seagate / cortx-halo Goto Github PK
View Code? Open in Web Editor NEWLicense: GNU Affero General Public License v3.0
License: GNU Affero General Public License v3.0
Parse, validate, manipulate, and display dates
Library home page: https://registry.npmjs.org/moment/-/moment-2.29.3.tgz
Path to dependency file: /manager/gui/package.json
Path to vulnerable library: /manager/gui/node_modules/moment/package.json
CVE | Severity | Dependency | Type | Fixed in | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2022-31129 | 7.5 | moment-2.29.3.tgz | Direct | moment - 2.29.4 | ✅ |
Parse, validate, manipulate, and display dates
Library home page: https://registry.npmjs.org/moment/-/moment-2.29.3.tgz
Path to dependency file: /manager/gui/package.json
Path to vulnerable library: /manager/gui/node_modules/moment/package.json
Dependency Hierarchy:
Found in base branch: main
moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has quadratic (N^2) complexity on specific inputs. Users may notice a noticeable slowdown is observed with inputs above 10k characters. Users who pass user-provided strings without sanity length checks to moment constructor are vulnerable to (Re)DoS attacks. The problem is patched in 2.29.4, the patch can be applied to all affected versions with minimal tweaking. Users are advised to upgrade. Users unable to upgrade should consider limiting date lengths accepted from user input.
Publish Date: 2022-07-06
URL: CVE-2022-31129
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-wc69-rhjr-hc9g
Release Date: 2022-07-06
Fix Resolution: moment - 2.29.4
⛑️ Automatic Remediation is available for this issue
⛑️ Automatic Remediation is available for this issue.
CVE | Severity | Dependency | Type | Fixed in (d3 version) | Remediation Available | |
---|---|---|---|---|---|---|
WS-2022-0322 | 7.5 | d3-color-3.0.1.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
Color spaces! RGB, HSL, Cubehelix, Lab and HCL (Lch).
Library home page: https://registry.npmjs.org/d3-color/-/d3-color-3.0.1.tgz
Dependency Hierarchy:
Found in base branch: main
The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.
Publish Date: 2022-09-29
URL: WS-2022-0322
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-36jr-mh4h-2g58
Release Date: 2022-09-29
Fix Resolution: d3-color - 3.1.0
CVE | Severity | Dependency | Type | Fixed in (c3 version) | Remediation Available | |
---|---|---|---|---|---|---|
WS-2022-0322 | 7.5 | d3-color-1.4.1.tgz | Transitive | N/A* | ❌ |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.
Color spaces! RGB, HSL, Cubehelix, Lab and HCL (Lch).
Library home page: https://registry.npmjs.org/d3-color/-/d3-color-1.4.1.tgz
Dependency Hierarchy:
Found in base branch: main
The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.
Publish Date: 2022-09-29
URL: WS-2022-0322
Base Score Metrics:
Type: Upgrade version
Origin: GHSA-36jr-mh4h-2g58
Release Date: 2022-09-29
Fix Resolution: d3-color - 3.1.0
Vue Material Component Framework
Library home page: https://registry.npmjs.org/vuetify/-/vuetify-2.6.2.tgz
CVE | Severity | Dependency | Type | Fixed in (vuetify version) | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2022-25873 | 5.4 | vuetify-2.6.2.tgz | Direct | 2.6.10 | ❌ |
Vue Material Component Framework
Library home page: https://registry.npmjs.org/vuetify/-/vuetify-2.6.2.tgz
Dependency Hierarchy:
Found in base branch: main
The package vuetify from 2.0.0-beta.4 and before 2.6.10 are vulnerable to Cross-site Scripting (XSS) due to improper input sanitization in the 'eventName' function within the VCalendar component.
Publish Date: 2022-09-18
URL: CVE-2022-25873
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2022-25873
Release Date: 2022-09-18
Fix Resolution: 2.6.10
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.