GithubHelp home page GithubHelp logo

unfriendly / quake-port Goto Github PK

View Code? Open in Web Editor NEW
1.0 1.0 0.0 107.76 MB

Port of Quake with Phasor

JavaScript 0.46% HTML 0.28% Makefile 1.54% C 52.70% C++ 1.53% Assembly 42.53% Objective-C 0.42% MATLAB 0.01% GLSL 0.23% Roff 0.08% Yacc 0.02% Shell 0.15% NSIS 0.04% Python 0.01% Rich Text Format 0.01% VBScript 0.01%

quake-port's Introduction

Beloved Son

Born May 6, 1999 - Tragically passed away Jun 27, 2022

I’m a designer, pentester, and developer.
(I ❤ Security research and Design!!!)
  • 🔭 I’m currently working on

  • 📇 Find out more about me

  • 🌱 I’m currently learning and brushing up my knowledge on

    • Swift and Objective-C as well as Mac, and iOS internal system operations.
  • 💬 Ask me about

    • Pentesting and Security Research or Frontend UI/UX Design
  • 📫 How to reach me

unfriendly unfriendly notunfriendly unfriendly unfriendly unfriendly unfriendly notunfriendly notunfriendly rawtechnique rawtechnique @unfriendly

unfriendly

vuejs react angularjs aws android c css3 csharp docker dotnet electron html5 javascript typescript laravel mongodb mysql php postgresql rails redis redhat ruby sass nodejs python swift oracle nginx linux express

quake-port's People

Contributors

mend-bolt-for-github[bot] avatar unfriendly avatar

Stargazers

 avatar

Watchers

 avatar

quake-port's Issues

CVE-2014-7191 Medium Severity Vulnerability detected by WhiteSource

CVE-2014-7191 - Medium Severity Vulnerability

Vulnerable Libraries - qs-0.5.6.tgz, qs-0.6.5.tgz

qs-0.5.6.tgz

querystring parser

path: /tmp/git/quake-port/node_modules/winston/node_modules/qs/package.json

Library home page: http://registry.npmjs.org/qs/-/qs-0.5.6.tgz

Dependency Hierarchy:

  • winston-0.7.3.tgz (Root Library)
    • request-2.16.6.tgz
      • qs-0.5.6.tgz (Vulnerable Library)
qs-0.6.5.tgz

querystring parser

path: /tmp/git/quake-port/node_modules/qs/package.json

Library home page: http://registry.npmjs.org/qs/-/qs-0.6.5.tgz

Dependency Hierarchy:

  • express-3.3.8.tgz (Root Library)
    • connect-2.8.8.tgz
      • qs-0.6.5.tgz (Vulnerable Library)

Vulnerability Details

The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.

Publish Date: 2014-10-19

URL: CVE-2014-7191

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/qs_dos_memory_exhaustion

Release Date: 2014-08-06

Fix Resolution: Update qs to version 1.0.0 or greater


Step up your Open Source Security Game with WhiteSource here

CVE-2015-8859 Medium Severity Vulnerability detected by WhiteSource

CVE-2015-8859 - Medium Severity Vulnerability

Vulnerable Library - send-0.1.4.tgz

Better streaming static file server with Range and conditional-GET support

path: /tmp/git/quake-port/node_modules/express/node_modules/send/package.json

Library home page: http://registry.npmjs.org/send/-/send-0.1.4.tgz

Dependency Hierarchy:

  • express-3.3.8.tgz (Root Library)
    • send-0.1.4.tgz (Vulnerable Library)

Vulnerability Details

The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.

Publish Date: 2017-01-23

URL: CVE-2015-8859

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: pillarjs/send@98a5b89

Release Date: 2015-01-20

Fix Resolution: Replace or update the following files: index.js, send.js


Step up your Open Source Security Game with WhiteSource here

CVE-2014-10064 High Severity Vulnerability detected by WhiteSource

CVE-2014-10064 - High Severity Vulnerability

Vulnerable Libraries - qs-0.5.6.tgz, qs-0.6.5.tgz

qs-0.5.6.tgz

querystring parser

path: /tmp/git/quake-port/node_modules/winston/node_modules/qs/package.json

Library home page: http://registry.npmjs.org/qs/-/qs-0.5.6.tgz

Dependency Hierarchy:

  • winston-0.7.3.tgz (Root Library)
    • request-2.16.6.tgz
      • qs-0.5.6.tgz (Vulnerable Library)
qs-0.6.5.tgz

querystring parser

path: /tmp/git/quake-port/node_modules/qs/package.json

Library home page: http://registry.npmjs.org/qs/-/qs-0.6.5.tgz

Dependency Hierarchy:

  • express-3.3.8.tgz (Root Library)
    • connect-2.8.8.tgz
      • qs-0.6.5.tgz (Vulnerable Library)

Vulnerability Details

The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.

Publish Date: 2018-05-31

URL: CVE-2014-10064

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/28

Release Date: 2014-08-06

Fix Resolution: Update to version 1.0.0 or later


Step up your Open Source Security Game with WhiteSource here

CVE-2013-6629 Medium Severity Vulnerability detected by WhiteSource

CVE-2013-6629 - Medium Severity Vulnerability

Vulnerable Library - phantomjs2.0.0

Scriptable Headless Browser

Library home page: https://github.com/ariya/phantomjs.git

Library Source Files (18)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

  • /quake-port/ioq3/code/jpeg-8c/jdmarker.c
  • /quake-port/ioq3/code/jpeg-8c/jctrans.c
  • /quake-port/ioq3/code/jpeg-8c/jdarith.c
  • /quake-port/ioq3/code/jpeg-8c/jerror.h
  • /quake-port/ioq3/code/jpeg-8c/jdatadst.c
  • /quake-port/ioq3/code/jpeg-8c/jcarith.c
  • /quake-port/ioq3/code/jpeg-8c/jdcoefct.c
  • /quake-port/ioq3/code/jpeg-8c/jccoefct.c
  • /quake-port/ioq3/code/jpeg-8c/jaricom.c
  • /quake-port/ioq3/code/jpeg-8c/jdmaster.c
  • /quake-port/ioq3/code/jpeg-8c/jdatasrc.c
  • /quake-port/ioq3/code/jpeg-8c/jutils.c
  • /quake-port/ioq3/code/jpeg-8c/jmemmgr.c
  • /quake-port/ioq3/code/jpeg-8c/jpeglib.h
  • /quake-port/ioq3/code/jpeg-8c/jdhuff.c
  • /quake-port/ioq3/code/jpeg-8c/jcparam.c
  • /quake-port/ioq3/code/jpeg-8c/jcmarker.c
  • /quake-port/ioq3/code/jpeg-8c/jpegint.h

Vulnerability Details

The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.

Publish Date: 2013-11-19

URL: CVE-2013-6629

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://security.gentoo.org/glsa/201606-03

Release Date: 2016-06-05

Fix Resolution: All libjpeg-turbo users should upgrade to the latest version >= libjpeg-turbo-1.4.2


Step up your Open Source Security Game with WhiteSource here

WS-2015-0025 High Severity Vulnerability detected by WhiteSource

WS-2015-0025 - High Severity Vulnerability

Vulnerable Library - tar-0.1.20.tgz

tar for node

path: /tmp/git/quake-port/node_modules/tar/package.json

Library home page: http://registry.npmjs.org/tar/-/tar-0.1.20.tgz

Dependency Hierarchy:

  • node-gyp-0.13.1.tgz (Root Library)
    • tar-0.1.20.tgz (Vulnerable Library)

Vulnerability Details

The tar module earlier than version 2.0.0 allow for archives to contain symbolic links that will overwrite targets outside the expected path for extraction.

Publish Date: 2015-11-03

URL: WS-2015-0025

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/57

Release Date: 2015-11-03

Fix Resolution: Update to a version 2.0.0 or greater


Step up your Open Source Security Game with WhiteSource here

CVE-2016-10540 High Severity Vulnerability detected by WhiteSource

CVE-2016-10540 - High Severity Vulnerability

Vulnerable Libraries - minimatch-0.3.0.tgz, minimatch-0.4.0.tgz

minimatch-0.3.0.tgz

a glob matcher in javascript

path: /tmp/git/quake-port/node_modules/glob/node_modules/minimatch/package.json

Library home page: http://registry.npmjs.org/minimatch/-/minimatch-0.3.0.tgz

Dependency Hierarchy:

  • node-gyp-0.13.1.tgz (Root Library)
    • glob-3.2.11.tgz
      • minimatch-0.3.0.tgz (Vulnerable Library)
minimatch-0.4.0.tgz

a glob matcher in javascript

path: /tmp/git/quake-port/node_modules/minimatch/package.json

Library home page: http://registry.npmjs.org/minimatch/-/minimatch-0.4.0.tgz

Dependency Hierarchy:

  • node-gyp-0.13.1.tgz (Root Library)
    • minimatch-0.4.0.tgz (Vulnerable Library)

Vulnerability Details

Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp objects. The primary function, minimatch(path, pattern) in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern parameter.

Publish Date: 2018-05-31

URL: CVE-2016-10540

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/118

Release Date: 2016-06-20

Fix Resolution: Update to version 3.0.2 or later.


Step up your Open Source Security Game with WhiteSource here

WS-2016-0040 High Severity Vulnerability detected by WhiteSource

WS-2016-0040 - High Severity Vulnerability

Vulnerable Library - ws-0.4.29.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

path: /quake-port/node_modules/ws/package.json

Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz

Dependency Hierarchy:

  • ws-0.4.29.tgz (Vulnerable Library)

Vulnerability Details

By sending an overly long websocket payload to a ws server, it is possible to crash the node process.

Publish Date: 2016-06-24

URL: WS-2016-0040

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/120

Release Date: 2016-06-24

Fix Resolution: Update to version 1.1.1 of ws, or if that is not possible, set the `maxpayload` option for the `ws` server - make sure the value is less than 256MB.


Step up your Open Source Security Game with WhiteSource here

WS-2016-0031 High Severity Vulnerability detected by WhiteSource

WS-2016-0031 - High Severity Vulnerability

Vulnerable Library - ws-0.4.29.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

path: /quake-port/node_modules/ws/package.json

Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz

Dependency Hierarchy:

  • ws-0.4.29.tgz (Vulnerable Library)

Vulnerability Details

DoS in ws module due to excessively large websocket message.

Publish Date: 2016-06-24

URL: WS-2016-0031

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/120

Release Date: 2016-06-24

Fix Resolution: Update to version 1.1.1 of ws, or if that is not possible, set the `maxpayload` option for the `ws` server - make sure the value is less than 256MB.


Step up your Open Source Security Game with WhiteSource here

CVE-2016-2515 High Severity Vulnerability detected by WhiteSource

CVE-2016-2515 - High Severity Vulnerability

Vulnerable Library - hawk-0.10.2.tgz

HTTP Hawk Authentication Scheme

path: /tmp/git/quake-port/node_modules/hawk/package.json

Library home page: http://registry.npmjs.org/hawk/-/hawk-0.10.2.tgz

Dependency Hierarchy:

  • winston-0.7.3.tgz (Root Library)
    • request-2.16.6.tgz
      • hawk-0.10.2.tgz (Vulnerable Library)

Vulnerability Details

Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.

Publish Date: 2016-04-13

URL: CVE-2016-2515

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/77

Release Date: 2016-01-19

Fix Resolution: Update to hawk version 4.1.1 or greater.


Step up your Open Source Security Game with WhiteSource here

CVE-2014-6394 High Severity Vulnerability detected by WhiteSource

CVE-2014-6394 - High Severity Vulnerability

Vulnerable Library - send-0.1.4.tgz

Better streaming static file server with Range and conditional-GET support

path: /tmp/git/quake-port/node_modules/express/node_modules/send/package.json

Library home page: http://registry.npmjs.org/send/-/send-0.1.4.tgz

Dependency Hierarchy:

  • express-3.3.8.tgz (Root Library)
    • send-0.1.4.tgz (Vulnerable Library)

Vulnerability Details

visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.

Publish Date: 2014-10-08

URL: CVE-2014-6394

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/send-directory-traversal

Release Date: 2014-09-12

Fix Resolution: Upgrade to a version greater than or equal to 0.8.4.


Step up your Open Source Security Game with WhiteSource here

CVE-2017-16138 High Severity Vulnerability detected by WhiteSource

CVE-2017-16138 - High Severity Vulnerability

Vulnerable Library - mime-1.2.11.tgz

A comprehensive library for mime-type mapping

path: /tmp/git/quake-port/node_modules/mime/package.json

Library home page: http://registry.npmjs.org/mime/-/mime-1.2.11.tgz

Dependency Hierarchy:

  • express-3.3.8.tgz (Root Library)
    • send-0.1.4.tgz
      • mime-1.2.11.tgz (Vulnerable Library)

Vulnerability Details

The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.

Publish Date: 2018-06-07

URL: CVE-2017-16138

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

WS-2017-0330 Medium Severity Vulnerability detected by WhiteSource

WS-2017-0330 - Medium Severity Vulnerability

Vulnerable Library - mime-1.2.11.tgz

A comprehensive library for mime-type mapping

path: /tmp/git/quake-port/node_modules/mime/package.json

Library home page: http://registry.npmjs.org/mime/-/mime-1.2.11.tgz

Dependency Hierarchy:

  • express-3.3.8.tgz (Root Library)
    • send-0.1.4.tgz
      • mime-1.2.11.tgz (Vulnerable Library)

Vulnerability Details

Affected version of mime (1.0.0 throw 1.4.0 and 2.0.0 throw 2.0.2), are vulnerable to regular expression denial of service.

Publish Date: 2017-09-27

URL: WS-2017-0330

CVSS 2 Score Details (5.0)

Base Score Metrics not available


Step up your Open Source Security Game with WhiteSource here

WS-2017-0107 Medium Severity Vulnerability detected by WhiteSource

WS-2017-0107 - Medium Severity Vulnerability

Vulnerable Library - ws-0.4.29.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

path: /quake-port/node_modules/ws/package.json

Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz

Dependency Hierarchy:

  • ws-0.4.29.tgz (Vulnerable Library)

Vulnerability Details

Depending on the JavaScript engine, Math.random can be anywhere between extremely insecure and cryptographically pseudo-random.
Versions which use Math.random can produce predictable values, thus shall not be used.

Publish Date: 2016-09-20

URL: WS-2017-0107

CVSS 2 Score Details (5.9)

Base Score Metrics not available

Suggested Fix

Type: Change files

Origin: websockets/ws@7253f06

Release Date: 2016-11-25

Fix Resolution: Replace or update the following file: Sender.js


Step up your Open Source Security Game with WhiteSource here

CVE-2017-16119 High Severity Vulnerability detected by WhiteSource

CVE-2017-16119 - High Severity Vulnerability

Vulnerable Library - fresh-0.2.0.tgz

HTTP response freshness testing

path: /tmp/git/quake-port/node_modules/fresh/package.json

Library home page: http://registry.npmjs.org/fresh/-/fresh-0.2.0.tgz

Dependency Hierarchy:

  • express-3.3.8.tgz (Root Library)
    • fresh-0.2.0.tgz (Vulnerable Library)

Vulnerability Details

Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.

Publish Date: 2018-06-07

URL: CVE-2017-16119

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

CVE-2014-6393 Medium Severity Vulnerability detected by WhiteSource

CVE-2014-6393 - Medium Severity Vulnerability

Vulnerable Library - express-3.3.8.tgz

Sinatra inspired web development framework

path: /quake-port/node_modules/express/package.json

Library home page: http://registry.npmjs.org/express/-/express-3.3.8.tgz

Dependency Hierarchy:

  • express-3.3.8.tgz (Vulnerable Library)

Vulnerability Details

The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.

Publish Date: 2017-08-09

URL: CVE-2014-6393

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-6393

Release Date: 2017-08-09

Fix Resolution: 3.11,4.5


Step up your Open Source Security Game with WhiteSource here

CVE-2016-10518 High Severity Vulnerability detected by WhiteSource

CVE-2016-10518 - High Severity Vulnerability

Vulnerable Library - ws-0.4.29.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

path: /quake-port/node_modules/ws/package.json

Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz

Dependency Hierarchy:

  • ws-0.4.29.tgz (Vulnerable Library)

Vulnerability Details

A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.

Publish Date: 2018-05-31

URL: CVE-2016-10518

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/67

Release Date: 2016-01-04

Fix Resolution: Update to version 1.0.1 or greater.


Step up your Open Source Security Game with WhiteSource here

WS-2017-0421 High Severity Vulnerability detected by WhiteSource

WS-2017-0421 - High Severity Vulnerability

Vulnerable Library - ws-0.4.29.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

path: /quake-port/node_modules/ws/package.json

Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz

Dependency Hierarchy:

  • ws-0.4.29.tgz (Vulnerable Library)

Vulnerability Details

Affected version of ws (0.2.6--3.3.0) are vulnerable to A specially crafted value of the Sec-WebSocket-Extensions header that used Object.prototype property names as extension or parameter names could be used to make a ws server crash.

Publish Date: 2017-11-08

URL: WS-2017-0421

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/550/versions

Release Date: 2019-01-24

Fix Resolution: 3.3.1


Step up your Open Source Security Game with WhiteSource here

CVE-2018-1000620 High Severity Vulnerability detected by WhiteSource

CVE-2018-1000620 - High Severity Vulnerability

Vulnerable Library - cryptiles-0.1.3.tgz

General purpose crypto utilities

path: /tmp/git/quake-port/node_modules/cryptiles/package.json

Library home page: http://registry.npmjs.org/cryptiles/-/cryptiles-0.1.3.tgz

Dependency Hierarchy:

  • winston-0.7.3.tgz (Root Library)
    • request-2.16.6.tgz
      • hawk-0.10.2.tgz
        • cryptiles-0.1.3.tgz (Vulnerable Library)

Vulnerability Details

Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.

Publish Date: 2018-07-09

URL: CVE-2018-1000620

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3728 Medium Severity Vulnerability detected by WhiteSource

CVE-2018-3728 - Medium Severity Vulnerability

Vulnerable Library - hoek-0.7.6.tgz

General purpose node utilities

path: /tmp/git/quake-port/node_modules/hoek/package.json

Library home page: http://registry.npmjs.org/hoek/-/hoek-0.7.6.tgz

Dependency Hierarchy:

  • winston-0.7.3.tgz (Root Library)
    • request-2.16.6.tgz
      • hawk-0.10.2.tgz
        • hoek-0.7.6.tgz (Vulnerable Library)

Vulnerability Details

hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-03-30

URL: CVE-2018-3728

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: hapijs/hoek@623667e

Release Date: 2018-02-15

Fix Resolution: Replace or update the following files: index.js, index.js


Step up your Open Source Security Game with WhiteSource here

CVE-2017-16026 Medium Severity Vulnerability detected by WhiteSource

CVE-2017-16026 - Medium Severity Vulnerability

Vulnerable Library - request-2.16.6.tgz

Simplified HTTP request client.

path: /tmp/git/quake-port/node_modules/winston/node_modules/request/package.json

Library home page: http://registry.npmjs.org/request/-/request-2.16.6.tgz

Dependency Hierarchy:

  • winston-0.7.3.tgz (Root Library)
    • request-2.16.6.tgz (Vulnerable Library)

Vulnerability Details

Request is an http client. If a request is made using multipart, and the body type is a number, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.

Publish Date: 2018-06-04

URL: CVE-2017-16026

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/309

Release Date: 2017-04-14

Fix Resolution: Update to version 2.68.0 or later


Step up your Open Source Security Game with WhiteSource here

CVE-2017-1000228 High Severity Vulnerability detected by WhiteSource

CVE-2017-1000228 - High Severity Vulnerability

Vulnerable Library - ejs-0.8.8.tgz

Embedded JavaScript templates

path: /quake-port/node_modules/ejs/package.json

Library home page: http://registry.npmjs.org/ejs/-/ejs-0.8.8.tgz

Dependency Hierarchy:

  • ejs-0.8.8.tgz (Vulnerable Library)

Vulnerability Details

nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function

Publish Date: 2017-11-17

URL: CVE-2017-1000228

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: mde/ejs@3d447c5

Release Date: 2016-11-28

Fix Resolution: Replace or update the following file: ejs.js


Step up your Open Source Security Game with WhiteSource here

WS-2016-0056 Medium Severity Vulnerability detected by WhiteSource

WS-2016-0056 - Medium Severity Vulnerability

Vulnerable Library - cookie-signature-1.0.1.tgz

Sign and unsign cookies

path: /tmp/git/quake-port/node_modules/cookie-signature/package.json

Library home page: http://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.1.tgz

Dependency Hierarchy:

  • express-3.3.8.tgz (Root Library)
    • cookie-signature-1.0.1.tgz (Vulnerable Library)

Vulnerability Details

Cookie-signature before 1.0.4 allows attackers to guess the secret token one character at a time via a timing attack.

Publish Date: 2016-08-29

URL: WS-2016-0056

CVSS 2 Score Details (5.3)

Base Score Metrics not available


Step up your Open Source Security Game with WhiteSource here

WS-2018-0076 Medium Severity Vulnerability detected by WhiteSource

WS-2018-0076 - Medium Severity Vulnerability

Vulnerable Library - tunnel-agent-0.2.0.tgz

HTTP proxy tunneling agent. Formerly part of mikeal/request, now a standalone module.

path: /tmp/git/quake-port/node_modules/winston/node_modules/tunnel-agent/package.json

Library home page: http://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.2.0.tgz

Dependency Hierarchy:

  • winston-0.7.3.tgz (Root Library)
    • request-2.16.6.tgz
      • tunnel-agent-0.2.0.tgz (Vulnerable Library)

Vulnerability Details

Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.

This is exploitable if user supplied input is provided to the auth value and is a number.

Publish Date: 2018-04-25

URL: WS-2018-0076

CVSS 2 Score Details (5.0)

Base Score Metrics not available


Step up your Open Source Security Game with WhiteSource here

WS-2014-0005 Medium Severity Vulnerability detected by WhiteSource

WS-2014-0005 - Medium Severity Vulnerability

Vulnerable Libraries - qs-0.5.6.tgz, qs-0.6.5.tgz

qs-0.5.6.tgz

querystring parser

path: /tmp/git/quake-port/node_modules/winston/node_modules/qs/package.json

Library home page: http://registry.npmjs.org/qs/-/qs-0.5.6.tgz

Dependency Hierarchy:

  • winston-0.7.3.tgz (Root Library)
    • request-2.16.6.tgz
      • qs-0.5.6.tgz (Vulnerable Library)
qs-0.6.5.tgz

querystring parser

path: /tmp/git/quake-port/node_modules/qs/package.json

Library home page: http://registry.npmjs.org/qs/-/qs-0.6.5.tgz

Dependency Hierarchy:

  • express-3.3.8.tgz (Root Library)
    • connect-2.8.8.tgz
      • qs-0.6.5.tgz (Vulnerable Library)

Vulnerability Details

Denial-of-Service Extended Event Loop Blocking.The qs module does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time

Publish Date: 2014-08-06

URL: WS-2014-0005

CVSS 2 Score Details (6.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking

Release Date: 2014-08-06

Fix Resolution: Update qs to version 1.0.0 or greater


Step up your Open Source Security Game with WhiteSource here

CVE-2015-8860 High Severity Vulnerability detected by WhiteSource

CVE-2015-8860 - High Severity Vulnerability

Vulnerable Library - tar-0.1.20.tgz

tar for node

path: /tmp/git/quake-port/node_modules/tar/package.json

Library home page: http://registry.npmjs.org/tar/-/tar-0.1.20.tgz

Dependency Hierarchy:

  • node-gyp-0.13.1.tgz (Root Library)
    • tar-0.1.20.tgz (Vulnerable Library)

Vulnerability Details

The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.

Publish Date: 2017-01-23

URL: CVE-2015-8860

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: isaacs/node-tar@a5337a6

Release Date: 2015-03-27

Fix Resolution: Replace or update the following files: extract.js, dir-normalization.tar, dir-normalization.js


Step up your Open Source Security Game with WhiteSource here

WS-2015-0018 Medium Severity Vulnerability detected by WhiteSource

WS-2015-0018 - Medium Severity Vulnerability

Vulnerable Library - semver-2.2.1.tgz

The semantic version parser used by npm.

path: /tmp/git/quake-port/node_modules/semver/package.json

Library home page: http://registry.npmjs.org/semver/-/semver-2.2.1.tgz

Dependency Hierarchy:

  • node-gyp-0.13.1.tgz (Root Library)
    • semver-2.2.1.tgz (Vulnerable Library)

Vulnerability Details

Semver is vulnerable to regular expression denial of service (ReDoS) when extremely long version strings are parsed.

Publish Date: 2015-04-04

URL: WS-2015-0018

CVSS 2 Score Details (5.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://nodesecurity.io/advisories/31

Release Date: 2015-04-04

Fix Resolution: Update to a version 4.3.2 or greater


Step up your Open Source Security Game with WhiteSource here

CVE-2018-3717 Medium Severity Vulnerability detected by WhiteSource

CVE-2018-3717 - Medium Severity Vulnerability

Vulnerable Library - connect-2.8.8.tgz

High performance middleware framework

path: /tmp/git/quake-port/node_modules/connect/package.json

Library home page: http://registry.npmjs.org/connect/-/connect-2.8.8.tgz

Dependency Hierarchy:

  • express-3.3.8.tgz (Root Library)
    • connect-2.8.8.tgz (Vulnerable Library)

Vulnerability Details

connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.

Publish Date: 2018-06-07

URL: CVE-2018-3717

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3717

Release Date: 2018-06-07

Fix Resolution: 2.14.0


Step up your Open Source Security Game with WhiteSource here

CVE-2016-10542 High Severity Vulnerability detected by WhiteSource

CVE-2016-10542 - High Severity Vulnerability

Vulnerable Library - ws-0.4.29.tgz

simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455

path: /quake-port/node_modules/ws/package.json

Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz

Dependency Hierarchy:

  • ws-0.4.29.tgz (Vulnerable Library)

Vulnerability Details

ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.

Publish Date: 2018-05-31

URL: CVE-2016-10542

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8858

Release Date: 2018-12-15

Fix Resolution: v2.4.24


Step up your Open Source Security Game with WhiteSource here

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.