View Code? Open in Web Editor
NEW
Port of Quake with Phasor
JavaScript 0.46%
HTML 0.28%
Makefile 1.54%
C 52.70%
C++ 1.53%
Assembly 42.53%
Objective-C 0.42%
MATLAB 0.01%
GLSL 0.23%
Roff 0.08%
Yacc 0.02%
Shell 0.15%
NSIS 0.04%
Python 0.01%
Rich Text Format 0.01%
VBScript 0.01%
quake-port's Introduction
quake-port's People
Contributors
Stargazers
Watchers
quake-port's Issues
CVE-2014-7191 - Medium Severity Vulnerability
Vulnerable Libraries - qs-0.5.6.tgz , qs-0.6.5.tgz
qs-0.5.6.tgz
querystring parser
path: /tmp/git/quake-port/node_modules/winston/node_modules/qs/package.json
Library home page: http://registry.npmjs.org/qs/-/qs-0.5.6.tgz
Dependency Hierarchy:
winston-0.7.3.tgz (Root Library)
request-2.16.6.tgz
❌ qs-0.5.6.tgz (Vulnerable Library)
qs-0.6.5.tgz
querystring parser
path: /tmp/git/quake-port/node_modules/qs/package.json
Library home page: http://registry.npmjs.org/qs/-/qs-0.6.5.tgz
Dependency Hierarchy:
express-3.3.8.tgz (Root Library)
connect-2.8.8.tgz
❌ qs-0.6.5.tgz (Vulnerable Library)
Vulnerability Details
The qs module before 1.0.0 in Node.js does not call the compact function for array data, which allows remote attackers to cause a denial of service (memory consumption) by using a large index value to create a sparse array.
Publish Date: 2014-10-19
URL: CVE-2014-7191
CVSS 2 Score Details (5.0 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/qs_dos_memory_exhaustion
Release Date: 2014-08-06
Fix Resolution: Update qs to version 1.0.0 or greater
Step up your Open Source Security Game with WhiteSource here
CVE-2015-8859 - Medium Severity Vulnerability
Vulnerable Library - send-0.1.4.tgz
Better streaming static file server with Range and conditional-GET support
path: /tmp/git/quake-port/node_modules/express/node_modules/send/package.json
Library home page: http://registry.npmjs.org/send/-/send-0.1.4.tgz
Dependency Hierarchy:
express-3.3.8.tgz (Root Library)
❌ send-0.1.4.tgz (Vulnerable Library)
Vulnerability Details
The send package before 0.11.1 for Node.js allows attackers to obtain the root path via unspecified vectors.
Publish Date: 2017-01-23
URL: CVE-2015-8859
CVSS 3 Score Details (5.3 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: Low
Integrity Impact: None
Availability Impact: None
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Change files
Origin: pillarjs/send@98a5b89
Release Date: 2015-01-20
Fix Resolution: Replace or update the following files: index.js, send.js
Step up your Open Source Security Game with WhiteSource here
CVE-2014-10064 - High Severity Vulnerability
Vulnerable Libraries - qs-0.5.6.tgz , qs-0.6.5.tgz
qs-0.5.6.tgz
querystring parser
path: /tmp/git/quake-port/node_modules/winston/node_modules/qs/package.json
Library home page: http://registry.npmjs.org/qs/-/qs-0.5.6.tgz
Dependency Hierarchy:
winston-0.7.3.tgz (Root Library)
request-2.16.6.tgz
❌ qs-0.5.6.tgz (Vulnerable Library)
qs-0.6.5.tgz
querystring parser
path: /tmp/git/quake-port/node_modules/qs/package.json
Library home page: http://registry.npmjs.org/qs/-/qs-0.6.5.tgz
Dependency Hierarchy:
express-3.3.8.tgz (Root Library)
connect-2.8.8.tgz
❌ qs-0.6.5.tgz (Vulnerable Library)
Vulnerability Details
The qs module before 1.0.0 does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time. An attacker could leverage this to cause a temporary denial-of-service condition, for example, in a web application, other requests would not be processed while this blocking is occurring.
Publish Date: 2018-05-31
URL: CVE-2014-10064
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/28
Release Date: 2014-08-06
Fix Resolution: Update to version 1.0.0 or later
Step up your Open Source Security Game with WhiteSource here
CVE-2013-6629 - Medium Severity Vulnerability
Vulnerable Library - phantomjs2.0.0
Scriptable Headless Browser
Library home page: https://github.com/ariya/phantomjs.git
Library Source Files (18)
* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.
/quake-port/ioq3/code/jpeg-8c/jdmarker.c
/quake-port/ioq3/code/jpeg-8c/jctrans.c
/quake-port/ioq3/code/jpeg-8c/jdarith.c
/quake-port/ioq3/code/jpeg-8c/jerror.h
/quake-port/ioq3/code/jpeg-8c/jdatadst.c
/quake-port/ioq3/code/jpeg-8c/jcarith.c
/quake-port/ioq3/code/jpeg-8c/jdcoefct.c
/quake-port/ioq3/code/jpeg-8c/jccoefct.c
/quake-port/ioq3/code/jpeg-8c/jaricom.c
/quake-port/ioq3/code/jpeg-8c/jdmaster.c
/quake-port/ioq3/code/jpeg-8c/jdatasrc.c
/quake-port/ioq3/code/jpeg-8c/jutils.c
/quake-port/ioq3/code/jpeg-8c/jmemmgr.c
/quake-port/ioq3/code/jpeg-8c/jpeglib.h
/quake-port/ioq3/code/jpeg-8c/jdhuff.c
/quake-port/ioq3/code/jpeg-8c/jcparam.c
/quake-port/ioq3/code/jpeg-8c/jcmarker.c
/quake-port/ioq3/code/jpeg-8c/jpegint.h
Vulnerability Details
The get_sos function in jdmarker.c in (1) libjpeg 6b and (2) libjpeg-turbo through 1.3.0, as used in Google Chrome before 31.0.1650.48, Ghostscript, and other products, does not check for certain duplications of component data during the reading of segments that follow Start Of Scan (SOS) JPEG markers, which allows remote attackers to obtain sensitive information from uninitialized memory locations via a crafted JPEG image.
Publish Date: 2013-11-19
URL: CVE-2013-6629
CVSS 2 Score Details (5.0 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://security.gentoo.org/glsa/201606-03
Release Date: 2016-06-05
Fix Resolution: All libjpeg-turbo users should upgrade to the latest version >= libjpeg-turbo-1.4.2
Step up your Open Source Security Game with WhiteSource here
WS-2015-0025 - High Severity Vulnerability
Vulnerable Library - tar-0.1.20.tgz
tar for node
path: /tmp/git/quake-port/node_modules/tar/package.json
Library home page: http://registry.npmjs.org/tar/-/tar-0.1.20.tgz
Dependency Hierarchy:
node-gyp-0.13.1.tgz (Root Library)
❌ tar-0.1.20.tgz (Vulnerable Library)
Vulnerability Details
The tar module earlier than version 2.0.0 allow for archives to contain symbolic links that will overwrite targets outside the expected path for extraction.
Publish Date: 2015-11-03
URL: WS-2015-0025
CVSS 2 Score Details (7.5 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/57
Release Date: 2015-11-03
Fix Resolution: Update to a version 2.0.0 or greater
Step up your Open Source Security Game with WhiteSource here
CVE-2016-10540 - High Severity Vulnerability
Vulnerable Libraries - minimatch-0.3.0.tgz , minimatch-0.4.0.tgz
minimatch-0.3.0.tgz
a glob matcher in javascript
path: /tmp/git/quake-port/node_modules/glob/node_modules/minimatch/package.json
Library home page: http://registry.npmjs.org/minimatch/-/minimatch-0.3.0.tgz
Dependency Hierarchy:
node-gyp-0.13.1.tgz (Root Library)
glob-3.2.11.tgz
❌ minimatch-0.3.0.tgz (Vulnerable Library)
minimatch-0.4.0.tgz
a glob matcher in javascript
path: /tmp/git/quake-port/node_modules/minimatch/package.json
Library home page: http://registry.npmjs.org/minimatch/-/minimatch-0.4.0.tgz
Dependency Hierarchy:
node-gyp-0.13.1.tgz (Root Library)
❌ minimatch-0.4.0.tgz (Vulnerable Library)
Vulnerability Details
Minimatch is a minimal matching utility that works by converting glob expressions into JavaScript RegExp
objects. The primary function, minimatch(path, pattern)
in Minimatch 3.0.1 and earlier is vulnerable to ReDoS in the pattern
parameter.
Publish Date: 2018-05-31
URL: CVE-2016-10540
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/118
Release Date: 2016-06-20
Fix Resolution: Update to version 3.0.2 or later.
Step up your Open Source Security Game with WhiteSource here
WS-2016-0040 - High Severity Vulnerability
Vulnerable Library - ws-0.4.29.tgz
simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455
path: /quake-port/node_modules/ws/package.json
Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz
Dependency Hierarchy:
❌ ws-0.4.29.tgz (Vulnerable Library)
Vulnerability Details
By sending an overly long websocket payload to a ws server, it is possible to crash the node process.
Publish Date: 2016-06-24
URL: WS-2016-0040
CVSS 2 Score Details (7.5 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/120
Release Date: 2016-06-24
Fix Resolution: Update to version 1.1.1 of ws, or if that is not possible, set the `maxpayload` option for the `ws` server - make sure the value is less than 256MB.
Step up your Open Source Security Game with WhiteSource here
WS-2016-0031 - High Severity Vulnerability
Vulnerable Library - ws-0.4.29.tgz
simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455
path: /quake-port/node_modules/ws/package.json
Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz
Dependency Hierarchy:
❌ ws-0.4.29.tgz (Vulnerable Library)
Vulnerability Details
DoS in ws module due to excessively large websocket message.
Publish Date: 2016-06-24
URL: WS-2016-0031
CVSS 2 Score Details (7.5 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/120
Release Date: 2016-06-24
Fix Resolution: Update to version 1.1.1 of ws, or if that is not possible, set the `maxpayload` option for the `ws` server - make sure the value is less than 256MB.
Step up your Open Source Security Game with WhiteSource here
CVE-2016-2515 - High Severity Vulnerability
Vulnerable Library - hawk-0.10.2.tgz
HTTP Hawk Authentication Scheme
path: /tmp/git/quake-port/node_modules/hawk/package.json
Library home page: http://registry.npmjs.org/hawk/-/hawk-0.10.2.tgz
Dependency Hierarchy:
winston-0.7.3.tgz (Root Library)
request-2.16.6.tgz
❌ hawk-0.10.2.tgz (Vulnerable Library)
Vulnerability Details
Hawk before 3.1.3 and 4.x before 4.1.1 allow remote attackers to cause a denial of service (CPU consumption or partial outage) via a long (1) header or (2) URI that is matched against an improper regular expression.
Publish Date: 2016-04-13
URL: CVE-2016-2515
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/77
Release Date: 2016-01-19
Fix Resolution: Update to hawk version 4.1.1 or greater.
Step up your Open Source Security Game with WhiteSource here
CVE-2014-6394 - High Severity Vulnerability
Vulnerable Library - send-0.1.4.tgz
Better streaming static file server with Range and conditional-GET support
path: /tmp/git/quake-port/node_modules/express/node_modules/send/package.json
Library home page: http://registry.npmjs.org/send/-/send-0.1.4.tgz
Dependency Hierarchy:
express-3.3.8.tgz (Root Library)
❌ send-0.1.4.tgz (Vulnerable Library)
Vulnerability Details
visionmedia send before 0.8.4 for Node.js uses a partial comparison for verifying whether a directory is within the document root, which allows remote attackers to access restricted directories, as demonstrated using "public-restricted" under a "public" directory.
Publish Date: 2014-10-08
URL: CVE-2014-6394
CVSS 2 Score Details (7.5 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/send-directory-traversal
Release Date: 2014-09-12
Fix Resolution: Upgrade to a version greater than or equal to 0.8.4.
Step up your Open Source Security Game with WhiteSource here
CVE-2017-16138 - High Severity Vulnerability
Vulnerable Library - mime-1.2.11.tgz
A comprehensive library for mime-type mapping
path: /tmp/git/quake-port/node_modules/mime/package.json
Library home page: http://registry.npmjs.org/mime/-/mime-1.2.11.tgz
Dependency Hierarchy:
express-3.3.8.tgz (Root Library)
send-0.1.4.tgz
❌ mime-1.2.11.tgz (Vulnerable Library)
Vulnerability Details
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Publish Date: 2018-06-07
URL: CVE-2017-16138
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Step up your Open Source Security Game with WhiteSource here
WS-2017-0330 - Medium Severity Vulnerability
Vulnerable Library - mime-1.2.11.tgz
A comprehensive library for mime-type mapping
path: /tmp/git/quake-port/node_modules/mime/package.json
Library home page: http://registry.npmjs.org/mime/-/mime-1.2.11.tgz
Dependency Hierarchy:
express-3.3.8.tgz (Root Library)
send-0.1.4.tgz
❌ mime-1.2.11.tgz (Vulnerable Library)
Vulnerability Details
Affected version of mime (1.0.0 throw 1.4.0 and 2.0.0 throw 2.0.2), are vulnerable to regular expression denial of service.
Publish Date: 2017-09-27
URL: WS-2017-0330
CVSS 2 Score Details (5.0 )
Base Score Metrics not available
Step up your Open Source Security Game with WhiteSource here
WS-2017-0107 - Medium Severity Vulnerability
Vulnerable Library - ws-0.4.29.tgz
simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455
path: /quake-port/node_modules/ws/package.json
Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz
Dependency Hierarchy:
❌ ws-0.4.29.tgz (Vulnerable Library)
Vulnerability Details
Depending on the JavaScript engine, Math.random can be anywhere between extremely insecure and cryptographically pseudo-random.
Versions which use Math.random can produce predictable values, thus shall not be used.
Publish Date: 2016-09-20
URL: WS-2017-0107
CVSS 2 Score Details (5.9 )
Base Score Metrics not available
Suggested Fix
Type: Change files
Origin: websockets/ws@7253f06
Release Date: 2016-11-25
Fix Resolution: Replace or update the following file: Sender.js
Step up your Open Source Security Game with WhiteSource here
CVE-2017-16119 - High Severity Vulnerability
Vulnerable Library - fresh-0.2.0.tgz
HTTP response freshness testing
path: /tmp/git/quake-port/node_modules/fresh/package.json
Library home page: http://registry.npmjs.org/fresh/-/fresh-0.2.0.tgz
Dependency Hierarchy:
express-3.3.8.tgz (Root Library)
❌ fresh-0.2.0.tgz (Vulnerable Library)
Vulnerability Details
Fresh is a module used by the Express.js framework for HTTP response freshness testing. It is vulnerable to a regular expression denial of service when it is passed specially crafted input to parse. This causes the event loop to be blocked causing a denial of service condition.
Publish Date: 2018-06-07
URL: CVE-2017-16119
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Step up your Open Source Security Game with WhiteSource here
CVE-2014-6393 - Medium Severity Vulnerability
Vulnerable Library - express-3.3.8.tgz
Sinatra inspired web development framework
path: /quake-port/node_modules/express/package.json
Library home page: http://registry.npmjs.org/express/-/express-3.3.8.tgz
Dependency Hierarchy:
❌ express-3.3.8.tgz (Vulnerable Library)
Vulnerability Details
The Express web framework before 3.11 and 4.x before 4.5 for Node.js does not provide a charset field in HTTP Content-Type headers in 400 level responses, which might allow remote attackers to conduct cross-site scripting (XSS) attacks via characters in a non-standard encoding.
Publish Date: 2017-08-09
URL: CVE-2014-6393
CVSS 3 Score Details (6.1 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: Required
Scope: Changed
Impact Metrics:
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: None
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-6393
Release Date: 2017-08-09
Fix Resolution: 3.11,4.5
Step up your Open Source Security Game with WhiteSource here
CVE-2016-10518 - High Severity Vulnerability
Vulnerable Library - ws-0.4.29.tgz
simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455
path: /quake-port/node_modules/ws/package.json
Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz
Dependency Hierarchy:
❌ ws-0.4.29.tgz (Vulnerable Library)
Vulnerability Details
A vulnerability was found in the ping functionality of the ws module before 1.0.0 which allowed clients to allocate memory by sending a ping frame. The ping functionality by default responds with a pong frame and the previously given payload of the ping frame. This is exactly what you expect, but internally ws always transforms all data that we need to send to a Buffer instance and that is where the vulnerability existed. ws didn't do any checks for the type of data it was sending. With buffers in node when you allocate it when a number instead of a string it will allocate the amount of bytes.
Publish Date: 2018-05-31
URL: CVE-2016-10518
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/67
Release Date: 2016-01-04
Fix Resolution: Update to version 1.0.1 or greater.
Step up your Open Source Security Game with WhiteSource here
WS-2017-0421 - High Severity Vulnerability
Vulnerable Library - ws-0.4.29.tgz
simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455
path: /quake-port/node_modules/ws/package.json
Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz
Dependency Hierarchy:
❌ ws-0.4.29.tgz (Vulnerable Library)
Vulnerability Details
Affected version of ws (0.2.6--3.3.0) are vulnerable to A specially crafted value of the Sec-WebSocket-Extensions header that used Object.prototype property names as extension or parameter names could be used to make a ws server crash.
Publish Date: 2017-11-08
URL: WS-2017-0421
CVSS 2 Score Details (7.5 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/550/versions
Release Date: 2019-01-24
Fix Resolution: 3.3.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - cryptiles-0.1.3.tgz
General purpose crypto utilities
path: /tmp/git/quake-port/node_modules/cryptiles/package.json
Library home page: http://registry.npmjs.org/cryptiles/-/cryptiles-0.1.3.tgz
Dependency Hierarchy:
winston-0.7.3.tgz (Root Library)
request-2.16.6.tgz
hawk-0.10.2.tgz
❌ cryptiles-0.1.3.tgz (Vulnerable Library)
Vulnerability Details
Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.
Publish Date: 2018-07-09
URL: CVE-2018-1000620
CVSS 3 Score Details (9.8 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Step up your Open Source Security Game with WhiteSource here
CVE-2018-3728 - Medium Severity Vulnerability
Vulnerable Library - hoek-0.7.6.tgz
General purpose node utilities
path: /tmp/git/quake-port/node_modules/hoek/package.json
Library home page: http://registry.npmjs.org/hoek/-/hoek-0.7.6.tgz
Dependency Hierarchy:
winston-0.7.3.tgz (Root Library)
request-2.16.6.tgz
hawk-0.10.2.tgz
❌ hoek-0.7.6.tgz (Vulnerable Library)
Vulnerability Details
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto , causing the addition or modification of an existing property that will exist on all objects.
Publish Date: 2018-03-30
URL: CVE-2018-3728
CVSS 3 Score Details (6.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: High
Availability Impact: None
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Change files
Origin: hapijs/hoek@623667e
Release Date: 2018-02-15
Fix Resolution: Replace or update the following files: index.js, index.js
Step up your Open Source Security Game with WhiteSource here
CVE-2017-16026 - Medium Severity Vulnerability
Vulnerable Library - request-2.16.6.tgz
Simplified HTTP request client.
path: /tmp/git/quake-port/node_modules/winston/node_modules/request/package.json
Library home page: http://registry.npmjs.org/request/-/request-2.16.6.tgz
Dependency Hierarchy:
winston-0.7.3.tgz (Root Library)
❌ request-2.16.6.tgz (Vulnerable Library)
Vulnerability Details
Request is an http client. If a request is made using multipart
, and the body type is a number
, then the specified number of non-zero memory is passed in the body. This affects Request >=2.2.6 <2.47.0 || >2.51.0 <=2.67.0.
Publish Date: 2018-06-04
URL: CVE-2017-16026
CVSS 3 Score Details (5.9 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: High
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: None
Availability Impact: None
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/309
Release Date: 2017-04-14
Fix Resolution: Update to version 2.68.0 or later
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - ejs-0.8.8.tgz
Embedded JavaScript templates
path: /quake-port/node_modules/ejs/package.json
Library home page: http://registry.npmjs.org/ejs/-/ejs-0.8.8.tgz
Dependency Hierarchy:
❌ ejs-0.8.8.tgz (Vulnerable Library)
Vulnerability Details
nodejs ejs versions older than 2.5.3 is vulnerable to remote code execution due to weak input validation in ejs.renderFile() function
Publish Date: 2017-11-17
URL: CVE-2017-1000228
CVSS 3 Score Details (9.8 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: High
Integrity Impact: High
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Change files
Origin: mde/ejs@3d447c5
Release Date: 2016-11-28
Fix Resolution: Replace or update the following file: ejs.js
Step up your Open Source Security Game with WhiteSource here
WS-2016-0056 - Medium Severity Vulnerability
Vulnerable Library - cookie-signature-1.0.1.tgz
Sign and unsign cookies
path: /tmp/git/quake-port/node_modules/cookie-signature/package.json
Library home page: http://registry.npmjs.org/cookie-signature/-/cookie-signature-1.0.1.tgz
Dependency Hierarchy:
express-3.3.8.tgz (Root Library)
❌ cookie-signature-1.0.1.tgz (Vulnerable Library)
Vulnerability Details
Cookie-signature before 1.0.4 allows attackers to guess the secret token one character at a time via a timing attack.
Publish Date: 2016-08-29
URL: WS-2016-0056
CVSS 2 Score Details (5.3 )
Base Score Metrics not available
Step up your Open Source Security Game with WhiteSource here
WS-2018-0076 - Medium Severity Vulnerability
Vulnerable Library - tunnel-agent-0.2.0.tgz
HTTP proxy tunneling agent. Formerly part of mikeal/request, now a standalone module.
path: /tmp/git/quake-port/node_modules/winston/node_modules/tunnel-agent/package.json
Library home page: http://registry.npmjs.org/tunnel-agent/-/tunnel-agent-0.2.0.tgz
Dependency Hierarchy:
winston-0.7.3.tgz (Root Library)
request-2.16.6.tgz
❌ tunnel-agent-0.2.0.tgz (Vulnerable Library)
Vulnerability Details
Versions of tunnel-agent before 0.6.0 are vulnerable to memory exposure.
This is exploitable if user supplied input is provided to the auth value and is a number.
Publish Date: 2018-04-25
URL: WS-2018-0076
CVSS 2 Score Details (5.0 )
Base Score Metrics not available
Step up your Open Source Security Game with WhiteSource here
WS-2014-0005 - Medium Severity Vulnerability
Vulnerable Libraries - qs-0.5.6.tgz , qs-0.6.5.tgz
qs-0.5.6.tgz
querystring parser
path: /tmp/git/quake-port/node_modules/winston/node_modules/qs/package.json
Library home page: http://registry.npmjs.org/qs/-/qs-0.5.6.tgz
Dependency Hierarchy:
winston-0.7.3.tgz (Root Library)
request-2.16.6.tgz
❌ qs-0.5.6.tgz (Vulnerable Library)
qs-0.6.5.tgz
querystring parser
path: /tmp/git/quake-port/node_modules/qs/package.json
Library home page: http://registry.npmjs.org/qs/-/qs-0.6.5.tgz
Dependency Hierarchy:
express-3.3.8.tgz (Root Library)
connect-2.8.8.tgz
❌ qs-0.6.5.tgz (Vulnerable Library)
Vulnerability Details
Denial-of-Service Extended Event Loop Blocking.The qs module does not have an option or default for specifying object depth and when parsing a string representing a deeply nested object will block the event loop for long periods of time
Publish Date: 2014-08-06
URL: WS-2014-0005
CVSS 2 Score Details (6.5 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/qs_dos_extended_event_loop_blocking
Release Date: 2014-08-06
Fix Resolution: Update qs to version 1.0.0 or greater
Step up your Open Source Security Game with WhiteSource here
CVE-2015-8860 - High Severity Vulnerability
Vulnerable Library - tar-0.1.20.tgz
tar for node
path: /tmp/git/quake-port/node_modules/tar/package.json
Library home page: http://registry.npmjs.org/tar/-/tar-0.1.20.tgz
Dependency Hierarchy:
node-gyp-0.13.1.tgz (Root Library)
❌ tar-0.1.20.tgz (Vulnerable Library)
Vulnerability Details
The tar package before 2.0.0 for Node.js allows remote attackers to write to arbitrary files via a symlink attack in an archive.
Publish Date: 2017-01-23
URL: CVE-2015-8860
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: High
Availability Impact: None
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Change files
Origin: isaacs/node-tar@a5337a6
Release Date: 2015-03-27
Fix Resolution: Replace or update the following files: extract.js, dir-normalization.tar, dir-normalization.js
Step up your Open Source Security Game with WhiteSource here
WS-2015-0018 - Medium Severity Vulnerability
Vulnerable Library - semver-2.2.1.tgz
The semantic version parser used by npm.
path: /tmp/git/quake-port/node_modules/semver/package.json
Library home page: http://registry.npmjs.org/semver/-/semver-2.2.1.tgz
Dependency Hierarchy:
node-gyp-0.13.1.tgz (Root Library)
❌ semver-2.2.1.tgz (Vulnerable Library)
Vulnerability Details
Semver is vulnerable to regular expression denial of service (ReDoS) when extremely long version strings are parsed.
Publish Date: 2015-04-04
URL: WS-2015-0018
CVSS 2 Score Details (5.3 )
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/31
Release Date: 2015-04-04
Fix Resolution: Update to a version 4.3.2 or greater
Step up your Open Source Security Game with WhiteSource here
CVE-2018-3717 - Medium Severity Vulnerability
Vulnerable Library - connect-2.8.8.tgz
High performance middleware framework
path: /tmp/git/quake-port/node_modules/connect/package.json
Library home page: http://registry.npmjs.org/connect/-/connect-2.8.8.tgz
Dependency Hierarchy:
express-3.3.8.tgz (Root Library)
❌ connect-2.8.8.tgz (Vulnerable Library)
Vulnerability Details
connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vulnerability due to a lack of validation of file in directory.js middleware.
Publish Date: 2018-06-07
URL: CVE-2018-3717
CVSS 3 Score Details (5.4 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: Low
User Interaction: Required
Scope: Changed
Impact Metrics:
Confidentiality Impact: Low
Integrity Impact: Low
Availability Impact: None
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3717
Release Date: 2018-06-07
Fix Resolution: 2.14.0
Step up your Open Source Security Game with WhiteSource here
CVE-2016-10542 - High Severity Vulnerability
Vulnerable Library - ws-0.4.29.tgz
simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455
path: /quake-port/node_modules/ws/package.json
Library home page: http://registry.npmjs.org/ws/-/ws-0.4.29.tgz
Dependency Hierarchy:
❌ ws-0.4.29.tgz (Vulnerable Library)
Vulnerability Details
ws is a "simple to use, blazing fast and thoroughly tested websocket client, server and console for node.js, up-to-date against RFC-6455". By sending an overly long websocket payload to a ws
server, it is possible to crash the node process. This affects ws 1.1.0 and earlier.
Publish Date: 2018-05-31
URL: CVE-2016-10542
CVSS 3 Score Details (7.5 )
Base Score Metrics:
Exploitability Metrics:
Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Impact Metrics:
Confidentiality Impact: None
Integrity Impact: None
Availability Impact: High
For more information on CVSS3 Scores, click here .
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8858
Release Date: 2018-12-15
Fix Resolution: v2.4.24
Step up your Open Source Security Game with WhiteSource here