0.tgz
      - decompress-4.2.1.tgz
        
        decompress-tar-4.1.1.tgz
        
        tar-stream-1.6.2.tgz
        
        ❌ bl-1.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 74dee4c2cae7ce4f6119a013ef63600a768a7b77

Vulnerability Details

A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1 and <2.2.1 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.

Publish Date: 2020-07-21

URL: CVE-2020-8244

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8244

Release Date: 2020-07-21

Fix Resolution: 2.2.1,3.0.1,4.0.3

Step up your Open Source Security Game with WhiteSource here

CVE-2015-9521 (Medium) detected in jquery-2.1.4.min.js, jquery-1.9.1.js

CVE-2015-9521 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.9.1.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: /2048/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

❌ jquery-2.1.4.min.js (Vulnerable Library)

jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/tinycolor2/index.html

Path to vulnerable library: /2048/node_modules/tinycolor2/demo/jquery-1.9.1.js,/2048/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js

Dependency Hierarchy:

❌ jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: b1c0fa9a6e1a3236044a9cd70f893e0fddbcb888

Vulnerability Details

The Easy Digital Downloads (EDD) Pushover Notifications extension for WordPress, as used with EDD 1.8.x before 1.8.7, 1.9.x before 1.9.10, 2.0.x before 2.0.5, 2.1.x before 2.1.11, 2.2.x before 2.2.9, and 2.3.x before 2.3.7, has XSS because add_query_arg is misused.

Publish Date: 2019-10-23

URL: CVE-2015-9521

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jquery/jquery@b078a62

Release Date: 2019-10-23

Fix Resolution: 2.2.0

Step up your Open Source Security Game with WhiteSource here

CVE-2015-9251 (Medium) detected in multiple libraries

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.9.1.js, jquery-1.7.1.min.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: /2048/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

❌ jquery-2.1.4.min.js (Vulnerable Library)

jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/tinycolor2/index.html

Path to vulnerable library: /2048/node_modules/tinycolor2/demo/jquery-1.9.1.js,/2048/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js

Dependency Hierarchy:

❌ jquery-1.9.1.js (Vulnerable Library)

jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/vm-browserify/example/run/index.html

Path to vulnerable library: /2048/node_modules/vm-browserify/example/run/index.html

Dependency Hierarchy:

❌ jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 3d66aea58ebd85a879a52006b5f871dc73085b72

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

Step up your Open Source Security Game with WhiteSource here

CVE-2018-11698 (High) detected in node-sass-v4.11.0

CVE-2018-11698 - High Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.

Publish Date: 2018-06-04

URL: CVE-2018-11698

CVSS 3 Score Details (8.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2018-20190 (Medium) detected in node-sass-v4.11.0

CVE-2018-20190 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.

Publish Date: 2018-12-17

URL: CVE-2018-20190

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

WS-2019-0424 (Medium) detected in elliptic-6.5.2.tgz

WS-2019-0424 - Medium Severity Vulnerability

Vulnerable Library - elliptic-6.5.2.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/elliptic/package.json

Dependency Hierarchy:

webpack-4.43.0.tgz (Root Library)
- node-libs-browser-2.2.1.tgz
  - crypto-browserify-3.12.0.tgz
    - browserify-sign-4.2.0.tgz
      - ❌ elliptic-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: 904fe053ffe0b7bc8eb700ee24ae7ff8b8fed094

Vulnerability Details

all versions before 6.5.2 of elliptic are vulnerable to Timing Attack through side-channels.

Publish Date: 2019-11-13

URL: WS-2019-0424

CVSS 3 Score Details (5.9)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Adjacent
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

WS-2020-0070 (High) detected in lodash-4.17.15.tgz

WS-2020-0070 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/lodash/package.json

Dependency Hierarchy:

awesome-typescript-loader-5.2.1.tgz (Root Library)
- ❌ lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: 4c661762095a935b2d510c682bdbd3351d254078

Vulnerability Details

a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype

Publish Date: 2020-04-28

URL: WS-2020-0070

CVSS 3 Score Details (8.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2018-11499 (High) detected in node-sass-v4.11.0

CVE-2018-11499 - High Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.

Publish Date: 2018-05-26

URL: CVE-2018-11499

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2020-8116 (Medium) detected in dot-prop-4.2.0.tgz

CVE-2020-8116 - Medium Severity Vulnerability

Vulnerable Library - dot-prop-4.2.0.tgz

Get, set, or delete a property from a nested object using a dot path

Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/dot-prop/package.json

Dependency Hierarchy:

postcss-merge-rules-4.0.3.tgz (Root Library)
- postcss-selector-parser-3.1.1.tgz
  - ❌ dot-prop-4.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 7c090d20bda65c244423514dbaeddd3db6e0857b

Vulnerability Details

Prototype pollution vulnerability in dot-prop npm package version 5.1.0 and earlier allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Publish Date: 2020-02-04

URL: CVE-2020-8116

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116

Release Date: 2020-02-04

Fix Resolution: dot-prop - 5.1.1

Step up your Open Source Security Game with WhiteSource here

WS-2019-0063 (High) detected in js-yaml-3.13.1.tgz

WS-2019-0063 - High Severity Vulnerability

Vulnerable Library - js-yaml-3.13.1.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.13.1.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/js-yaml/package.json

Dependency Hierarchy:

tslint-5.18.0.tgz (Root Library)
- ❌ js-yaml-3.13.1.tgz (Vulnerable Library)

Found in HEAD commit: 110cda77d316d3d3d3c956973abda6fae784f4f8

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-30

URL: WS-2019-0063

CVSS 2 Score Details (8.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-30

Fix Resolution: 3.13.1

Step up your Open Source Security Game with WhiteSource here

CVE-2020-8175 (Medium) detected in jpeg-js-0.3.7.tgz

CVE-2020-8175 - Medium Severity Vulnerability

Vulnerable Library - jpeg-js-0.3.7.tgz

A pure javascript JPEG encoder and decoder

Library home page: https://registry.npmjs.org/jpeg-js/-/jpeg-js-0.3.7.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/jpeg-js/package.json

Dependency Hierarchy:

create-pwa-2.3.0.tgz (Root Library)
- png-to-ico-2.1.0.tgz
  - jimp-0.9.8.tgz
    - types-0.9.8.tgz
      - jpeg-0.9.8.tgz
        
        ❌ jpeg-js-0.3.7.tgz (Vulnerable Library)

Found in HEAD commit: f53fecb70323fadbea333ad6c2337ae6869d8f79

Vulnerability Details

Uncontrolled resource consumption in jpeg-js before 0.4.0 may allow attacker to launch denial of service attacks using specially a crafted JPEG image.

Publish Date: 2020-07-21

URL: CVE-2020-8175

CVSS 3 Score Details (5.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8175

Release Date: 2020-07-21

Fix Resolution: 0.4.0

Step up your Open Source Security Game with WhiteSource here

CVE-2019-10742 (Medium) detected in axios-0.17.1.tgz

CVE-2019-10742 - Medium Severity Vulnerability

Vulnerable Library - axios-0.17.1.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.17.1.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/axios/package.json

Dependency Hierarchy:

browser-sync-2.26.5.tgz (Root Library)
- localtunnel-1.9.1.tgz
  - ❌ axios-0.17.1.tgz (Vulnerable Library)

Found in HEAD commit: b287c1f49141ed857742868a44fdbc0ff446ce3a

Vulnerability Details

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.

Publish Date: 2019-05-07

URL: CVE-2019-10742

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Step up your Open Source Security Game with WhiteSource here

CVE-2019-6286 (Medium) detected in node-sass-v4.11.0

CVE-2019-6286 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::skip_over_scopes in prelexer.hpp when called from Sass::Parser::parse_import(), a similar issue to CVE-2018-11693.

Publish Date: 2019-01-14

URL: CVE-2019-6286

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2019-18797 (Medium) detected in node-sass-v4.11.0

CVE-2019-18797 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: 81ef9d00d275b65353f00bd7be519c1ff24bca87

Library Source Files (66)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp

Vulnerability Details

LibSass 3.6.1 has uncontrolled recursion in Sass::Eval::operator()(Sass::Binary_Expression*) in eval.cpp.

Publish Date: 2019-11-06

URL: CVE-2019-18797

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-18797

Release Date: 2019-11-06

Fix Resolution: 3.6.3

Step up your Open Source Security Game with WhiteSource here

CVE-2018-19838 (Medium) detected in node-sass-v4.11.0

CVE-2018-19838 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().

Publish Date: 2018-12-04

URL: CVE-2018-19838

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19838

Fix Resolution: 3.5.5

Step up your Open Source Security Game with WhiteSource here

CVE-2018-19827 (High) detected in node-sass-v4.11.0

CVE-2018-19827 - High Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.

Publish Date: 2018-12-03

URL: CVE-2018-19827

CVSS 3 Score Details (8.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7598 (High) detected in multiple libraries

CVE-2020-7598 - High Severity Vulnerability

Vulnerable Libraries - minimist-0.0.8.tgz, minimist-1.1.3.tgz, minimist-1.2.0.tgz

minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/mkdirp/node_modules/minimist/package.json

Dependency Hierarchy:

awesome-typescript-loader-5.2.1.tgz (Root Library)
- mkdirp-0.5.1.tgz
  - ❌ minimist-0.0.8.tgz (Vulnerable Library)

minimist-1.1.3.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.1.3.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/gonzales-pe/node_modules/minimist/package.json

Dependency Hierarchy:

stylelint-13.2.1.tgz (Root Library)
- postcss-sass-0.4.2.tgz
  - gonzales-pe-4.2.4.tgz
    - ❌ minimist-1.1.3.tgz (Vulnerable Library)

minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Dependency Hierarchy:

browser-sync-2.26.1.tgz (Root Library)
- chokidar-2.1.8.tgz
  - fsevents-1.2.11.tgz
    - node-pre-gyp-0.14.0.tgz
      - rc-1.2.8.tgz
        
        ❌ minimist-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: eec4d903894695618e66c7546c7869026759573c

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.2

Step up your Open Source Security Game with WhiteSource here

CVE-2018-11695 (High) detected in node-sass-v4.11.0

CVE-2018-11695 - High Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

An issue was discovered in LibSass through 3.5.2. A NULL pointer dereference was found in the function Sass::Expand::operator which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.

Publish Date: 2018-06-04

URL: CVE-2018-11695

CVSS 3 Score Details (8.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2020-13822 (Medium) detected in elliptic-6.5.2.tgz

CVE-2020-13822 - Medium Severity Vulnerability

Vulnerable Library - elliptic-6.5.2.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/elliptic/package.json

Dependency Hierarchy:

webpack-4.43.0.tgz (Root Library)
- node-libs-browser-2.2.1.tgz
  - crypto-browserify-3.12.0.tgz
    - browserify-sign-4.2.0.tgz
      - ❌ elliptic-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: 0bd2d6ac21fd15bc7f7de7fabda3faea2af5c868

Vulnerability Details

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Publish Date: 2020-06-04

URL: CVE-2020-13822

CVSS 3 Score Details (5.0)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: N/A
- Attack Complexity: N/A
- Privileges Required: N/A
- User Interaction: N/A
- Scope: N/A
Impact Metrics:
- Confidentiality Impact: N/A
- Integrity Impact: N/A
- Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2019-6284 (Medium) detected in node-sass-v4.11.0

CVE-2019-6284 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::alternatives in prelexer.hpp.

Publish Date: 2019-01-14

URL: CVE-2019-6284

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2017-1000048 (High) detected in qs-6.2.3.tgz

CVE-2017-1000048 - High Severity Vulnerability

Vulnerable Library - qs-6.2.3.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.2.3.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/qs/package.json

Dependency Hierarchy:

browser-sync-2.26.5.tgz (Root Library)
- ❌ qs-6.2.3.tgz (Vulnerable Library)

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Vulnerability Details

the web framework using ljharb's qs module older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS. A malicious user can send a evil request to cause the web framework crash.

Publish Date: 2017-07-17

URL: CVE-2017-1000048

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: ljharb/qs@c709f6e

Release Date: 2017-03-06

Fix Resolution: Replace or update the following files: parse.js, parse.js, utils.js

Step up your Open Source Security Game with WhiteSource here

CVE-2018-11694 (High) detected in node-sass-v4.11.0

CVE-2018-11694 - High Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.

Publish Date: 2018-06-04

URL: CVE-2018-11694

CVSS 3 Score Details (8.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

WS-2020-0068 (Medium) detected in multiple libraries

WS-2020-0068 - Medium Severity Vulnerability

Vulnerable Libraries - yargs-parser-13.1.2.tgz, yargs-parser-10.1.0.tgz, yargs-parser-4.2.1.tgz

yargs-parser-13.1.2.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-13.1.2.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/sass-graph/node_modules/yargs-parser/package.json

Dependency Hierarchy:

webpack-cli-3.3.11.tgz (Root Library)
- yargs-13.2.4.tgz
  - ❌ yargs-parser-13.1.2.tgz (Vulnerable Library)

yargs-parser-10.1.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-10.1.0.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/critical/node_modules/yargs-parser/package.json

Dependency Hierarchy:

critical-1.3.9.tgz (Root Library)
- meow-5.0.0.tgz
  - ❌ yargs-parser-10.1.0.tgz (Vulnerable Library)

yargs-parser-4.2.1.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-4.2.1.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/browser-sync/node_modules/yargs-parser/package.json

Dependency Hierarchy:

browser-sync-2.26.7.tgz (Root Library)
- yargs-6.4.0.tgz
  - ❌ yargs-parser-4.2.1.tgz (Vulnerable Library)

Found in HEAD commit: 54f27c77aaf05ec3859ee7866fa4679fecde03a8

Vulnerability Details

Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument --foo.proto.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.

Publish Date: 2020-05-01

URL: WS-2020-0068

CVSS 3 Score Details (5.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: N/A
- Attack Complexity: N/A
- Privileges Required: N/A
- User Interaction: N/A
- Scope: N/A
Impact Metrics:
- Confidentiality Impact: N/A
- Integrity Impact: N/A
- Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/package/yargs-parser

Release Date: 2020-05-04

Fix Resolution: https://www.npmjs.com/package/yargs-parser/v/18.1.2,https://www.npmjs.com/package/yargs-parser/v/15.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2019-6283 (Medium) detected in node-sass-v4.11.0

CVE-2019-6283 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

In LibSass 3.5.5, a heap-based buffer over-read exists in Sass::Prelexer::parenthese_scope in prelexer.hpp.

Publish Date: 2019-01-14

URL: CVE-2019-6283

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2018-19797 (Medium) detected in node-sass-v4.11.0

CVE-2018-19797 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.

Publish Date: 2018-12-03

URL: CVE-2018-19797

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2020-11023 (Medium) detected in jquery-2.1.4.min.js, jquery-1.9.1.js

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.9.1.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: /2048/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

❌ jquery-2.1.4.min.js (Vulnerable Library)

jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/tinycolor2/test/index.html

Path to vulnerable library: /2048/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js,/2048/node_modules/tinycolor2/demo/jquery-1.9.1.js

Dependency Hierarchy:

❌ jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: 3b0b042b45e018c88529c0c8367edbc8787adad6

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0

Step up your Open Source Security Game with WhiteSource here

Update socials

Update links to social networks based on the latest changes in atanas.info.
Also add a link to atanas.info.

CVE-2019-1010266 (Medium) detected in lodash-3.10.1.tgz, lodash-2.4.2.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Libraries - lodash-3.10.1.tgz, lodash-2.4.2.tgz

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/oust/node_modules/lodash/package.json

Dependency Hierarchy:

critical-1.3.4.tgz (Root Library)
- oust-0.4.0.tgz
  - cheerio-0.19.0.tgz
    - ❌ lodash-3.10.1.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/cave/node_modules/lodash/package.json

Dependency Hierarchy:

critical-1.3.4.tgz (Root Library)
- inline-critical-4.0.7.tgz
  - cave-2.0.0.tgz
    - ❌ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: 490b25b61ecc1c40311a924aa487eb446971a0cc

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11

Step up your Open Source Security Game with WhiteSource here

CVE-2018-11697 (High) detected in node-sass-v4.11.0

CVE-2018-11697 - High Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly() which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.

Publish Date: 2018-06-04

URL: CVE-2018-11697

CVSS 3 Score Details (8.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

WS-2020-0042 (Medium) detected in acorn-6.4.0.tgz

WS-2020-0042 - Medium Severity Vulnerability

Vulnerable Library - acorn-6.4.0.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-6.4.0.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/acorn/package.json

Dependency Hierarchy:

webpack-4.42.0.tgz (Root Library)
- ❌ acorn-6.4.0.tgz (Vulnerable Library)

Found in HEAD commit: 5ff91286bf970b60fa51979d8978797bf4090698

Vulnerability Details

acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.

Publish Date: 2020-03-08

URL: WS-2020-0042

CVSS 3 Score Details (5.0)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: N/A
- Attack Complexity: N/A
- Privileges Required: N/A
- User Interaction: N/A
- Scope: N/A
Impact Metrics:
- Confidentiality Impact: N/A
- Integrity Impact: N/A
- Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1488

Release Date: 2020-03-08

Fix Resolution: 7.1.1

Step up your Open Source Security Game with WhiteSource here

CVE-2018-3721 (Medium) detected in lodash-3.10.1.tgz, lodash-2.4.2.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Libraries - lodash-3.10.1.tgz, lodash-2.4.2.tgz

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/oust/node_modules/lodash/package.json

Dependency Hierarchy:

critical-1.3.4.tgz (Root Library)
- oust-0.4.0.tgz
  - cheerio-0.19.0.tgz
    - ❌ lodash-3.10.1.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/cave/node_modules/lodash/package.json

Dependency Hierarchy:

critical-1.3.4.tgz (Root Library)
- inline-critical-4.0.7.tgz
  - cave-2.0.0.tgz
    - ❌ lodash-2.4.2.tgz (Vulnerable Library)

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5

Step up your Open Source Security Game with WhiteSource here

CVE-2018-20821 (Medium) detected in node-sass-v4.11.0

CVE-2018-20821 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp).

Publish Date: 2019-04-23

URL: CVE-2018-20821

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

WS-2016-0090 (Medium) detected in multiple libraries

WS-2016-0090 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.9.1.js, jquery-1.7.1.min.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: /2048/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

❌ jquery-2.1.4.min.js (Vulnerable Library)

jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/tinycolor2/index.html

Path to vulnerable library: /2048/node_modules/tinycolor2/demo/jquery-1.9.1.js,/2048/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js

Dependency Hierarchy:

❌ jquery-1.9.1.js (Vulnerable Library)

jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/vm-browserify/example/run/index.html

Path to vulnerable library: /2048/node_modules/vm-browserify/example/run/index.html

Dependency Hierarchy:

❌ jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 3d66aea58ebd85a879a52006b5f871dc73085b72

Vulnerability Details

JQuery, before 2.2.0, is vulnerable to Cross-site Scripting (XSS) attacks via text/javascript response with arbitrary code execution.

Publish Date: 2016-11-27

URL: WS-2016-0090

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jquery/jquery@b078a62

Release Date: 2019-04-08

Fix Resolution: 2.2.0

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7608 (Medium) detected in multiple libraries

CVE-2020-7608 - Medium Severity Vulnerability

Vulnerable Libraries - yargs-parser-16.1.0.tgz, yargs-parser-10.1.0.tgz, yargs-parser-4.2.1.tgz, yargs-parser-5.0.0.tgz

yargs-parser-16.1.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-16.1.0.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/stylelint/node_modules/yargs-parser/package.json

Dependency Hierarchy:

stylelint-13.2.1.tgz (Root Library)
- meow-6.0.1.tgz
  - ❌ yargs-parser-16.1.0.tgz (Vulnerable Library)

yargs-parser-10.1.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-10.1.0.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/critical/node_modules/yargs-parser/package.json

Dependency Hierarchy:

critical-1.3.9.tgz (Root Library)
- meow-5.0.0.tgz
  - ❌ yargs-parser-10.1.0.tgz (Vulnerable Library)

yargs-parser-4.2.1.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-4.2.1.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/browser-sync/node_modules/yargs-parser/package.json

Dependency Hierarchy:

browser-sync-2.26.7.tgz (Root Library)
- yargs-6.4.0.tgz
  - ❌ yargs-parser-4.2.1.tgz (Vulnerable Library)

yargs-parser-5.0.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-5.0.0.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/sass-graph/node_modules/yargs-parser/package.json

Dependency Hierarchy:

node-sass-4.13.1.tgz (Root Library)
- sass-graph-2.2.4.tgz
  - yargs-7.1.0.tgz
    - ❌ yargs-parser-5.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 7b7bc3866a51a5cda3f2bb532489634688f0104e

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.0)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: N/A
- Attack Complexity: N/A
- Privileges Required: N/A
- User Interaction: N/A
- Scope: N/A
Impact Metrics:
- Confidentiality Impact: N/A
- Integrity Impact: N/A
- Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7608

Release Date: 2020-03-16

Fix Resolution: v18.1.1;13.1.2;15.0.1

Step up your Open Source Security Game with WhiteSource here

CVE-2019-11358 (Medium) detected in jquery-2.1.4.min.js, jquery-1.9.1.js

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-2.1.4.min.js, jquery-1.9.1.js

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: /2048/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

❌ jquery-2.1.4.min.js (Vulnerable Library)

jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/tinycolor2/index.html

Path to vulnerable library: /2048/node_modules/tinycolor2/demo/jquery-1.9.1.js,/2048/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js

Dependency Hierarchy:

❌ jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: 3d66aea58ebd85a879a52006b5f871dc73085b72

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: jquery/jquery@753d591

Release Date: 2019-03-25

Fix Resolution: Replace or update the following files: core.js, core.js

Step up your Open Source Security Game with WhiteSource here

Migrate to ESLint

https://github.com/typescript-eslint/tslint-to-eslint-config

WS-2020-0044 (High) detected in decompress-4.2.0.tgz

WS-2020-0044 - High Severity Vulnerability

Vulnerable Library - decompress-4.2.0.tgz

Extracting archives made easy

Library home page: https://registry.npmjs.org/decompress/-/decompress-4.2.0.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/decompress/package.json

Dependency Hierarchy:

optisize-1.0.0.tgz (Root Library)
- imagemin-gifsicle-6.0.1.tgz
  - gifsicle-4.0.1.tgz
    - bin-build-3.0.0.tgz
      - ❌ decompress-4.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 8570e2ef6a1fcd90c4827221f91f5c1fd7d2bcb7

Vulnerability Details

decompress in all its versions is vulnerable to arbitrary file write. the package fails to prevent an extraction of files with relative paths which allows attackers to write to any folder in the system.

Publish Date: 2020-03-08

URL: WS-2020-0044

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2019-10744 (High) detected in multiple libraries

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Libraries - lodash-4.17.10.tgz, lodash-3.10.1.tgz, lodash-2.4.2.tgz, lodash-4.17.11.tgz

lodash-4.17.10.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.10.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/asset-resolver/node_modules/lodash/package.json

Dependency Hierarchy:

critical-1.3.4.tgz (Root Library)
- postcss-image-inliner-2.0.0.tgz
  - asset-resolver-1.0.3.tgz
    - ❌ lodash-4.17.10.tgz (Vulnerable Library)

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/oust/node_modules/lodash/package.json

Dependency Hierarchy:

critical-1.3.4.tgz (Root Library)
- oust-0.4.0.tgz
  - cheerio-0.19.0.tgz
    - ❌ lodash-3.10.1.tgz (Vulnerable Library)

lodash-2.4.2.tgz

A utility library delivering consistency, customization, performance, & extras.

Library home page: https://registry.npmjs.org/lodash/-/lodash-2.4.2.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/cave/node_modules/lodash/package.json

Dependency Hierarchy:

critical-1.3.4.tgz (Root Library)
- inline-critical-4.0.7.tgz
  - cave-2.0.0.tgz
    - ❌ lodash-2.4.2.tgz (Vulnerable Library)

lodash-4.17.11.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/lodash/package.json

Dependency Hierarchy:

awesome-typescript-loader-5.2.1.tgz (Root Library)
- ❌ lodash-4.17.11.tgz (Vulnerable Library)

Found in HEAD commit: 8195e5c1be288267d74cb92d59b47b5c8b14d389

Vulnerability Details

A Prototype Pollution vulnerability was found in lodash through version 4.17.11.

Publish Date: 2019-07-08

URL: CVE-2019-10744

CVSS 2 Score Details (7.4)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: lodash/lodash@a01e4fa

Release Date: 2019-07-08

Fix Resolution: 4.17.12

Step up your Open Source Security Game with WhiteSource here

WS-2020-0091 (High) detected in http-proxy-1.15.2.tgz

WS-2020-0091 - High Severity Vulnerability

Vulnerable Library - http-proxy-1.15.2.tgz

HTTP proxying for the masses

Library home page: https://registry.npmjs.org/http-proxy/-/http-proxy-1.15.2.tgz

Path to dependency file: /tmp/ws-scm/2048/package.json

Path to vulnerable library: /tmp/ws-scm/2048/node_modules/http-proxy/package.json

Dependency Hierarchy:

browser-sync-2.26.7.tgz (Root Library)
- ❌ http-proxy-1.15.2.tgz (Vulnerable Library)

Found in HEAD commit: f1bece02fabc8824e9bc201b047b0b9ca64cc1f5

Vulnerability Details

Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.

Publish Date: 2020-05-14

URL: WS-2020-0091

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1486

Release Date: 2020-05-26

Fix Resolution: http-proxy - 1.18.1

Step up your Open Source Security Game with WhiteSource here

CVE-2018-20822 (Medium) detected in node-sass-v4.11.0

CVE-2018-20822 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.11.0

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: b58bbe703411c8203ad9e68496cd450c7f2ea208

Library Source Files (125)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

/2048/node_modules/node-sass/src/libsass/src/expand.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8/unchecked.h
/2048/node_modules/node-sass/src/libsass/src/output.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.hpp
/2048/node_modules/node-sass/src/libsass/src/util.hpp
/2048/node_modules/node-sass/src/libsass/src/emitter.hpp
/2048/node_modules/node-sass/src/libsass/src/lexer.cpp
/2048/node_modules/node-sass/src/libsass/test/test_node.cpp
/2048/node_modules/node-sass/src/libsass/src/plugins.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/base.h
/2048/node_modules/node-sass/src/libsass/src/position.hpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.hpp
/2048/node_modules/node-sass/src/libsass/src/operation.hpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.cpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.hpp
/2048/node_modules/node-sass/src/custom_importer_bridge.cpp
/2048/node_modules/node-sass/src/libsass/contrib/plugin.cpp
/2048/node_modules/node-sass/src/libsass/src/functions.hpp
/2048/node_modules/node-sass/src/libsass/test/test_superselector.cpp
/2048/node_modules/node-sass/src/libsass/src/eval.hpp
/2048/node_modules/node-sass/src/libsass/src/utf8_string.hpp
/2048/node_modules/node-sass/src/libsass/src/error_handling.cpp
/2048/node_modules/node-sass/src/sass_context_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/node.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.cpp
/2048/node_modules/node-sass/src/libsass/src/subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/emitter.cpp
/2048/node_modules/node-sass/src/libsass/src/listize.cpp
/2048/node_modules/node-sass/src/libsass/src/ast.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.cpp
/2048/node_modules/node-sass/src/libsass/src/output.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
/2048/node_modules/node-sass/src/libsass/src/cssize.hpp
/2048/node_modules/node-sass/src/libsass/src/functions.cpp
/2048/node_modules/node-sass/src/libsass/src/paths.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.cpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
/2048/node_modules/node-sass/src/sass_types/color.cpp
/2048/node_modules/node-sass/src/libsass/test/test_unification.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.hpp
/2048/node_modules/node-sass/src/libsass/src/values.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_util.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.hpp
/2048/node_modules/node-sass/src/sass_types/list.h
/2048/node_modules/node-sass/src/libsass/src/json.cpp
/2048/node_modules/node-sass/src/libsass/src/check_nesting.hpp
/2048/node_modules/node-sass/src/libsass/src/units.cpp
/2048/node_modules/node-sass/src/libsass/src/units.hpp
/2048/node_modules/node-sass/src/libsass/src/context.cpp
/2048/node_modules/node-sass/src/libsass/src/utf8/checked.h
/2048/node_modules/node-sass/src/libsass/src/listize.hpp
/2048/node_modules/node-sass/src/sass_types/string.cpp
/2048/node_modules/node-sass/src/libsass/src/context.hpp
/2048/node_modules/node-sass/src/libsass/src/prelexer.hpp
/2048/node_modules/node-sass/src/sass_types/boolean.h
/2048/node_modules/node-sass/src/libsass/include/sass2scss.h
/2048/node_modules/node-sass/src/libsass/src/eval.cpp
/2048/node_modules/node-sass/src/libsass/src/expand.cpp
/2048/node_modules/node-sass/src/libsass/src/operators.cpp
/2048/node_modules/node-sass/src/sass_types/factory.cpp
/2048/node_modules/node-sass/src/sass_types/boolean.cpp
/2048/node_modules/node-sass/src/libsass/src/source_map.cpp
/2048/node_modules/node-sass/src/sass_types/value.h
/2048/node_modules/node-sass/src/libsass/src/utf8_string.cpp
/2048/node_modules/node-sass/src/callback_bridge.h
/2048/node_modules/node-sass/src/libsass/src/file.cpp
/2048/node_modules/node-sass/src/libsass/src/sass.cpp
/2048/node_modules/node-sass/src/libsass/src/node.hpp
/2048/node_modules/node-sass/src/libsass/src/environment.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.hpp
/2048/node_modules/node-sass/src/libsass/src/operators.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.hpp
/2048/node_modules/node-sass/src/libsass/src/sass.hpp
/2048/node_modules/node-sass/src/libsass/src/ast_fwd_decl.cpp
/2048/node_modules/node-sass/src/libsass/src/parser.hpp
/2048/node_modules/node-sass/src/libsass/src/constants.cpp
/2048/node_modules/node-sass/src/sass_types/list.cpp
/2048/node_modules/node-sass/src/libsass/src/cssize.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/functions.h
/2048/node_modules/node-sass/src/libsass/src/util.cpp
/2048/node_modules/node-sass/src/custom_function_bridge.cpp
/2048/node_modules/node-sass/src/custom_importer_bridge.h
/2048/node_modules/node-sass/src/libsass/src/bind.cpp
/2048/node_modules/node-sass/src/libsass/src/inspect.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_functions.cpp
/2048/node_modules/node-sass/src/libsass/src/backtrace.cpp
/2048/node_modules/node-sass/src/libsass/src/extend.cpp
/2048/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
/2048/node_modules/node-sass/src/libsass/src/debugger.hpp
/2048/node_modules/node-sass/src/libsass/src/cencode.c
/2048/node_modules/node-sass/src/libsass/src/base64vlq.cpp
/2048/node_modules/node-sass/src/sass_types/number.cpp
/2048/node_modules/node-sass/src/sass_types/color.h
/2048/node_modules/node-sass/src/libsass/src/c99func.c
/2048/node_modules/node-sass/src/libsass/src/position.cpp
/2048/node_modules/node-sass/src/libsass/src/remove_placeholders.hpp
/2048/node_modules/node-sass/src/libsass/src/sass_values.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/values.h
/2048/node_modules/node-sass/src/libsass/test/test_subset_map.cpp
/2048/node_modules/node-sass/src/libsass/src/sass2scss.cpp
/2048/node_modules/node-sass/src/sass_types/null.cpp
/2048/node_modules/node-sass/src/libsass/include/sass/context.h
/2048/node_modules/node-sass/src/libsass/src/ast.cpp
/2048/node_modules/node-sass/src/libsass/src/to_c.cpp
/2048/node_modules/node-sass/src/libsass/src/to_value.hpp
/2048/node_modules/node-sass/src/libsass/src/color_maps.hpp
/2048/node_modules/node-sass/src/sass_context_wrapper.cpp
/2048/node_modules/node-sass/src/libsass/script/test-leaks.pl
/2048/node_modules/node-sass/src/libsass/src/lexer.hpp
/2048/node_modules/node-sass/src/libsass/src/memory/SharedPtr.hpp
/2048/node_modules/node-sass/src/libsass/src/to_c.hpp
/2048/node_modules/node-sass/src/libsass/src/to_value.cpp
/2048/node_modules/node-sass/src/libsass/src/b64/encode.h
/2048/node_modules/node-sass/src/libsass/src/file.hpp
/2048/node_modules/node-sass/src/sass_types/map.cpp
/2048/node_modules/node-sass/src/libsass/src/environment.hpp
/2048/node_modules/node-sass/src/libsass/src/plugins.hpp
/2048/node_modules/node-sass/src/binding.cpp
/2048/node_modules/node-sass/src/libsass/src/sass_context.cpp
/2048/node_modules/node-sass/src/libsass/src/debug.hpp

Vulnerability Details

LibSass 3.5.4 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Complex_Selector::perform in ast.hpp and Sass::Inspect::operator in inspect.cpp).

Publish Date: 2019-04-23

URL: CVE-2018-20822

CVSS 3 Score Details (6.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Step up your Open Source Security Game with WhiteSource here

CVE-2020-11022 (Medium) detected in multiple libraries

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-3.4.0.min.js, jquery-2.1.4.min.js, jquery-1.9.1.js

jquery-3.4.0.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.0/jquery.min.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/js-base64/test/index.html

Path to vulnerable library: /2048/node_modules/js-base64/test/index.html

Dependency Hierarchy:

❌ jquery-3.4.0.min.js (Vulnerable Library)

jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: /2048/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

❌ jquery-2.1.4.min.js (Vulnerable Library)

jquery-1.9.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.9.1/jquery.js

Path to dependency file: /tmp/ws-scm/2048/node_modules/tinycolor2/test/index.html

Path to vulnerable library: /2048/node_modules/tinycolor2/test/../demo/jquery-1.9.1.js,/2048/node_modules/tinycolor2/demo/jquery-1.9.1.js

Dependency Hierarchy:

❌ jquery-1.9.1.js (Vulnerable Library)

Found in HEAD commit: 1ef613d93155262138cc75e2b902143367db38ae

Vulnerability Details

In jQuery before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (5.0)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: N/A
- Attack Complexity: N/A
- Privileges Required: N/A
- User Interaction: N/A
- Scope: N/A
Impact Metrics:
- Confidentiality Impact: N/A
- Integrity Impact: N/A
- Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

Step up your Open Source Security Game with WhiteSource here

CVE-2018-20834 (High) detected in tar-2.2.2.tgz

CVE-2018-20834 - High Severity Vulnerability

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /2048/package.json

Path to vulnerable library: /tmp/git/2048/node_modules/node-gyp/node_modules/tar/package.json

Dependency Hierarchy:

node-sass-4.12.0.tgz (Root Library)
- node-gyp-3.8.0.tgz
  - ❌ tar-2.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 85785856c0e37100d8e1f70fb09dac46c8904b28

Vulnerability Details

A vulnerability was found in node-tar before version 4.4.2. An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content.

Publish Date: 2019-04-30

URL: CVE-2018-20834

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/344595

Release Date: 2019-04-30

Fix Resolution: v4.4.2

Step up your Open Source Security Game with WhiteSource here

scriptex / 2048 Goto Github PK

2048's Introduction

Hi, I'm Atanas 👋

2048's People

Contributors

Stargazers

Watchers

Forkers

2048's Issues

CVE-2012-6708 - Medium Severity Vulnerability

CVE-2018-11693 - High Severity Vulnerability

WS-2019-0047 - Medium Severity Vulnerability

CVE-2013-0340 - Medium Severity Vulnerability

CVE-2019-20149 - Medium Severity Vulnerability

CVE-2018-16487 - High Severity Vulnerability

CVE-2018-19839 - Medium Severity Vulnerability

CVE-2018-19826 - Medium Severity Vulnerability

CVE-2020-8244 - High Severity Vulnerability

CVE-2015-9521 - Medium Severity Vulnerability

CVE-2015-9251 - Medium Severity Vulnerability

CVE-2018-11698 - High Severity Vulnerability

CVE-2018-20190 - Medium Severity Vulnerability

WS-2019-0424 - Medium Severity Vulnerability

WS-2020-0070 - High Severity Vulnerability

CVE-2018-11499 - High Severity Vulnerability

CVE-2020-8116 - Medium Severity Vulnerability

WS-2019-0063 - High Severity Vulnerability

CVE-2020-8175 - Medium Severity Vulnerability

CVE-2019-10742 - Medium Severity Vulnerability

CVE-2019-6286 - Medium Severity Vulnerability

CVE-2019-18797 - Medium Severity Vulnerability

CVE-2018-19838 - Medium Severity Vulnerability

CVE-2018-19827 - High Severity Vulnerability

CVE-2020-7598 - High Severity Vulnerability

CVE-2018-11695 - High Severity Vulnerability

CVE-2020-13822 - Medium Severity Vulnerability

CVE-2019-6284 - Medium Severity Vulnerability

CVE-2017-1000048 - High Severity Vulnerability

CVE-2018-11694 - High Severity Vulnerability

WS-2020-0068 - Medium Severity Vulnerability

CVE-2019-6283 - Medium Severity Vulnerability

CVE-2018-19797 - Medium Severity Vulnerability

CVE-2020-11023 - Medium Severity Vulnerability

CVE-2019-1010266 - Medium Severity Vulnerability

CVE-2018-11697 - High Severity Vulnerability

WS-2020-0042 - Medium Severity Vulnerability

CVE-2018-3721 - Medium Severity Vulnerability

CVE-2018-20821 - Medium Severity Vulnerability

WS-2016-0090 - Medium Severity Vulnerability

CVE-2020-7608 - Medium Severity Vulnerability

CVE-2019-11358 - Medium Severity Vulnerability

WS-2020-0044 - High Severity Vulnerability

CVE-2019-10744 - High Severity Vulnerability

WS-2020-0091 - High Severity Vulnerability

CVE-2018-20822 - Medium Severity Vulnerability

CVE-2020-11022 - Medium Severity Vulnerability

CVE-2018-20834 - High Severity Vulnerability

Recommend Projects

Recommend Topics

Recommend Org

Jobs