willmao / tschess Goto Github PK

Vulnerabilities

DepShield reports that this application's usage of debug:2.2.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.2.0 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ socket.io-parser:2.3.1
                    └─ debug:2.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of adm-zip:0.4.4 results in the following vulnerability(s):

• (CVSS 9.1) CWE-29: Path Traversal: '..filename'
• (CVSS 5.5) [CVE-2018-1002204] Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal")

---

Occurrences

adm-zip:0.4.4 is a transitive dependency introduced by the following direct dependency(s):

• protractor:5.1.2
        └─ webdriver-js-extender:1.0.0
              └─ selenium-webdriver:2.53.3
                    └─ adm-zip:0.4.4

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:2.3.3 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.3.3 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ engine.io:1.8.3
                    └─ debug:2.3.3
              └─ socket.io-adapter:0.5.0
                    └─ debug:2.3.3
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3
                          └─ debug:2.3.3
                    └─ debug:2.3.3
              └─ debug:2.3.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.memoize:4.1.2 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.memoize:4.1.2 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ cssnano:3.10.0
              └─ postcss-merge-rules:2.1.2
                    └─ caniuse-api:1.6.1
                          └─ lodash.memoize:4.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash:4.17.4 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash:4.17.4 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ copy-webpack-plugin:4.0.1
              └─ lodash:4.17.4
        └─ extract-text-webpack-plugin:3.0.0
              └─ async:2.5.0
                    └─ lodash:4.17.4
        └─ html-webpack-plugin:2.30.1
              └─ lodash:4.17.4
        └─ istanbul-instrumenter-loader:2.0.0
              └─ istanbul-lib-instrument:1.8.0
                    └─ babel-generator:6.26.0
                          └─ lodash:4.17.4
                    └─ babel-template:6.26.0
                          └─ lodash:4.17.4
                    └─ babel-traverse:6.26.0
                          └─ lodash:4.17.4
                    └─ babel-types:6.26.0
                          └─ lodash:4.17.4
        └─ lodash:4.17.4
        └─ node-sass:4.5.3
              └─ gaze:1.1.2
                    └─ globule:1.2.0
                          └─ lodash:4.17.4
              └─ sass-graph:2.2.4
                    └─ lodash:4.17.4
        └─ webpack-dev-server:2.7.1
              └─ http-proxy-middleware:0.17.4
                    └─ lodash:4.17.4
        └─ webpack-merge:4.1.0
              └─ lodash:4.17.4

• angular-cli-ghpages:0.5.1
        └─ gh-pages:0.12.0
              └─ async:2.1.2
                    └─ lodash:4.17.4

• karma:1.7.1
        └─ combine-lists:1.0.1
              └─ lodash:4.17.4

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of fstream:1.0.11 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2019-13173] Improper Input Validation
• (CVSS 7.5) CWE-62: UNIX Hard Link

---

Occurrences

fstream:1.0.11 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ node-sass:4.5.3
              └─ node-gyp:3.6.2
                    └─ fstream:1.0.11
                    └─ tar:2.2.1
                          └─ fstream:1.0.11

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.camelcase:4.3.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.camelcase:4.3.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ css-loader:0.28.7
              └─ lodash.camelcase:4.3.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of tar:2.2.1 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2018-20834] Improper Link Resolution Before File Access ("Link Following")
• (CVSS 7.5) CWE-62: UNIX Hard Link

---

Occurrences

tar:2.2.1 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ node-sass:4.5.3
              └─ node-gyp:3.6.2
                    └─ tar:2.2.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of stringstream:0.0.5 results in the following vulnerability(s):

• (CVSS 7.4) CWE-125: Out-of-bounds Read
• (CVSS 5.2) CWE-125: Out-of-bounds Read

---

Occurrences

stringstream:0.0.5 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ less:2.7.2
              └─ request:2.81.0
                    └─ stringstream:0.0.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of sshpk:1.13.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

sshpk:1.13.1 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ less:2.7.2
              └─ request:2.81.0
                    └─ http-signature:1.1.1
                          └─ sshpk:1.13.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of url-parse:1.0.5 results in the following vulnerability(s):

• (CVSS 6.1) CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

---

Occurrences

url-parse:1.0.5 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ webpack-dev-server:2.7.1
              └─ sockjs-client:1.1.4
                    └─ eventsource:0.1.6
                          └─ original:1.0.0
                                └─ url-parse:1.0.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of forwarded:0.1.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

forwarded:0.1.1 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ webpack-dev-server:2.7.1
              └─ express:4.15.4
                    └─ proxy-addr:1.1.5
                          └─ forwarded:0.1.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of webpack-dev-server:2.7.1 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2018-14732] Improper Input Validation
• (CVSS 6.9) CWE-346: Origin Validation Error

---

Occurrences

webpack-dev-server:2.7.1 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ webpack-dev-server:2.7.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of uglify-js:2.3.6 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2015-8857] The uglify-js package before 2.4.24 for Node.js does not properly account for no...
• (CVSS 8.3) CWE-95: Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection')
• (CVSS 7.5) [CVE-2015-8858] Resource Management Errors
• (CVSS 5.3) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

uglify-js:2.3.6 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ postcss-url:5.1.2
              └─ directory-encoder:0.7.2
                    └─ handlebars:1.3.0
                          └─ uglify-js:2.3.6

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of url-parse:1.1.9 results in the following vulnerability(s):

• (CVSS 6.1) CWE-601: URL Redirection to Untrusted Site ('Open Redirect')

---

Occurrences

url-parse:1.1.9 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ webpack-dev-server:2.7.1
              └─ sockjs-client:1.1.4
                    └─ url-parse:1.1.9

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of node-forge:0.6.33 results in the following vulnerability(s):

• (CVSS 7.5) CWE-185: Incorrect Regular Expression
• (CVSS 7.5) CWE-185: Incorrect Regular Expression

---

Occurrences

node-forge:0.6.33 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ webpack-dev-server:2.7.1
              └─ selfsigned:1.10.1
                    └─ node-forge:0.6.33

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of q:1.4.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

---

Occurrences

q:1.4.1 is a transitive dependency introduced by the following direct dependency(s):

• angular-cli-ghpages:0.5.1
        └─ gh-pages:0.12.0
              └─ q:1.4.1

• protractor:5.1.2
        └─ q:1.4.1
        └─ webdriver-manager:12.0.6
              └─ q:1.4.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of https-proxy-agent:1.0.0 results in the following vulnerability(s):

• (CVSS 8.2) CWE-20: Improper Input Validation

---

Occurrences

https-proxy-agent:1.0.0 is a transitive dependency introduced by the following direct dependency(s):

• protractor:5.1.2
        └─ saucelabs:1.3.0
              └─ https-proxy-agent:1.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.clonedeep:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.clonedeep:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ node-sass:4.5.3
              └─ lodash.clonedeep:4.5.0
        └─ stylus-loader:3.0.1
              └─ lodash.clonedeep:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of ws:1.1.2 results in the following vulnerability(s):

• (CVSS 7.5) CWE-20: Improper Input Validation

---

Occurrences

ws:1.1.2 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ engine.io:1.8.3
                    └─ ws:1.1.2
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3
                          └─ ws:1.1.2

• protractor:5.1.2
        └─ webdriver-js-extender:1.0.0
              └─ selenium-webdriver:2.53.3
                    └─ ws:1.1.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of engine.io-client:1.8.3 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

engine.io-client:1.8.3 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.uniq:4.5.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.uniq:4.5.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ cssnano:3.10.0
              └─ postcss-merge-rules:2.1.2
                    └─ caniuse-api:1.6.1
                          └─ lodash.uniq:4.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of hoek:2.16.3 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3728] Improper Access Control

---

Occurrences

hoek:2.16.3 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ less:2.7.2
              └─ request:2.81.0
                    └─ hawk:3.1.3
                          └─ boom:2.10.1
                                └─ hoek:2.16.3
                          └─ hoek:2.16.3
                          └─ sntp:1.0.9
                                └─ hoek:2.16.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of cryptiles:2.0.5 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-1000620] Insufficient Entropy

---

Occurrences

cryptiles:2.0.5 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ less:2.7.2
              └─ request:2.81.0
                    └─ hawk:3.1.3
                          └─ cryptiles:2.0.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of mime:1.3.4 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

mime:1.3.4 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ webpack-dev-server:2.7.1
              └─ express:4.15.4
                    └─ send:0.15.4
                          └─ mime:1.3.4

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:2.6.8 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.6.8 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ heimdalljs-logger:0.1.9
              └─ debug:2.6.8
        └─ istanbul-instrumenter-loader:2.0.0
              └─ istanbul-lib-instrument:1.8.0
                    └─ babel-traverse:6.26.0
                          └─ debug:2.6.8
        └─ portfinder:1.0.13
              └─ debug:2.6.8
        └─ silent-error:1.1.0
              └─ debug:2.6.8
        └─ stylus:0.54.5
              └─ debug:2.6.8
        └─ webpack-dev-server:2.7.1
              └─ compression:1.7.0
                    └─ debug:2.6.8
              └─ express:4.15.4
                    └─ debug:2.6.8
                    └─ send:0.15.4
                          └─ debug:2.6.8
              └─ serve-index:1.9.0
                    └─ debug:2.6.8
              └─ sockjs-client:1.1.4
                    └─ debug:2.6.8
              └─ spdy:3.4.7
                    └─ debug:2.6.8
                    └─ spdy-transport:2.0.20
                          └─ debug:2.6.8

• karma:1.7.1
        └─ body-parser:1.18.1
              └─ debug:2.6.8
        └─ connect:3.6.3
              └─ debug:2.6.8
              └─ finalhandler:1.0.4
                    └─ debug:2.6.8

• karma-coverage-istanbul-reporter:1.3.0
        └─ istanbul-api:1.1.14
              └─ istanbul-lib-source-maps:1.2.1
                    └─ debug:2.6.8

• protractor:5.1.2
        └─ saucelabs:1.3.0
              └─ https-proxy-agent:1.0.0
                    └─ debug:2.6.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of handlebars:1.3.0 results in the following vulnerability(s):

• (CVSS 6.1) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
• (CVSS 6.1) [CVE-2015-8861] Improper Neutralization of Input During Web Page Generation ("Cross-site Scripting")
• (CVSS 5.3) CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

---

Occurrences

handlebars:1.3.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ postcss-url:5.1.2
              └─ directory-encoder:0.7.2
                    └─ handlebars:1.3.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of d:1.0.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

---

Occurrences

d:1.0.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ webpack:3.5.6
              └─ escope:3.6.0
                    └─ es6-map:0.1.5
                          └─ d:1.0.0
                          └─ es6-iterator:2.0.1
                                └─ d:1.0.0
                          └─ es6-set:0.1.5
                                └─ d:1.0.0
                          └─ es6-symbol:3.1.1
                                └─ d:1.0.0
                          └─ event-emitter:0.3.5
                                └─ d:1.0.0
                    └─ es6-weak-map:2.0.2
                          └─ d:1.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of mime:1.3.6 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

mime:1.3.6 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ url-loader:0.5.9
              └─ mime:1.3.6

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of mime:1.4.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

mime:1.4.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ less:2.7.2
              └─ mime:1.4.0
        └─ postcss-url:5.1.2
              └─ mime:1.4.0
        └─ webpack-dev-middleware:1.12.0
              └─ mime:1.4.0

• angular-cli-ghpages:0.5.1
        └─ gh-pages:0.12.0
              └─ q-io:1.13.2
                    └─ mime:1.4.0

• karma:1.7.1
        └─ mime:1.4.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of tough-cookie:2.3.2 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) [CVE-2017-15010] Uncontrolled Resource Consumption ("Resource Exhaustion")
• (CVSS 7.5) CWE-185: Incorrect Regular Expression
• (CVSS 7.5) CWE-185: Incorrect Regular Expression

---

Occurrences

tough-cookie:2.3.2 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ less:2.7.2
              └─ request:2.81.0
                    └─ tough-cookie:2.3.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.tail:4.1.1 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.tail:4.1.1 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ sass-loader:6.0.6
              └─ lodash.tail:4.1.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of macaddress:0.2.8 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-13797] Improper Neutralization of Special Elements used in a Command (Command Injection)

---

Occurrences

macaddress:0.2.8 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ cssnano:3.10.0
              └─ postcss-filter-plugins:2.0.2
                    └─ uniqid:4.1.1
                          └─ macaddress:0.2.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of fresh:0.5.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

fresh:0.5.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ webpack-dev-server:2.7.1
              └─ express:4.15.4
                    └─ fresh:0.5.0
                    └─ send:0.15.4
                          └─ fresh:0.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of adm-zip:0.4.7 results in the following vulnerability(s):

• (CVSS 9.1) CWE-29: Path Traversal: '..filename'
• (CVSS 5.5) [CVE-2018-1002204] Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal")

---

Occurrences

adm-zip:0.4.7 is a transitive dependency introduced by the following direct dependency(s):

• protractor:5.1.2
        └─ webdriver-manager:12.0.6
              └─ adm-zip:0.4.7
        └─ selenium-webdriver:3.0.1
              └─ adm-zip:0.4.7

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of parsejson:0.0.3 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

parsejson:0.0.3 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ socket.io:1.7.3
              └─ socket.io-client:1.7.3
                    └─ engine.io-client:1.8.3
                          └─ parsejson:0.0.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash:3.10.1 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash:3.10.1 is a transitive dependency introduced by the following direct dependency(s):

• karma:1.7.1
        └─ lodash:3.10.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash.assign:4.2.0 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash.assign:4.2.0 is a transitive dependency introduced by the following direct dependency(s):

• @angular/cli:1.4.2
        └─ node-sass:4.5.3
              └─ lodash.assign:4.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}