blacksuan19 / website Goto Github PK

Vulnerable Library - jquery-1.11.3.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.min.js

Path to vulnerable library: /blacksuan19.github.io/assets/js/jquery.min.js

Dependency Hierarchy:

• ❌ jquery-1.11.3.min.js (Vulnerable Library)

Found in HEAD commit: d2943ea76e87ad85ec01dbd6b4e625b3aad6f177

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

Vulnerable Libraries - rack-protection-1.5.5.gem, sinatra-1.4.8.gem

Found in HEAD commit: d2943ea76e87ad85ec01dbd6b4e625b3aad6f177

Vulnerability Details

An issue was discovered in rack-protection/lib/rack/protection/path_traversal.rb in Sinatra 2.x before 2.0.1 on Windows. Path traversal is possible via backslash characters.

Publish Date: 2018-02-18

URL: CVE-2018-7212

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-7212

Release Date: 2018-02-18

Fix Resolution: 2.0.1

Vulnerable Library - jquery-1.11.3.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.min.js

Path to vulnerable library: /blacksuan19.github.io/assets/js/jquery.min.js

Dependency Hierarchy:

• ❌ jquery-1.11.3.min.js (Vulnerable Library)

Found in HEAD commit: d2943ea76e87ad85ec01dbd6b4e625b3aad6f177

Vulnerability Details

JQuery, before 2.2.0, is vulnerable to Cross-site Scripting (XSS) attacks via text/javascript response with arbitrary code execution.

Publish Date: 2016-11-27

URL: WS-2016-0090

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jquery/jquery@b078a62

Release Date: 2019-04-08

Fix Resolution: 2.2.0

Vulnerable Library - sinatra-1.4.8.gem

Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.

Library home page: https://rubygems.org/gems/sinatra-1.4.8.gem

Path to dependency file: /tmp/ws-scm/blacksuan19.github.io/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/sinatra-1.4.8.gem

Dependency Hierarchy:

• jekyll-admin-0.9.0.gem (Root Library)
  • sinatra-contrib-1.4.7.gem
    • ❌ sinatra-1.4.8.gem (Vulnerable Library)

Found in HEAD commit: d2943ea76e87ad85ec01dbd6b4e625b3aad6f177

Vulnerability Details

Sinatra rack-protection versions 1.5.4 and 2.0.0.rc3 and earlier contains a timing attack vulnerability in the CSRF token checking that can result in signatures can be exposed. This attack appear to be exploitable via network connectivity to the ruby application. This vulnerability appears to have been fixed in 1.5.5 and 2.0.0.

Publish Date: 2018-03-07

URL: CVE-2018-1000119

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Change files

Origin: sinatra/sinatra@8aa6c42#commitcomment-27964109

Release Date: 2016-07-26

Fix Resolution: Replace or update the following files: authenticity_token.rb, base.rb

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /tmp/ws-scm/blacksuan19.github.io/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/rack-1.6.13.gem

Dependency Hierarchy:

• jekyll-admin-0.10.1.gem (Root Library)
  • sinatra-contrib-1.4.7.gem
    • rack-protection-1.5.5.gem
      • ❌ rack-1.6.13.gem (Vulnerable Library)

Found in HEAD commit: c1d69fc72cb1659e2eed1396bef02d05d2c0dfd8

Vulnerability Details

There was a possible directory traversal vulnerability in the Rack::Directory app that is bundled with Rack.

Publish Date: 2020-06-01

URL: CVE-2020-8161

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: None
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://github.com/rack/rack/tree/2.2.0

Release Date: 2020-06-01

Fix Resolution: 2.2.0,2.1.3

Vulnerable Library - jquery-1.11.3.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.min.js

Path to vulnerable library: /blacksuan19.github.io/assets/js/jquery.min.js

Dependency Hierarchy:

• ❌ jquery-1.11.3.min.js (Vulnerable Library)

Found in HEAD commit: d2943ea76e87ad85ec01dbd6b4e625b3aad6f177

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0

Vulnerable Library - jquery-3.4.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.4.1/jquery.min.js

Path to vulnerable library: /blacksuan19.github.io/assets/js/jquery.min.js

Dependency Hierarchy:

• ❌ jquery-3.4.1.min.js (Vulnerable Library)

Found in HEAD commit: 58008c7fcf3a12b83c6bb28d69f3250221052e29

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

Vulnerable Library - sinatra-1.4.8.gem

Sinatra is a DSL for quickly creating web applications in Ruby with minimal effort.

Library home page: https://rubygems.org/gems/sinatra-1.4.8.gem

Path to dependency file: /tmp/ws-scm/blacksuan19.github.io/Gemfile.lock

Path to vulnerable library: /var/lib/gems/2.5.0/cache/sinatra-1.4.8.gem

Dependency Hierarchy:

• jekyll-admin-0.9.0.gem (Root Library)
  • sinatra-contrib-1.4.7.gem
    • ❌ sinatra-1.4.8.gem (Vulnerable Library)

Found in HEAD commit: d2943ea76e87ad85ec01dbd6b4e625b3aad6f177

Vulnerability Details

Sinatra before 2.0.2 has XSS via the 400 Bad Request page that occurs upon a params parser exception.

Publish Date: 2018-05-31

URL: CVE-2018-11627

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-11627

Release Date: 2018-05-31

Fix Resolution: 2.0.2