pkurremula / apigatewaysolution Goto Github PK

C# 39.41% Dockerfile 5.17% HTML 35.97% CSS 19.45%

apigatewaysolution's Introduction

.NET Core Demo Microservice Solution

Watch Tutorial Videos Now:

.NET Core Web API Microservice with SQL Server Entity Framework Core - https://www.youtube.com/watch?v=2p01iafOxUw
.Net Core MySQL Microservice - Entity Framework Core MySQL - https://www.youtube.com/watch?v=b1BSu0Wb2Rw
.Net Core MongoDB Microservice - .Net Core MongoDB CRUD - https://www.youtube.com/watch?v=fWwbY91eDlY
ASP.Net Core API Gateway - Ocelot API Microservice - https://www.youtube.com/watch?v=k4l3Ptd4yjw

This solution is a collection of three microservices with different database (SQL Server, MySQL & MongoDB). We'll be developing a API Gateway which communicates with all the three microservices for doing the CRUD operations. Finally we'll also develop a Web Application which only communicates with the API Gateway.

Follow the Youtube Playlist: https://www.youtube.com/playlist?list=PLzewa6pjbr3JQKhB_U_FiuYwQC70i-TyU

Visual Studio provides a consistent way to develop Docker containers and validate your application locally. You can run and debug your apps in Linux or Windows containers running on your local Windows desktop with Docker installed, and you don't have to restart the container each time you make a code change.

You can view what's going on inside the containers that host your app by using the Containers window. If you're used to using the command prompt to run Docker commands to view and diagnose what's going on with your containers, this window provides a more convenient way to monitor your containers without leaving the Visual Studio IDE.

What is Docker Compose? Docker Compose is a tool for defining and running multi-container Docker applications. With Compose, you use a YAML file to configure your application’s services. Then, with a single command, you create and start all the services from your configuration.

Docker for .Net Core: .NET Core can easily run in a Docker container. Containers provide a lightweight way to isolate your application from the rest of the host system, sharing just the kernel, and using resources given to your application. Learn how to use docker for .Net Core and deploy .Net Core to Docker.

.NET Core images Official .NET Core Docker images are published to the Microsoft Container Registry (MCR) and are discoverable at the Microsoft .NET Core Docker Hub repository. Each repository contains images for different combinations of the .NET (SDK or Runtime) and OS that you can use. Microsoft provides images that are tailored for specific scenarios. For example, the ASP.NET Core repository provides images that are built for running ASP.NET Core apps in production.

The tools included in Visual Studio for developing with Docker containers [.Net Core Docker Container] are easy to use, and greatly simplify building, debugging, and deployment for containerized applications. You can work with a container for a single project, or use container orchestration with Docker Compose or Service Fabric to work with multiple services in containers.

apigatewaysolution's People

Contributors

Watchers

apigatewaysolution's Issues

Google.Protobuf-3.19.4.0.dll: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - Google.Protobuf-3.19.4.0.dll

Google Protocol Buffers

Library home page: https://api.nuget.org/packages/google.protobuf.3.19.4.nupkg

Path to vulnerable library: /ProductWebAPI/bin/Debug/net6.0/Google.Protobuf.dll,/bin/Debug/Google.Protobuf.dll

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (Google.Protobuf version)	Remediation Available
CVE-2022-1941	High	7.5	Google.Protobuf-3.19.4.0.dll	Direct	Google.Protobuf - 3.18.3,3.19.5,3.20.2,3.21.6;protobuf-python - 3.18.3,3.19.5,3.20.2,4.21.6	❌

Details

CVE-2022-1941

Vulnerable Library - Google.Protobuf-3.19.4.0.dll

Google Protocol Buffers

Library home page: https://api.nuget.org/packages/google.protobuf.3.19.4.nupkg

Path to vulnerable library: /ProductWebAPI/bin/Debug/net6.0/Google.Protobuf.dll,/bin/Debug/Google.Protobuf.dll

Dependency Hierarchy:

❌ Google.Protobuf-3.19.4.0.dll (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

A parsing vulnerability for the MessageSet type in the ProtocolBuffers versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 3.21.5 for protobuf-cpp, and versions prior to and including 3.16.1, 3.17.3, 3.18.2, 3.19.4, 3.20.1 and 4.21.5 for protobuf-python can lead to out of memory failures. A specially crafted message with multiple key-value per elements creates parsing issues, and can lead to a Denial of Service against services receiving unsanitized input. We recommend upgrading to versions 3.18.3, 3.19.5, 3.20.2, 3.21.6 for protobuf-cpp and 3.18.3, 3.19.5, 3.20.2, 4.21.6 for protobuf-python. Versions for 3.16 and 3.17 are no longer updated.

Publish Date: 2022-09-22

URL: CVE-2022-1941

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cloud.google.com/support/bulletins#GCP-2022-019

Release Date: 2022-09-22

Fix Resolution: Google.Protobuf - 3.18.3,3.19.5,3.20.2,3.21.6;protobuf-python - 3.18.3,3.19.5,3.20.2,4.21.6

Step up your Open Source Security Game with Mend here

microsoft.entityframeworkcore.sqlserver.6.0.5.nupkg: 3 vulnerabilities (highest severity is: 8.7)

Vulnerable Library - microsoft.entityframeworkcore.sqlserver.6.0.5.nupkg

Path to dependency file: /CustomerWebAPI/CustomerWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.drawing.common/4.7.0/system.drawing.common.4.7.0.nupkg

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (microsoft.entityframeworkcore.sqlserver.6.0.5.nupkg version)	Remediation Possible**
CVE-2024-0056	High	8.7	microsoft.data.sqlclient.2.1.4.nupkg	Transitive	N/A*	❌
CVE-2021-24112	High	8.1	system.drawing.common.4.7.0.nupkg	Transitive	N/A*	❌
CVE-2024-21319	Medium	6.8	detected in multiple dependencies	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-0056

Vulnerable Library - microsoft.data.sqlclient.2.1.4.nupkg

Provides the data provider for SQL Server. These classes provide access to versions of SQL Server an...

Library home page: https://api.nuget.org/packages/microsoft.data.sqlclient.2.1.4.nupkg

Path to dependency file: /CustomerWebAPI/CustomerWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.data.sqlclient/2.1.4/microsoft.data.sqlclient.2.1.4.nupkg

Dependency Hierarchy:

microsoft.entityframeworkcore.sqlserver.6.0.5.nupkg (Root Library)
- ❌ microsoft.data.sqlclient.2.1.4.nupkg (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-0056

CVSS 3 Score Details (8.7)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-98g6-xh36-x2p7

Release Date: 2024-01-09

Fix Resolution: Microsoft.Data.SqlClient - 2.1.7,3.1.5,4.0.5,5.1.3, System.Data.SqlClient - 4.8.6

Step up your Open Source Security Game with Mend here

CVE-2021-24112

Vulnerable Library - system.drawing.common.4.7.0.nupkg

Provides access to GDI+ graphics functionality.

Commonly Used Types:
System.Drawing.Bitmap
System.D...

Library home page: https://api.nuget.org/packages/system.drawing.common.4.7.0.nupkg

Path to dependency file: /ProductWebAPI/ProductWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.drawing.common/4.7.0/system.drawing.common.4.7.0.nupkg

Dependency Hierarchy:

microsoft.entityframeworkcore.sqlserver.6.0.5.nupkg (Root Library)
- microsoft.data.sqlclient.2.1.4.nupkg
  - system.runtime.caching.4.7.0.nupkg
    - system.configuration.configurationmanager.4.7.0.nupkg
      - system.security.permissions.4.7.0.nupkg
        
        system.windows.extensions.4.7.0.nupkg
        
        ❌ system.drawing.common.4.7.0.nupkg (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

.NET Core Remote Code Execution Vulnerability

Publish Date: 2021-02-25

URL: CVE-2021-24112

CVSS 3 Score Details (8.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rxg9-xrhp-64gj

Release Date: 2021-02-25

Fix Resolution: System.Drawing.Common - 4.7.2,5.0.3

Step up your Open Source Security Game with Mend here

CVE-2024-21319

Vulnerable Libraries - microsoft.identitymodel.jsonwebtokens.6.8.0.nupkg, system.identitymodel.tokens.jwt.6.8.0.nupkg

microsoft.identitymodel.jsonwebtokens.6.8.0.nupkg

Includes types that provide support for creating, serializing and validating JSON Web Tokens.

Library home page: https://api.nuget.org/packages/microsoft.identitymodel.jsonwebtokens.6.8.0.nupkg

Path to dependency file: /CustomerWebAPI/CustomerWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.identitymodel.jsonwebtokens/6.8.0/microsoft.identitymodel.jsonwebtokens.6.8.0.nupkg

Dependency Hierarchy:

microsoft.entityframeworkcore.sqlserver.6.0.5.nupkg (Root Library)
- microsoft.data.sqlclient.2.1.4.nupkg
  - microsoft.identitymodel.protocols.openidconnect.6.8.0.nupkg
    - system.identitymodel.tokens.jwt.6.8.0.nupkg
      - ❌ microsoft.identitymodel.jsonwebtokens.6.8.0.nupkg (Vulnerable Library)

system.identitymodel.tokens.jwt.6.8.0.nupkg

Includes types that provide support for creating, serializing and validating JSON Web Tokens.

Library home page: https://api.nuget.org/packages/system.identitymodel.tokens.jwt.6.8.0.nupkg

Path to dependency file: /CustomerWebAPI/CustomerWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.identitymodel.tokens.jwt/6.8.0/system.identitymodel.tokens.jwt.6.8.0.nupkg

Dependency Hierarchy:

microsoft.entityframeworkcore.sqlserver.6.0.5.nupkg (Root Library)
- microsoft.data.sqlclient.2.1.4.nupkg
  - microsoft.identitymodel.protocols.openidconnect.6.8.0.nupkg
    - ❌ system.identitymodel.tokens.jwt.6.8.0.nupkg (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

Microsoft Identity Denial of service vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-21319

CVSS 3 Score Details (6.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8g9c-28fc-mcx2

Release Date: 2024-01-09

Fix Resolution: System.IdentityModel.Tokens.Jwt - 5.7.0,6.34.0,7.1.2, Microsoft.IdentityModel.JsonWebTokens - 5.7.0,6.34.0,7.1.2

Step up your Open Source Security Game with Mend here

mysql.entityframeworkcore.6.0.7.nupkg: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - mysql.entityframeworkcore.6.0.7.nupkg

Path to dependency file: /ProductWebAPI/ProductWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.drawing.common/4.7.0/system.drawing.common.4.7.0.nupkg

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (mysql.entityframeworkcore.6.0.7.nupkg version)	Remediation Available
CVE-2021-24112	High	9.8	system.drawing.common.4.7.0.nupkg	Transitive	N/A*	❌
CVE-2022-1941	High	7.5	google.protobuf.3.19.4.nupkg	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2021-24112

Vulnerable Library - system.drawing.common.4.7.0.nupkg

Provides access to GDI+ graphics functionality.

Commonly Used Types:
System.Drawing.Bitmap
System.D...

Library home page: https://api.nuget.org/packages/system.drawing.common.4.7.0.nupkg

Path to dependency file: /ProductWebAPI/ProductWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.drawing.common/4.7.0/system.drawing.common.4.7.0.nupkg

Dependency Hierarchy:

mysql.entityframeworkcore.6.0.7.nupkg (Root Library)
- mysql.data.8.0.31.nupkg
  - system.security.permissions.4.7.0.nupkg
    - system.windows.extensions.4.7.0.nupkg
      - ❌ system.drawing.common.4.7.0.nupkg (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701.

Publish Date: 2021-02-25

URL: CVE-2021-24112

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rxg9-xrhp-64gj

Release Date: 2021-02-25

Fix Resolution: System.Drawing.Common - 4.7.2,5.0.3

Step up your Open Source Security Game with Mend here

CVE-2022-1941

Vulnerable Library - google.protobuf.3.19.4.nupkg

C# runtime library for Protocol Buffers - Google's data interchange format.

Library home page: https://api.nuget.org/packages/google.protobuf.3.19.4.nupkg

Path to dependency file: /ProductWebAPI/ProductWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.19.4/google.protobuf.3.19.4.nupkg

Dependency Hierarchy:

mysql.entityframeworkcore.6.0.7.nupkg (Root Library)
- mysql.data.8.0.31.nupkg
  - ❌ google.protobuf.3.19.4.nupkg (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

Publish Date: 2022-09-22

URL: CVE-2022-1941

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cloud.google.com/support/bulletins#GCP-2022-019

Release Date: 2022-09-22

Fix Resolution: Google.Protobuf - 3.18.3,3.19.5,3.20.2,3.21.6;protobuf-python - 3.18.3,3.19.5,3.20.2,4.21.6

Step up your Open Source Security Game with Mend here

mongodb.driver.2.15.1.nupkg: 1 vulnerabilities (highest severity is: 7.2)

Vulnerable Library - mongodb.driver.2.15.1.nupkg

Official .NET driver for MongoDB.

Library home page: https://api.nuget.org/packages/mongodb.driver.2.15.1.nupkg

Path to dependency file: /OrderWebAPI/OrderWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/mongodb.driver/2.15.1/mongodb.driver.2.15.1.nupkg

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (mongodb.driver.2.15.1.nupkg version)	Remediation Possible**
CVE-2022-48282	High	7.2	mongodb.driver.2.15.1.nupkg	Direct	MongoDB.Driver - 2.19.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-48282

Vulnerable Library - mongodb.driver.2.15.1.nupkg

Official .NET driver for MongoDB.

Library home page: https://api.nuget.org/packages/mongodb.driver.2.15.1.nupkg

Path to dependency file: /OrderWebAPI/OrderWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/mongodb.driver/2.15.1/mongodb.driver.2.15.1.nupkg

Dependency Hierarchy:

❌ mongodb.driver.2.15.1.nupkg (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

Under very specific circumstances (see Required configuration section below), a privileged user is able to cause arbitrary code to be executed which may cause further disruption to services. This is specific to applications written in C#. This affects all MongoDB .NET/C# Driver versions prior to and including v2.18.0

Following configuration must be true for the vulnerability to be applicable: * Application must written in C# taking arbitrary data from users and serializing data using _t without any validation AND

Application must be running on a Windows host using the full .NET Framework, not .NET Core AND
Application must have domain model class with a property/field explicitly of type System.Object or a collection of type System.Object (against MongoDB best practice) AND
Malicious attacker must have unrestricted insert access to target database to add a _t discriminator."Following configuration must be true for the vulnerability to be applicable

Publish Date: 2023-02-21

URL: CVE-2022-48282

CVSS 3 Score Details (7.2)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-7j9m-j397-g4wx

Release Date: 2023-02-21

Fix Resolution: MongoDB.Driver - 2.19.0

Step up your Open Source Security Game with Mend here

System.Drawing.Common-4.700.19.56404.dll: 1 vulnerabilities (highest severity is: 8.1)

Vulnerable Library - System.Drawing.Common-4.700.19.56404.dll

System.Drawing.Common

Library home page: https://api.nuget.org/packages/system.drawing.common.4.7.0.nupkg

Path to vulnerable library: /CustomerWebAPI/bin/Debug/net6.0/runtimes/win/lib/netcoreapp3.0/System.Drawing.Common.dll,/ProductWebAPI/bin/Debug/net6.0/runtimes/win/lib/netcoreapp3.0/System.Drawing.Common.dll

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (System.Drawing.Common version)	Remediation Possible**
CVE-2021-24112	High	8.1	detected in multiple dependencies	Direct	System.Drawing.Common - 4.7.2,5.0.3	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-24112

Vulnerable Libraries - System.Drawing.Common-4.700.19.56404.dll, System.Drawing.Common-4.700.19.56404.dll

System.Drawing.Common-4.700.19.56404.dll

System.Drawing.Common

Library home page: https://api.nuget.org/packages/system.drawing.common.4.7.0.nupkg

Dependency Hierarchy:

❌ System.Drawing.Common-4.700.19.56404.dll (Vulnerable Library)

System.Drawing.Common-4.700.19.56404.dll

System.Drawing.Common

Library home page: https://api.nuget.org/packages/system.drawing.common.4.7.0.nupkg

Path to vulnerable library: /ProductWebAPI/bin/Debug/net6.0/runtimes/unix/lib/netcoreapp3.0/System.Drawing.Common.dll,/CustomerWebAPI/bin/Debug/net6.0/runtimes/unix/lib/netcoreapp3.0/System.Drawing.Common.dll

Dependency Hierarchy:

❌ System.Drawing.Common-4.700.19.56404.dll (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

.NET Core Remote Code Execution Vulnerability

Publish Date: 2021-02-25

URL: CVE-2021-24112

CVSS 3 Score Details (8.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rxg9-xrhp-64gj

Release Date: 2021-02-25

Fix Resolution: System.Drawing.Common - 4.7.2,5.0.3

Step up your Open Source Security Game with Mend here

Microsoft.Data.SqlClient-2.0.20168.4.dll: 1 vulnerabilities (highest severity is: 8.7)

Vulnerable Library - Microsoft.Data.SqlClient-2.0.20168.4.dll

Microsoft.Data.SqlClient

Library home page: https://api.nuget.org/packages/microsoft.data.sqlclient.2.1.4.nupkg

Path to vulnerable library: /CustomerWebAPI/bin/Debug/net6.0/runtimes/win/lib/netcoreapp3.1/Microsoft.Data.SqlClient.dll

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (Microsoft.Data.SqlClient version)	Remediation Possible**
CVE-2024-0056	High	8.7	detected in multiple dependencies	Direct	Microsoft.Data.SqlClient - 2.1.7,3.1.5,4.0.5,5.1.3, System.Data.SqlClient - 4.8.6	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-0056

Vulnerable Libraries - Microsoft.Data.SqlClient-2.0.20168.4.dll, Microsoft.Data.SqlClient-2.0.20168.4.dll, Microsoft.Data.SqlClient-2.0.20168.4.dll

Microsoft.Data.SqlClient-2.0.20168.4.dll

Microsoft.Data.SqlClient

Library home page: https://api.nuget.org/packages/microsoft.data.sqlclient.2.1.4.nupkg

Path to vulnerable library: /CustomerWebAPI/bin/Debug/net6.0/runtimes/win/lib/netcoreapp3.1/Microsoft.Data.SqlClient.dll

Dependency Hierarchy:

❌ Microsoft.Data.SqlClient-2.0.20168.4.dll (Vulnerable Library)

Microsoft.Data.SqlClient-2.0.20168.4.dll

Microsoft.Data.SqlClient

Library home page: https://api.nuget.org/packages/microsoft.data.sqlclient.2.1.4.nupkg

Path to vulnerable library: /CustomerWebAPI/bin/Debug/net6.0/runtimes/unix/lib/netcoreapp3.1/Microsoft.Data.SqlClient.dll

Dependency Hierarchy:

❌ Microsoft.Data.SqlClient-2.0.20168.4.dll (Vulnerable Library)

Microsoft.Data.SqlClient-2.0.20168.4.dll

Microsoft.Data.SqlClient

Library home page: https://api.nuget.org/packages/microsoft.data.sqlclient.2.1.4.nupkg

Path to vulnerable library: /bin/Debug/Microsoft.Data.SqlClient.dll,/CustomerWebAPI/bin/Debug/net6.0/Microsoft.Data.SqlClient.dll

Dependency Hierarchy:

❌ Microsoft.Data.SqlClient-2.0.20168.4.dll (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-0056

CVSS 3 Score Details (8.7)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-98g6-xh36-x2p7

Release Date: 2024-01-09

Fix Resolution: Microsoft.Data.SqlClient - 2.1.7,3.1.5,4.0.5,5.1.3, System.Data.SqlClient - 4.8.6

Step up your Open Source Security Game with Mend here

mysql.entityframeworkcore.6.0.1.nupkg: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - mysql.entityframeworkcore.6.0.1.nupkg

Path to dependency file: /ProductWebAPI/ProductWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.19.4/google.protobuf.3.19.4.nupkg

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (mysql.entityframeworkcore.6.0.1.nupkg version)	Remediation Available
CVE-2022-1941	High	7.5	google.protobuf.3.19.4.nupkg	Transitive	N/A*	❌

Details

CVE-2022-1941

Vulnerable Library - google.protobuf.3.19.4.nupkg

C# runtime library for Protocol Buffers - Google's data interchange format.

Library home page: https://api.nuget.org/packages/google.protobuf.3.19.4.nupkg

Path to dependency file: /ProductWebAPI/ProductWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/google.protobuf/3.19.4/google.protobuf.3.19.4.nupkg

Dependency Hierarchy:

mysql.entityframeworkcore.6.0.1.nupkg (Root Library)
- mysql.data.8.0.29.nupkg
  - ❌ google.protobuf.3.19.4.nupkg (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

Publish Date: 2022-09-22

URL: CVE-2022-1941

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cloud.google.com/support/bulletins#GCP-2022-019

Release Date: 2022-09-22

Fix Resolution: Google.Protobuf - 3.18.3,3.19.5,3.20.2,3.21.6;protobuf-python - 3.18.3,3.19.5,3.20.2,4.21.6

Step up your Open Source Security Game with Mend here

microsoft.visualstudio.azure.containers.tools.targets.1.14.0.nupkg: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - microsoft.visualstudio.azure.containers.tools.targets.1.14.0.nupkg

Targets files to enable the Visual Studio Tools for Containers.

Library home page: https://api.nuget.org/packages/microsoft.visualstudio.azure.containers.tools.targets.1.14.0.nupkg

Path to dependency file: /ProductWebAPI/ProductWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.visualstudio.azure.containers.tools.targets/1.14.0/microsoft.visualstudio.azure.containers.tools.targets.1.14.0.nupkg

Found in HEAD commit: f2db4e1b1bcbb25161de807637f7017b7a79fe06

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (microsoft.visualstudio.azure.containers.tools.targets.1.14.0.nupkg version)	Remediation Possible**
CVE-2024-21907	High	7.5	microsoft.visualstudio.azure.containers.tools.targets.1.14.0.nupkg	Direct	Newtonsoft.Json - 13.0.1	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-21907

Vulnerable Library - microsoft.visualstudio.azure.containers.tools.targets.1.14.0.nupkg

Targets files to enable the Visual Studio Tools for Containers.

Library home page: https://api.nuget.org/packages/microsoft.visualstudio.azure.containers.tools.targets.1.14.0.nupkg

Path to dependency file: /ProductWebAPI/ProductWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.visualstudio.azure.containers.tools.targets/1.14.0/microsoft.visualstudio.azure.containers.tools.targets.1.14.0.nupkg

Dependency Hierarchy:

❌ microsoft.visualstudio.azure.containers.tools.targets.1.14.0.nupkg (Vulnerable Library)

Found in HEAD commit: f2db4e1b1bcbb25161de807637f7017b7a79fe06

Found in base branch: master

Vulnerability Details

Newtonsoft.Json before version 13.0.1 is affected by a mishandling of exceptional conditions vulnerability. Crafted data that is passed to the JsonConvert.DeserializeObject method may trigger a StackOverflow exception resulting in denial of service. Depending on the usage of the library, an unauthenticated and remote attacker may be able to cause the denial of service condition.

Publish Date: 2024-01-03

URL: CVE-2024-21907

CVSS 3 Score Details (7.5)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5crp-9r3c-p9vr

Release Date: 2024-01-03

Fix Resolution: Newtonsoft.Json - 13.0.1

Step up your Open Source Security Game with Mend here

Microsoft.IdentityModel.JsonWebTokens-6.8.0.11012.dll: 1 vulnerabilities (highest severity is: 6.8)

Vulnerable Library - Microsoft.IdentityModel.JsonWebTokens-6.8.0.11012.dll

Microsoft.IdentityModel.JsonWebTokens

Library home page: https://api.nuget.org/packages/microsoft.identitymodel.jsonwebtokens.6.8.0.nupkg

Path to vulnerable library: /CustomerWebAPI/bin/Debug/net6.0/Microsoft.IdentityModel.JsonWebTokens.dll

Found in HEAD commit: f2db4e1b1bcbb25161de807637f7017b7a79fe06

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (Microsoft.IdentityModel.JsonWebTokens version)	Remediation Possible**
CVE-2024-21319	Medium	6.8	Microsoft.IdentityModel.JsonWebTokens-6.8.0.11012.dll	Direct	System.IdentityModel.Tokens.Jwt - 5.7.0,6.34.0,7.1.2, Microsoft.IdentityModel.JsonWebTokens - 5.7.0,6.34.0,7.1.2	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-21319

Vulnerable Library - Microsoft.IdentityModel.JsonWebTokens-6.8.0.11012.dll

Microsoft.IdentityModel.JsonWebTokens

Library home page: https://api.nuget.org/packages/microsoft.identitymodel.jsonwebtokens.6.8.0.nupkg

Path to vulnerable library: /CustomerWebAPI/bin/Debug/net6.0/Microsoft.IdentityModel.JsonWebTokens.dll

Dependency Hierarchy:

❌ Microsoft.IdentityModel.JsonWebTokens-6.8.0.11012.dll (Vulnerable Library)

Found in HEAD commit: f2db4e1b1bcbb25161de807637f7017b7a79fe06

Found in base branch: master

Vulnerability Details

Microsoft Identity Denial of service vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-21319

CVSS 3 Score Details (6.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8g9c-28fc-mcx2

Release Date: 2024-01-09

Fix Resolution: System.IdentityModel.Tokens.Jwt - 5.7.0,6.34.0,7.1.2, Microsoft.IdentityModel.JsonWebTokens - 5.7.0,6.34.0,7.1.2

Step up your Open Source Security Game with Mend here

Microsoft.EntityFrameworkCore.SqlServer-6.0.5: 1 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - Microsoft.EntityFrameworkCore.SqlServer-6.0.5

Path to dependency file: /CustomerWebAPI/CustomerWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.drawing.common/4.7.0/system.drawing.common.4.7.0.nupkg

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (Microsoft.EntityFrameworkCore.SqlServer version)	Remediation Available
CVE-2021-24112	High	9.8	system.drawing.common.4.7.0.nupkg	Transitive	N/A*	❌

Details

CVE-2021-24112

Vulnerable Library - system.drawing.common.4.7.0.nupkg

Provides access to GDI+ graphics functionality.

Commonly Used Types:
System.Drawing.Bitmap
System.D...

Library home page: https://api.nuget.org/packages/system.drawing.common.4.7.0.nupkg

Path to dependency file: /ProductWebAPI/ProductWebAPI.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.drawing.common/4.7.0/system.drawing.common.4.7.0.nupkg

Dependency Hierarchy:

Microsoft.EntityFrameworkCore.SqlServer-6.0.5 (Root Library)
- microsoft.data.sqlclient.2.1.4.nupkg
  - system.runtime.caching.4.7.0.nupkg
    - system.configuration.configurationmanager.4.7.0.nupkg
      - system.security.permissions.4.7.0.nupkg
        
        system.windows.extensions.4.7.0.nupkg
        
        ❌ system.drawing.common.4.7.0.nupkg (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

.NET Core Remote Code Execution Vulnerability This CVE ID is unique from CVE-2021-26701.

Publish Date: 2021-02-25

URL: CVE-2021-24112

CVSS 3 Score Details (9.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rxg9-xrhp-64gj

Release Date: 2021-02-25

Fix Resolution: System.Drawing.Common - 4.7.2,5.0.3

Step up your Open Source Security Game with Mend here

System.Drawing.Common-4.6.26919.02.dll: 1 vulnerabilities (highest severity is: 8.1)

Vulnerable Library - System.Drawing.Common-4.6.26919.02.dll

System.Drawing.Common

Library home page: https://api.nuget.org/packages/system.drawing.common.4.6.1.nupkg

Path to vulnerable library: /CustomerWebAPI/bin/Debug/net6.0/System.Drawing.Common.dll,/ProductWebAPI/bin/Debug/net6.0/System.Drawing.Common.dll

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (System.Drawing.Common version)	Remediation Possible**
CVE-2021-24112	High	8.1	System.Drawing.Common-4.6.26919.02.dll	Direct	System.Drawing.Common - 4.7.2,5.0.3	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-24112

Vulnerable Library - System.Drawing.Common-4.6.26919.02.dll

System.Drawing.Common

Library home page: https://api.nuget.org/packages/system.drawing.common.4.6.1.nupkg

Path to vulnerable library: /CustomerWebAPI/bin/Debug/net6.0/System.Drawing.Common.dll,/ProductWebAPI/bin/Debug/net6.0/System.Drawing.Common.dll

Dependency Hierarchy:

❌ System.Drawing.Common-4.6.26919.02.dll (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

.NET Core Remote Code Execution Vulnerability

Publish Date: 2021-02-25

URL: CVE-2021-24112

CVSS 3 Score Details (8.1)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rxg9-xrhp-64gj

Release Date: 2021-02-25

Fix Resolution: System.Drawing.Common - 4.7.2,5.0.3

Step up your Open Source Security Game with Mend here

System.IdentityModel.Tokens.Jwt-6.8.0.11012.dll: 1 vulnerabilities (highest severity is: 6.8)

Vulnerable Library - System.IdentityModel.Tokens.Jwt-6.8.0.11012.dll

System.IdentityModel.Tokens.Jwt

Library home page: https://api.nuget.org/packages/system.identitymodel.tokens.jwt.6.8.0.nupkg

Path to vulnerable library: /CustomerWebAPI/bin/Debug/net6.0/System.IdentityModel.Tokens.Jwt.dll

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (System.IdentityModel.Tokens.Jwt version)	Remediation Possible**
CVE-2024-21319	Medium	6.8	System.IdentityModel.Tokens.Jwt-6.8.0.11012.dll	Direct	System.IdentityModel.Tokens.Jwt - 5.7.0,6.34.0,7.1.2, Microsoft.IdentityModel.JsonWebTokens - 5.7.0,6.34.0,7.1.2	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-21319

Vulnerable Library - System.IdentityModel.Tokens.Jwt-6.8.0.11012.dll

System.IdentityModel.Tokens.Jwt

Library home page: https://api.nuget.org/packages/system.identitymodel.tokens.jwt.6.8.0.nupkg

Path to vulnerable library: /CustomerWebAPI/bin/Debug/net6.0/System.IdentityModel.Tokens.Jwt.dll

Dependency Hierarchy:

❌ System.IdentityModel.Tokens.Jwt-6.8.0.11012.dll (Vulnerable Library)

Found in HEAD commit: 0d7da7e7674ec6ef98004de517c5b0109b2cb2a0

Found in base branch: master

Vulnerability Details

Microsoft Identity Denial of service vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-21319

CVSS 3 Score Details (6.8)

Base Score Metrics:

Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Changed
Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8g9c-28fc-mcx2

Release Date: 2024-01-09

Fix Resolution: System.IdentityModel.Tokens.Jwt - 5.7.0,6.34.0,7.1.2, Microsoft.IdentityModel.JsonWebTokens - 5.7.0,6.34.0,7.1.2

Step up your Open Source Security Game with Mend here