Node JS Boilerplate project with ExpressJS + MongoDB + PUG. Permissions, Auth, Routing, API Cache, Dynamic Pagination, 3rd-party error handler APIs, loggers, 3 level deployment cycles. REST APIs with best practices from top devs and projects on GitHub.
License: MIT License
I've been learning code since 5 years and giving my services in various MNC companies. Currently, I'm working in Nagarro In last 5 years I have worked on PHP, Laravel, Yii 2, Android, Python, React JS, VueJS, NodeJS and little bit in cloud and flutter.
🌍 I'm based in India
🖥️ See my portfolio at https://linktr.ee/ronakjain2012
✉️ You can contact me at [email protected]
🧠 I'm learning Python and have exprince of 5+ Years as MERN & MEVN
🤝 I'm open to collaborating on NodeJS and ReactJS Projects
![mend-bolt-for-github[bot] avatar](https://avatars.githubusercontent.com/in/16809?v=4 "mend-bolt-for-github[bot]")
Vulnerable Libraries - glob-parent-5.1.1.tgz, glob-parent-3.1.0.tgz, glob-parent-2.0.0.tgz
Extract the non-magic parent path from a glob string.
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-5.1.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/glob-parent/package.json
Dependency Hierarchy:
Strips glob magic from a string to provide the parent directory path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/watchpack-chokidar2/node_modules/glob-parent/package.json
Dependency Hierarchy:
Strips glob magic from a string to provide the parent path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/babel-cli/node_modules/glob-parent/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Publish Date: 2021-06-03
URL: CVE-2020-28469
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
Release Date: 2021-06-03
Fix Resolution (glob-parent): 5.1.2
Direct dependency fix Resolution (eslint): 7.0.0-alpha.0
Fix Resolution (glob-parent): 5.1.2
Direct dependency fix Resolution (webpack): 5.0.0-alpha.5
Step up your Open Source Security Game with WhiteSource here
Redis as optional service
Many small projects do not require the Redis, according to current implementation it is mandatory
Solution
Picking ENV value to check where Redis is required or not, if not then disable to Redis and bypass all the implementations
Additional context
app\middlewares\redisApiCache.js
Vulnerable Library - braces-1.8.5.tgzFastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.
Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/micromatch/node_modules/braces/package.json
Dependency Hierarchy:
Found in HEAD commit: 2bf6493406fe8d594fe9c0df6e4123c9a9280bd7
Found in base branch: master
Vulnerability Details
Braces before 1.4.2 and 2.17.2 is vulnerable to ReDoS. It used a regular expression (^{(,+(?:({,+})),|,(?:({,+})),+)}) in order to detects empty braces. This can cause an impact of about 10 seconds matching time for data 50K characters long.
Publish Date: 2020-07-21
URL: CVE-2018-1109
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1547272
Release Date: 2020-07-21
Fix Resolution: 2.3.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Libraries - dot-prop-3.0.0.tgz, dot-prop-4.2.0.tgz
Get, set, or delete a property from a nested object using a dot path
Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-3.0.0.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/compare-func/node_modules/dot-prop/package.json
Dependency Hierarchy:
Get, set, or delete a property from a nested object using a dot path
Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/dot-prop/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.
Publish Date: 2020-02-04
URL: CVE-2020-8116
CVSS 3 Score Details (7.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116
Release Date: 2020-02-04
Fix Resolution: dot-prop - 5.1.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Libraries - jquery-3.2.1.min.js, jquery-1.8.1.min.js
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
Path to dependency file: node-boilerplate/node_modules/superagent/index.html
Path to vulnerable library: node-boilerplate/node_modules/superagent/index.html,node-boilerplate/node_modules/supertest/node_modules/superagent/docs/tail.html
Dependency Hierarchy:
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js
Path to dependency file: node-boilerplate/node_modules/redeyed/examples/browser/index.html
Path to vulnerable library: node-boilerplate/node_modules/redeyed/examples/browser/index.html
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11022
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/
Release Date: 2020-04-29
Fix Resolution: jQuery - 3.5.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - jquery-1.8.1.min.jsJavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js
Path to dependency file: node-boilerplate/node_modules/redeyed/examples/browser/index.html
Path to vulnerable library: node-boilerplate/node_modules/redeyed/examples/browser/index.html
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.
Publish Date: 2018-01-18
URL: CVE-2015-9251
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251
Release Date: 2018-01-18
Fix Resolution: jQuery - v3.0.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - minimist-0.0.10.tgzparse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/minimist/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/substack/minimist/issues/164
Release Date: 2022-03-17
Fix Resolution: minimist - 1.2.6
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - minimist-0.0.10.tgzparse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/minimist/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.
Publish Date: 2020-03-11
URL: CVE-2020-7598
CVSS 3 Score Details (5.6)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94
Release Date: 2020-03-11
Fix Resolution: minimist - 0.2.1,1.2.3
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - npm-6.14.4.tgza package manager for JavaScript
Library home page: https://registry.npmjs.org/npm/-/npm-6.14.4.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/npm/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like "://[[:]@][:][:][/]". The password value is not redacted and is printed to stdout and also to any generated log files.
Publish Date: 2020-07-07
URL: CVE-2020-15095
CVSS 3 Score Details (4.4)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-93f3-23rq-pjfp
Release Date: 2020-07-07
Fix Resolution: npm - 6.14.6
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - axios-0.21.1.tgzPromise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.21.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@pm2/js-api/node_modules/axios/package.json,/node_modules/@pm2/js-api/node_modules/axios/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository axios/axios prior to 0.26.
Publish Date: 2022-05-03
URL: CVE-2022-1214
CVSS 3 Score Details (8.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/ef7b4ab6-a3f6-4268-a21a-e7104d344607/
Release Date: 2022-05-03
Fix Resolution: 0.26.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - y18n-4.0.0.tgzthe bare-bones internationalization library used by yargs
Library home page: https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/npm/node_modules/y18n/package.json
Dependency Hierarchy:
Found in HEAD commit: 29cfc6ccf7871c02275ffdcdd0b5a41ed0369aab
Found in base branch: master
Vulnerability Details
This affects the package y18n before 3.2.2, 4.0.1 and 5.0.5. PoC by po6ix: const y18n = require('y18n')(); y18n.setLocale('proto'); y18n.updateLocale({polluted: true}); console.log(polluted); // true
Publish Date: 2020-11-17
URL: CVE-2020-7774
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1654
Release Date: 2020-11-17
Fix Resolution (y18n): 4.0.1
Direct dependency fix Resolution (all-contributors-cli): 6.20.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Libraries - jquery-3.2.1.min.js, jquery-1.8.1.min.js
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
Path to dependency file: node-boilerplate/node_modules/superagent/index.html
Path to vulnerable library: node-boilerplate/node_modules/superagent/index.html,node-boilerplate/node_modules/supertest/node_modules/superagent/docs/tail.html
Dependency Hierarchy:
JavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js
Path to dependency file: node-boilerplate/node_modules/redeyed/examples/browser/index.html
Path to vulnerable library: node-boilerplate/node_modules/redeyed/examples/browser/index.html
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.
Publish Date: 2020-04-29
URL: CVE-2020-11023
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023
Release Date: 2020-04-29
Fix Resolution: jquery - 3.5.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - pac-resolver-3.0.0.tgzGenerates an asynchronous resolver function from a PAC file
Library home page: https://registry.npmjs.org/pac-resolver/-/pac-resolver-3.0.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/pac-resolver/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
This affects the package pac-resolver before 5.0.0. This can occur when used with untrusted input, due to unsafe PAC file handling. NOTE: The fix for this vulnerability is applied in the node-degenerator library, a dependency written by the same maintainer.
Publish Date: 2021-08-24
URL: CVE-2021-23406
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-9j49-mfvp-vmhm
Release Date: 2021-08-24
Fix Resolution (pac-resolver): 5.0.0
Direct dependency fix Resolution (pm2): 5.0.0
Step up your Open Source Security Game with WhiteSource here
Multi-language Support
Solution
Vulnerable Library - node-fetch-2.6.1.tgzA light-weight module that brings window.fetch to node.js
Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/node-fetch/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Publish Date: 2022-01-16
URL: CVE-2022-0235
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-r683-j2x4-v87g
Release Date: 2022-01-16
Fix Resolution: node-fetch - 2.6.7,3.1.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgzXMLHttpRequest for Node
Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xmlhttprequest-ssl/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The xmlhttprequest-ssl package before 1.6.1 for Node.js disables SSL certificate validation by default, because rejectUnauthorized (when the property exists but is undefined) is considered to be false within the https.request function of Node.js. In other words, no certificate is ever rejected.
Publish Date: 2021-04-23
URL: CVE-2021-31597
CVSS 3 Score Details (9.4)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31597
Release Date: 2021-04-23
Fix Resolution (xmlhttprequest-ssl): 1.6.1
Direct dependency fix Resolution (express-status-monitor): 1.3.4
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - elliptic-6.5.2.tgzEC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/elliptic/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.
Publish Date: 2020-06-04
URL: CVE-2020-13822
CVSS 3 Score Details (7.7)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/indutny/elliptic/tree/v6.5.3
Release Date: 2020-06-04
Fix Resolution: v6.5.3
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - marked-1.2.7.tgzA markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-1.2.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/marked/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression block.def may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Publish Date: 2022-01-14
URL: CVE-2022-21680
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-rrrm-qjm4-v8hf
Release Date: 2022-01-14
Fix Resolution (marked): 4.0.10
Direct dependency fix Resolution (semantic-release): 19.0.0-beta.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - bl-2.2.0.tgzBuffer List: collect buffers and access with a standard readable Buffer interface, streamable too!
Library home page: https://registry.npmjs.org/bl/-/bl-2.2.0.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/bl/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
A buffer over-read vulnerability exists in bl <4.0.3, <3.0.1, <2.2.1, and <1.2.3 which could allow an attacker to supply user input (even typed) that if it ends up in consume() argument and can become negative, the BufferList state can be corrupted, tricking it into exposing uninitialized memory via regular .slice() calls.
Publish Date: 2020-08-30
URL: CVE-2020-8244
CVSS 3 Score Details (6.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8244
Release Date: 2020-07-21
Fix Resolution: 2.2.1,3.0.1,4.0.3
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - axios-0.19.2.tgzPromise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/express-status-monitor/node_modules/axios/package.json
Dependency Hierarchy:
Found in HEAD commit: 29cfc6ccf7871c02275ffdcdd0b5a41ed0369aab
Found in base branch: master
Vulnerability Details
Axios NPM package 0.21.0 contains a Server-Side Request Forgery (SSRF) vulnerability where an attacker is able to bypass a proxy by providing a URL that responds with a redirect to a restricted host or IP address.
Publish Date: 2020-11-06
URL: CVE-2020-28168
CVSS 3 Score Details (5.9)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: axios/axios@c7329fe
Release Date: 2020-11-06
Fix Resolution (axios): 0.21.1
Direct dependency fix Resolution (express-status-monitor): 1.3.4
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - marked-1.2.7.tgzA markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-1.2.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/marked/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can affect anyone who runs user generated code through marked. This vulnerability is fixed in version 2.0.0.
Publish Date: 2021-02-08
URL: CVE-2021-21306
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-4r62-v4vq-hr96
Release Date: 2021-02-08
Fix Resolution (marked): 2.0.0
Direct dependency fix Resolution (semantic-release): 17.3.8
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - elliptic-6.5.2.tgzEC cryptography
Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/elliptic/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
all versions of elliptic are vulnerable to Timing Attack through side-channels.
Publish Date: 2019-11-13
URL: WS-2019-0424
CVSS 3 Score Details (5.9)
Base Score Metrics:
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - serialize-javascript-2.1.2.tgzSerialize JavaScript to a superset of JSON that includes regular expressions and functions.
Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-2.1.2.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/serialize-javascript/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".
Publish Date: 2020-06-01
URL: CVE-2020-7660
CVSS 3 Score Details (8.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660
Release Date: 2020-06-01
Fix Resolution: serialize-javascript - 3.1.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - node-fetch-2.6.0.tgzA light-weight module that brings window.fetch to node.js
Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.0.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/node-fetch/package.json
Dependency Hierarchy:
Found in HEAD commit: d9b4cc8063e24bd484530314ab20ac2d824ecf7a
Found in base branch: master
Vulnerability Details
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
Publish Date: 2020-09-10
URL: CVE-2020-15168
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-w7rc-rwvf-8q5r
Release Date: 2020-07-21
Fix Resolution: 2.6.1,3.0.0-beta.9
Step up your Open Source Security Game with WhiteSource here
Vulnerable Libraries - normalize-url-4.5.0.tgz, normalize-url-5.3.0.tgz
Normalize a URL
Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-4.5.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/normalize-url/package.json
Dependency Hierarchy:
Normalize a URL
Library home page: https://registry.npmjs.org/normalize-url/-/normalize-url-5.3.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@semantic-release/npm/node_modules/normalize-url/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The normalize-url package before 4.5.1, 5.x before 5.3.1, and 6.x before 6.0.1 for Node.js has a ReDoS (regular expression denial of service) issue because it has exponential performance for data: URLs.
Publish Date: 2021-05-24
URL: CVE-2021-33502
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-33502
Release Date: 2021-05-24
Fix Resolution (normalize-url): 4.5.1
Direct dependency fix Resolution (nodemon): 2.0.8-alpha.1
Fix Resolution (normalize-url): 5.3.1
Direct dependency fix Resolution (semantic-release): 17.3.2
Step up your Open Source Security Game with WhiteSource here
Vulnerable Libraries - pug-code-gen-2.0.2.tgz, pug-2.0.4.tgz
Default code-generator for pug. It generates HTML via a JavaScript template function.
Library home page: https://registry.npmjs.org/pug-code-gen/-/pug-code-gen-2.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/pug-code-gen/package.json
Dependency Hierarchy:
A clean, whitespace-sensitive template language for writing HTML
Library home page: https://registry.npmjs.org/pug/-/pug-2.0.4.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/pug/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Pug is an npm package which is a high-performance template engine. In pug before version 3.0.1, if a remote attacker was able to control the pretty option of the pug compiler, e.g. if you spread a user provided object such as the query parameters of a request into the pug template inputs, it was possible for them to achieve remote code execution on the node.js backend. This is fixed in version 3.0.1. This advisory applies to multiple pug packages including "pug", "pug-code-gen". pug-code-gen has a backported fix at version 2.0.3. This advisory is not exploitable if there is no way for un-trusted input to be passed to pug as the pretty option, e.g. if you compile templates in advance before applying user input to them, you do not need to upgrade.
Publish Date: 2021-03-03
URL: CVE-2021-21353
CVSS 3 Score Details (9.0)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-p493-635q-r6gr
Release Date: 2021-03-03
Fix Resolution (pug-code-gen): 2.0.3
Direct dependency fix Resolution (pug): 3.0.0-canary-1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - node-fetch-2.6.0.tgzA light-weight module that brings window.fetch to node.js
Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-2.6.0.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/node-fetch/package.json
Dependency Hierarchy:
Found in HEAD commit: 69fe536a21ff7400f36b3c5d567635e87df28e53
Found in base branch: master
Vulnerability Details
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
Publish Date: 2020-09-10
URL: CVE-2020-15168
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-w7rc-rwvf-8q5r
Release Date: 2020-07-21
Fix Resolution: 2.6.1,3.0.0-beta.9
Step up your Open Source Security Game with WhiteSource here
Vulnerable Libraries - axios-0.21.1.tgz, axios-0.19.2.tgz
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.21.1.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@pm2/js-api/node_modules/axios/package.json,/node_modules/@pm2/js-api/node_modules/axios/package.json
Dependency Hierarchy:
Promise based HTTP client for the browser and node.js
Library home page: https://registry.npmjs.org/axios/-/axios-0.19.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/express-status-monitor/node_modules/axios/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
axios is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-08-31
URL: CVE-2021-3749
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/1e8f07fc-c384-4ff9-8498-0690de2e8c31/
Release Date: 2021-08-31
Fix Resolution (axios): 0.20.0
Direct dependency fix Resolution (express-status-monitor): 1.3.4
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - socket.io-parser-3.3.0.tgzsocket.io protocol parser
Library home page: https://registry.npmjs.org/socket.io-parser/-/socket.io-parser-3.3.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/socket.io-client/node_modules/socket.io-parser/package.json
Dependency Hierarchy:
Found in HEAD commit: 29cfc6ccf7871c02275ffdcdd0b5a41ed0369aab
Found in base branch: master
Vulnerability Details
socket.io-parser before 3.4.1 allows attackers to cause a denial of service (memory consumption) via a large packet because a concatenation approach is used.
Publish Date: 2021-01-08
URL: CVE-2020-36049
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-xfhh-g9f5-x4m4
Release Date: 2021-01-08
Fix Resolution (socket.io-parser): 3.3.2
Direct dependency fix Resolution (express-status-monitor): 1.3.4
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - jquery-3.2.1.min.jsJavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.2.1/jquery.min.js
Path to dependency file: node-boilerplate/node_modules/superagent/index.html
Path to vulnerable library: node-boilerplate/node_modules/superagent/index.html,node-boilerplate/node_modules/supertest/node_modules/superagent/docs/tail.html
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.
Publish Date: 2019-04-20
URL: CVE-2019-11358
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358
Release Date: 2019-04-20
Fix Resolution: 3.4.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - mpath-0.8.3.tgz{G,S}et object values using MongoDB-like path notation
Library home page: https://registry.npmjs.org/mpath/-/mpath-0.8.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/mpath/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
This affects the package mpath before 0.8.4. A type confusion vulnerability can lead to a bypass of CVE-2018-16490. In particular, the condition ignoreProperties.indexOf(parts[i]) !== -1 returns -1 if parts[i] is ['proto']. This is because the method that has been called if the input is an array is Array.prototype.indexOf() and not String.prototype.indexOf(). They behave differently depending on the type of the input.
Publish Date: 2021-09-01
URL: CVE-2021-23438
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23438
Release Date: 2021-09-01
Fix Resolution (mpath): 0.8.4
Direct dependency fix Resolution (mongoose): 6.3.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - pathval-1.1.0.tgzObject value retrieval given a string path
Library home page: https://registry.npmjs.org/pathval/-/pathval-1.1.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/pathval/package.json
Dependency Hierarchy:
Found in HEAD commit: 29cfc6ccf7871c02275ffdcdd0b5a41ed0369aab
Found in base branch: master
Vulnerability Details
pathval before version 1.1.1 is vulnerable to prototype pollution.
Publish Date: 2020-10-26
URL: CVE-2020-7751
CVSS 3 Score Details (7.2)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7751
Release Date: 2020-10-26
Fix Resolution (pathval): 1.1.1
Direct dependency fix Resolution (chai): 4.3.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - xmlhttprequest-ssl-1.5.5.tgzXMLHttpRequest for Node
Library home page: https://registry.npmjs.org/xmlhttprequest-ssl/-/xmlhttprequest-ssl-1.5.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/xmlhttprequest-ssl/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
This affects the package xmlhttprequest before 1.7.0; all versions of package xmlhttprequest-ssl. Provided requests are sent synchronously (async=False on xhr.open), malicious user input flowing into xhr.send could result in arbitrary code being injected and run.
Publish Date: 2021-03-05
URL: CVE-2020-28502
CVSS 3 Score Details (8.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-h4j5-c7cj-74xg
Release Date: 2021-03-05
Fix Resolution (xmlhttprequest-ssl): 1.6.1
Direct dependency fix Resolution (express-status-monitor): 1.3.4
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - marked-0.8.2.tgzA markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.8.2.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/marked/package.json
Dependency Hierarchy:
Found in HEAD commit: 69fe536a21ff7400f36b3c5d567635e87df28e53
Found in base branch: master
Vulnerability Details
marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.
Publish Date: 2020-07-02
URL: WS-2020-0163
CVSS 3 Score Details (5.9)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/markedjs/marked/releases/tag/v1.1.1
Release Date: 2020-07-02
Fix Resolution: marked - 1.1.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - systeminformation-4.34.5.tgzSimple system and OS information library
Library home page: https://registry.npmjs.org/systeminformation/-/systeminformation-4.34.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/systeminformation/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
The System Information Library for Node.JS (npm package "systeminformation") is an open source collection of functions to retrieve detailed hardware, system and OS information. In systeminformation before version 5.3.1 there is a command injection vulnerability. Problem was fixed in version 5.3.1. As a workaround instead of upgrading, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() ... do only allow strings, reject any arrays. String sanitation works as expected.
Publish Date: 2021-02-16
URL: CVE-2021-21315
CVSS 3 Score Details (7.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-2m8v-572m-ff2v
Release Date: 2021-02-16
Fix Resolution (systeminformation): 4.34.11
Direct dependency fix Resolution (pm2): 4.5.2
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - ini-1.3.5.tgzAn ini encoder/decoder for node
Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/ini/package.json
Dependency Hierarchy:
Found in HEAD commit: 29cfc6ccf7871c02275ffdcdd0b5a41ed0369aab
Found in base branch: master
Vulnerability Details
This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.
Publish Date: 2020-12-11
URL: CVE-2020-7788
CVSS 3 Score Details (7.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788
Release Date: 2020-12-11
Fix Resolution (ini): 1.3.6
Direct dependency fix Resolution (npm-check-updates): 5.0.0-alpha.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - braces-1.8.5.tgzFastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.
Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/micromatch/node_modules/braces/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.
Publish Date: 2018-02-16
URL: WS-2019-0019
CVSS 2 Score Details (5.0)
Base Score Metrics not available
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/786
Release Date: 2019-02-21
Fix Resolution: 2.3.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Libraries - yargs-parser-10.1.0.tgz, yargs-parser-9.0.2.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-10.1.0.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/conventional-commits-parser/node_modules/yargs-parser/package.json
Dependency Hierarchy:
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-9.0.2.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/npm/node_modules/yargs-parser/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.
Publish Date: 2020-03-16
URL: CVE-2020-7608
CVSS 3 Score Details (5.3)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7608
Release Date: 2020-03-16
Fix Resolution: v18.1.1;13.1.2;15.0.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - jquery-1.8.1.min.jsJavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js
Path to dependency file: node-boilerplate/node_modules/redeyed/examples/browser/index.html
Path to vulnerable library: node-boilerplate/node_modules/redeyed/examples/browser/index.html
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.
Publish Date: 2020-05-19
URL: CVE-2020-7656
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: rails/jquery-rails@8f601cb
Release Date: 2020-05-19
Fix Resolution: jquery-rails - 2.2.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - systeminformation-4.34.5.tgzSimple system and OS information library
Library home page: https://registry.npmjs.org/systeminformation/-/systeminformation-4.34.5.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/systeminformation/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
systeminformation is an open source system and OS information library for node.js. A command injection vulnerability has been discovered in versions of systeminformation prior to 5.6.4. The issue has been fixed with a parameter check on user input. Please upgrade to version >= 5.6.4. If you cannot upgrade, be sure to check or sanitize service parameters that are passed to si.inetLatency(), si.inetChecksite(), si.services(), si.processLoad() and other commands. Only allow strings, reject any arrays. String sanitation works as expected.
Publish Date: 2021-04-29
URL: CVE-2021-21388
CVSS 3 Score Details (9.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: sebhildebrandt/systeminformation#492
Release Date: 2021-04-29
Fix Resolution (systeminformation): 4.34.11
Direct dependency fix Resolution (pm2): 4.5.2
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - engine.io-3.4.2.tgzThe realtime engine behind Socket.IO. Provides the foundation of a bidirectional connection between client and server
Library home page: https://registry.npmjs.org/engine.io/-/engine.io-3.4.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/engine.io/package.json
Dependency Hierarchy:
Found in HEAD commit: 29cfc6ccf7871c02275ffdcdd0b5a41ed0369aab
Found in base branch: master
Vulnerability Details
Engine.IO before 4.0.0 allows attackers to cause a denial of service (resource consumption) via a POST request to the long polling transport.
Publish Date: 2021-01-08
URL: CVE-2020-36048
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-36048
Release Date: 2021-01-08
Fix Resolution: engine.io - 4.0.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - ajv-5.5.2.tgzAnother JSON Schema Validator
Library home page: https://registry.npmjs.org/ajv/-/ajv-5.5.2.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/npm/node_modules/ajv/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)
Publish Date: 2020-07-15
URL: CVE-2020-15366
CVSS 3 Score Details (5.6)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/ajv-validator/ajv/releases/tag/v6.12.3
Release Date: 2020-07-15
Fix Resolution: ajv - 6.12.3
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - marked-1.2.7.tgzA markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-1.2.7.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/marked/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression inline.reflinkSearch may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Publish Date: 2022-01-14
URL: CVE-2022-21681
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-5v2h-r2cx-5xgj
Release Date: 2022-01-14
Fix Resolution (marked): 4.0.10
Direct dependency fix Resolution (semantic-release): 19.0.0-beta.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - moment-2.27.0.tgzParse, validate, manipulate, and display dates
Library home page: https://registry.npmjs.org/moment/-/moment-2.27.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/moment/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
Publish Date: 2022-04-04
URL: CVE-2022-24785
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-8hfj-j24r-96c4
Release Date: 2022-04-04
Fix Resolution: moment - 2.29.2,Moment.js - 2.29.2
Step up your Open Source Security Game with WhiteSource here
Vulnerable Libraries - async-2.6.3.tgz, async-3.2.0.tgz, async-1.5.2.tgz
Higher-order functions and common patterns for asynchronous code
Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/@pm2/js-api/node_modules/async/package.json
Dependency Hierarchy:
Higher-order functions and common patterns for asynchronous code
Library home page: https://registry.npmjs.org/async/-/async-3.2.0.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/async/package.json
Dependency Hierarchy:
Higher-order functions and common patterns for asynchronous code
Library home page: https://registry.npmjs.org/async/-/async-1.5.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/vizion/node_modules/async/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.
Publish Date: 2022-04-06
URL: CVE-2021-43138
CVSS 3 Score Details (7.8)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138
Release Date: 2022-04-06
Fix Resolution (async): 3.2.2
Direct dependency fix Resolution (all-contributors-cli): 6.20.0
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - redis-3.0.2.tgzA high performance Redis client.
Library home page: https://registry.npmjs.org/redis/-/redis-3.0.2.tgz
Path to dependency file: /package.json
Path to vulnerable library: /node_modules/redis/package.json
Dependency Hierarchy:
Found in base branch: master
Vulnerability Details
Node-redis is a Node.js Redis client. Before version 3.1.1, when a client is in monitoring mode, the regex begin used to detected monitor messages could cause exponential backtracking on some strings. This issue could lead to a denial of service. The issue is patched in version 3.1.1.
Publish Date: 2021-04-23
URL: CVE-2021-29469
CVSS 3 Score Details (7.5)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: GHSA-35q2-47q7-3pc3
Release Date: 2021-04-23
Fix Resolution: 3.1.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Libraries - lodash-4.17.14.tgz, lodash-4.17.15.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.14.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/pm2/node_modules/lodash/package.json
Dependency Hierarchy:
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/lodash/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
Prototype pollution attack when using _.zipObjectDeep in lodash <= 4.17.15.
Publish Date: 2020-07-15
URL: CVE-2020-8203
CVSS 3 Score Details (7.4)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1523
Release Date: 2020-07-23
Fix Resolution: lodash - 4.17.19
Step up your Open Source Security Game with WhiteSource here
Vulnerable Libraries - npm-registry-fetch-8.0.0.tgz, npm-registry-fetch-4.0.3.tgz
Fetch-based http client for use with npm registry APIs
Library home page: https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-8.0.0.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/npm-registry-fetch/package.json
Dependency Hierarchy:
Fetch-based http client for use with npm registry APIs
Library home page: https://registry.npmjs.org/npm-registry-fetch/-/npm-registry-fetch-4.0.3.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/npm/node_modules/npm-registry-fetch/package.json
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
npm-registry-fetch before 4.0.5 and 8.1.1 is vulnerable to an information exposure vulnerability through log files.
Publish Date: 2020-07-07
URL: WS-2020-0127
CVSS 3 Score Details (3.4)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1544
Release Date: 2020-07-14
Fix Resolution: npm-registry-fetch - 4.0.5,8.1.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - marked-0.8.2.tgzA markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.8.2.tgz
Path to dependency file: node-boilerplate/package.json
Path to vulnerable library: node-boilerplate/node_modules/marked/package.json
Dependency Hierarchy:
Found in HEAD commit: d9b4cc8063e24bd484530314ab20ac2d824ecf7a
Found in base branch: master
Vulnerability Details
marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.
Publish Date: 2020-07-02
URL: WS-2020-0163
CVSS 3 Score Details (5.9)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://github.com/markedjs/marked/releases/tag/v1.1.1
Release Date: 2020-07-02
Fix Resolution: marked - 1.1.1
Step up your Open Source Security Game with WhiteSource here
Vulnerable Library - jquery-1.8.1.min.jsJavaScript library for DOM operations
Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js
Path to dependency file: node-boilerplate/node_modules/redeyed/examples/browser/index.html
Path to vulnerable library: node-boilerplate/node_modules/redeyed/examples/browser/index.html
Dependency Hierarchy:
Found in HEAD commit: 3d234aef965340ed4c7d5b95ed6fa0f1a6bf6345
Found in base branch: master
Vulnerability Details
jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.
Publish Date: 2018-01-18
URL: CVE-2012-6708
CVSS 3 Score Details (6.1)
Base Score Metrics:
Suggested Fix
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708
Release Date: 2018-01-18
Fix Resolution: jQuery - v1.9.0
Step up your Open Source Security Game with WhiteSource here
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
Django
The Web framework for perfectionists with deadlines.
Laravel
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
Microsoft
Open source projects and samples from Microsoft.
Google
Google ❤️ Open Source for everyone.
Alibaba
Alibaba Open Source for everyone
D3
Data-Driven Documents codes.
Tencent
China tencent open source team.
