rahulsom / lgtm-chrome Goto Github PK

Vulnerabilities

DepShield reports that this application's usage of js-yaml:2.0.5 results in the following vulnerability(s):

• (CVSS 8.8) CWE-94: Improper Control of Generation of Code ('Code Injection')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

js-yaml:2.0.5 is a transitive dependency introduced by the following direct dependency(s):

• grunt:0.4.5
        └─ js-yaml:2.0.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of tar:0.1.20 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2018-20834] Improper Link Resolution Before File Access ("Link Following")
• (CVSS 7.5) [CVE-2015-8860] Improper Link Resolution Before File Access ("Link Following")
• (CVSS 7.5) Symlink Arbitrary File Overwrite

---

Occurrences

tar:0.1.20 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-imagemin:0.7.2
        └─ imagemin:0.4.9
              └─ imagemin-gifsicle:0.1.1
                    └─ gifsicle:0.1.7
                          └─ bin-build:0.1.1
                                └─ download:0.1.19
                                      └─ decompress:0.2.5
                                            └─ tar:0.1.20

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of send:0.1.4 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2014-6394] Improper Limitation of a Pathname to a Restricted Directory ("Path Traversal")
• (CVSS 5.3) CWE-200: Information Exposure
• (CVSS 5.3) [CVE-2015-8859] Information Exposure
• (CVSS 4.3) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

---

Occurrences

send:0.1.4 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-connect:0.7.1
        └─ connect:2.13.1
              └─ send:0.1.4

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of cryptiles:2.0.5 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-1000620] Insufficient Entropy
• (CVSS 9.8) CWE-331: Insufficient Entropy
• (CVSS 9.8) CWE-331: Insufficient Entropy
• (CVSS 5.9) CWE-330: Use of Insufficiently Random Values

---

Occurrences

cryptiles:2.0.5 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ grunt-lib-phantomjs:0.7.1
              └─ phantomjs:1.9.20
                    └─ request:2.67.0
                          └─ hawk:3.1.3
                                └─ cryptiles:2.0.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of ms:0.6.2 results in the following vulnerability(s):

• (CVSS 5.3) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

ms:0.6.2 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ mocha:1.21.5
              └─ debug:2.0.0
                    └─ ms:0.6.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of mime:1.2.11 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

mime:1.2.11 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-connect:0.7.1
        └─ connect:2.13.1
              └─ send:0.1.4
                    └─ mime:1.2.11

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash:0.9.2 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2019-10744] Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The...
• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 9.6) CWE-506: Embedded Malicious Code
• (CVSS 8.8) [NPMJS]Prototype Pollution
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2019-1010266] lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumpti...
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash:0.9.2 is a transitive dependency introduced by the following direct dependency(s):

• grunt:0.4.5
        └─ grunt-legacy-util:0.2.0
              └─ lodash:0.9.2
        └─ lodash:0.9.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of request:2.67.0 results in the following vulnerability(s):

• (CVSS 5.3) CWE-201: Information Exposure Through Sent Data

---

Occurrences

request:2.67.0 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ grunt-lib-phantomjs:0.7.1
              └─ phantomjs:1.9.20
                    └─ request:2.67.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of fresh:0.2.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

fresh:0.2.0 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-connect:0.7.1
        └─ connect:2.13.1
              └─ fresh:0.2.0
              └─ send:0.1.4
                    └─ fresh:0.2.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of fstream:0.1.31 results in the following vulnerability(s):

• (CVSS 7.5) [CVE-2019-13173] Improper Input Validation
• (CVSS 7.5) CWE-62: UNIX Hard Link

---

Occurrences

fstream:0.1.31 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-imagemin:0.7.2
        └─ imagemin:0.4.9
              └─ imagemin-gifsicle:0.1.1
                    └─ gifsicle:0.1.7
                          └─ bin-build:0.1.1
                                └─ download:0.1.19
                                      └─ decompress:0.2.5
                                            └─ tar:0.1.20
                                                  └─ fstream:0.1.31

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:0.7.4 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:0.7.4 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-watch:0.6.1
        └─ tiny-lr-fork:0.0.5
              └─ debug:0.7.4

• grunt-mocha:0.4.15
        └─ grunt-lib-phantomjs:0.7.1
              └─ phantomjs:1.9.20
                    └─ extract-zip:1.5.0
                          └─ debug:0.7.4

• grunt-usemin:2.1.1
        └─ debug:0.7.4

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of bl:0.6.0 results in the following vulnerability(s):

• (CVSS 8.2) CWE-20: Improper Input Validation

---

Occurrences

bl:0.6.0 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-compress:0.9.1
        └─ archiver:0.9.1
              └─ tar-stream:0.3.3
                    └─ bl:0.6.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of js-yaml:2.1.3 results in the following vulnerability(s):

• (CVSS 8.8) CWE-94: Improper Control of Generation of Code ('Code Injection')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

js-yaml:2.1.3 is a transitive dependency introduced by the following direct dependency(s):

• grunt-svgmin:0.4.0
        └─ svgo:0.4.5
              └─ js-yaml:2.1.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of qs:0.5.6 results in the following vulnerability(s):

• (CVSS 8.2) CWE-20: Improper Input Validation
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 5.0) [CVE-2014-7191] Resource Management Errors

---

Occurrences

qs:0.5.6 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-watch:0.6.1
        └─ tiny-lr-fork:0.0.5
              └─ qs:0.5.6

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of phantomjs:1.9.20 results in the following vulnerability(s):

• (CVSS 7.4) CWE-300: Channel Accessible by Non-Endpoint ('Man-in-the-Middle')

---

Occurrences

phantomjs:1.9.20 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ grunt-lib-phantomjs:0.7.1
              └─ phantomjs:1.9.20

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of cli:0.4.5 results in the following vulnerability(s):

• (CVSS 1.9) Insecure temporary files (path traversal)

---

Occurrences

cli:0.4.5 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-jshint:0.9.2
        └─ jshint:2.4.4
              └─ cli:0.4.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of hoek:2.16.3 results in the following vulnerability(s):

• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3728] Improper Access Control

---

Occurrences

hoek:2.16.3 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ grunt-lib-phantomjs:0.7.1
              └─ phantomjs:1.9.20
                    └─ request:2.67.0
                          └─ hawk:3.1.3
                                └─ boom:2.10.1
                                      └─ hoek:2.16.3
                                └─ hoek:2.16.3
                                └─ sntp:1.0.9
                                      └─ hoek:2.16.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of growl:1.8.1 results in the following vulnerability(s):

• (CVSS 8.8) CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
• (CVSS 8.8) CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

---

Occurrences

growl:1.8.1 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ mocha:1.21.5
              └─ growl:1.8.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of kind-of:3.2.2 results in the following vulnerability(s):

• (CVSS 5.3) CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

---

Occurrences

kind-of:3.2.2 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-uglify:0.4.1
        └─ uglify-js:2.8.29
              └─ yargs:3.10.0
                    └─ cliui:2.1.0
                          └─ center-align:0.1.3
                                └─ align-text:0.1.4
                                      └─ kind-of:3.2.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of minimist:0.0.8 results in the following vulnerability(s):

• (CVSS 8.8) CWE-94: Improper Control of Generation of Code ('Code Injection')

---

Occurrences

minimist:0.0.8 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ grunt-lib-phantomjs:0.7.1
              └─ phantomjs:1.9.20
                    └─ extract-zip:1.5.0
                          └─ mkdirp:0.5.0
                                └─ minimist:0.0.8
        └─ mocha:1.21.5
              └─ mkdirp:0.5.0
                    └─ minimist:0.0.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of decompress:0.2.5 results in the following vulnerability(s):

• (CVSS 7.5) CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

---

Occurrences

decompress:0.2.5 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-imagemin:0.7.2
        └─ imagemin:0.4.9
              └─ imagemin-gifsicle:0.1.1
                    └─ gifsicle:0.1.7
                          └─ bin-build:0.1.1
                                └─ download:0.1.19
                                      └─ decompress:0.2.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of qs:0.6.6 results in the following vulnerability(s):

• (CVSS 8.2) CWE-20: Improper Input Validation
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 5.0) [CVE-2014-7191] Resource Management Errors

---

Occurrences

qs:0.6.6 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-connect:0.7.1
        └─ connect:2.13.1
              └─ qs:0.6.6

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash:2.4.2 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2019-10744] Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The...
• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 9.6) CWE-506: Embedded Malicious Code
• (CVSS 8.8) [NPMJS]Prototype Pollution
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2019-1010266] lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumpti...
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash:2.4.2 is a transitive dependency introduced by the following direct dependency(s):

• grunt:0.4.5
        └─ findup-sync:0.1.3
              └─ lodash:2.4.2
        └─ grunt-legacy-log:0.1.3
              └─ grunt-legacy-log-utils:0.1.1
                    └─ lodash:2.4.2
              └─ lodash:2.4.2

• grunt-contrib-compress:0.9.1
        └─ archiver:0.9.1
              └─ lodash:2.4.2
              └─ zip-stream:0.3.7
                    └─ lodash:2.4.2

• grunt-contrib-watch:0.6.1
        └─ lodash:2.4.2

• load-grunt-tasks:0.4.0
        └─ multimatch:0.1.0
              └─ lodash:2.4.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of clean-css:2.1.8 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

clean-css:2.1.8 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-cssmin:0.9.0
        └─ clean-css:2.1.8

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of tunnel-agent:0.4.3 results in the following vulnerability(s):

• (CVSS 8.2) CWE-20: Improper Input Validation

---

Occurrences

tunnel-agent:0.4.3 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ grunt-lib-phantomjs:0.7.1
              └─ phantomjs:1.9.20
                    └─ request:2.67.0
                          └─ tunnel-agent:0.4.3

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash:1.3.1 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 9.6) CWE-506: Embedded Malicious Code
• (CVSS 8.8) [NPMJS]Prototype Pollution
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash:1.3.1 is a transitive dependency introduced by the following direct dependency(s):

• grunt-bower-install:1.0.2
        └─ wiredep:1.2.2
              └─ lodash:1.3.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of uuid:1.4.2 results in the following vulnerability(s):

• (CVSS 4.2) CWE-338: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

---

Occurrences

uuid:1.4.2 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-imagemin:0.7.2
        └─ imagemin:0.4.9
              └─ tempfile:0.1.3
                    └─ uuid:1.4.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash:1.0.2 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2019-10744] Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The...
• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 9.6) CWE-506: Embedded Malicious Code
• (CVSS 8.8) [NPMJS]Prototype Pollution
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2019-1010266] lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumpti...
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash:1.0.2 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-watch:0.6.1
        └─ gaze:0.5.2
              └─ globule:0.1.0
                    └─ lodash:1.0.2

• grunt-usemin:2.1.1
        └─ lodash:1.0.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:0.8.1 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:0.8.1 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-connect:0.7.1
        └─ connect:2.13.1
              └─ debug:0.8.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of qs:5.2.1 results in the following vulnerability(s):

• (CVSS 8.2) CWE-20: Improper Input Validation
• (CVSS 7.5) [CVE-2017-1000048] Improper Input Validation

---

Occurrences

qs:5.2.1 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ grunt-lib-phantomjs:0.7.1
              └─ phantomjs:1.9.20
                    └─ request:2.67.0
                          └─ qs:5.2.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:2.0.0 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:2.0.0 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ mocha:1.21.5
              └─ debug:2.0.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash:3.10.1 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2019-10744] Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The...
• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 9.6) CWE-506: Embedded Malicious Code
• (CVSS 8.8) [NPMJS]Prototype Pollution
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2019-1010266] lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumpti...
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash:3.10.1 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ lodash:3.10.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of connect:2.13.1 results in the following vulnerability(s):

• (CVSS 5.4) [CVE-2018-3717] connect node module before 2.14.0 suffers from a Cross-Site Scripting (XSS) vuln...

---

Occurrences

connect:2.13.1 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-connect:0.7.1
        └─ connect:2.13.1

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of minimist:0.0.10 results in the following vulnerability(s):

• (CVSS 8.8) CWE-94: Improper Control of Generation of Code ('Code Injection')

---

Occurrences

minimist:0.0.10 is a transitive dependency introduced by the following direct dependency(s):

• grunt-bower-install:1.0.2
        └─ bower-config:0.5.3
              └─ optimist:0.6.1
                    └─ minimist:0.0.10

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of lodash:2.1.0 results in the following vulnerability(s):

• (CVSS 9.8) [CVE-2019-10744] Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The...
• (CVSS 9.8) [CVE-2018-16487] A prototype pollution vulnerability was found in lodash <4.17.11 where the funct...
• (CVSS 9.6) CWE-506: Embedded Malicious Code
• (CVSS 8.8) [NPMJS]Prototype Pollution
• (CVSS 7.4) CWE-471: Modification of Assumed-Immutable Data (MAID)
• (CVSS 6.5) [CVE-2019-1010266] lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumpti...
• (CVSS 6.5) [CVE-2018-3721] lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutabl...

---

Occurrences

lodash:2.1.0 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-compress:0.9.1
        └─ archiver:0.9.1
              └─ file-utils:0.1.5
                    └─ lodash:2.1.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of concat-stream:1.5.0 results in the following vulnerability(s):

• (CVSS 8.2) CWE-20: Improper Input Validation

---

Occurrences

concat-stream:1.5.0 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ grunt-lib-phantomjs:0.7.1
              └─ phantomjs:1.9.20
                    └─ extract-zip:1.5.0
                          └─ concat-stream:1.5.0

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of debug:1.0.5 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')

---

Occurrences

debug:1.0.5 is a transitive dependency introduced by the following direct dependency(s):

• grunt-contrib-compress:0.9.1
        └─ archiver:0.9.1
              └─ zip-stream:0.3.7
                    └─ debug:1.0.5

• grunt-contrib-connect:0.7.1
        └─ connect:2.13.1
              └─ send:0.1.4
                    └─ debug:1.0.5

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}

Vulnerabilities

DepShield reports that this application's usage of tough-cookie:2.2.2 results in the following vulnerability(s):

• (CVSS 7.5) CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
• (CVSS 7.5) [CVE-2017-15010] Uncontrolled Resource Consumption ("Resource Exhaustion")
• (CVSS 7.5) CWE-185: Incorrect Regular Expression
• (CVSS 7.5) CWE-185: Incorrect Regular Expression
• (CVSS 5.3) [CVE-2016-1000232] Improper Input Validation

---

Occurrences

tough-cookie:2.2.2 is a transitive dependency introduced by the following direct dependency(s):

• grunt-mocha:0.4.15
        └─ grunt-lib-phantomjs:0.7.1
              └─ phantomjs:1.9.20
                    └─ request:2.67.0
                          └─ tough-cookie:2.2.2

_{This is an automated GitHub Issue created by Sonatype DepShield. Details on managing GitHub Apps, including DepShield, are available for personal and organization accounts. Please submit questions or feedback about DepShield to the Sonatype DepShield Community.}