Giter VIP home page Giter VIP logo

vonage-dotnet-code-snippets's Introduction

Vonage APIs code snippets for .NET using CSharp

Vonage

The purpose of the code snippets project is to provide simple examples focused on one goal. For example, sending an SMS, handling an incoming SMS webhook or making a Text to Speech call.

Configure with Your Vonage Credentials

To use this sample you will first need a Vonage account. Once you have your own API credentials, Create a Vonage Client instance and pass in credentials in the constructor.

Setting up environment variables

Configuring Environment Variables

Open the sln file. For each project, right click and go to properties -> debug -> Environment Variables. Alternatively you can edit the environment variables in the Properties/launchSettings.json - there is a Properties/launchSettings.json.dist file present you can rename. This file has keys associated with each relevant property.

Environment Variable Reference

Key Description
VONAGE_API_KEY Your API key
VONAGE_API_SECRET Vonage API secret
VONAGE_PRIVATE_KEY_PATH Path to a private key for your Vonage app
VONAGE_APPLICATION_ID Your application ID
VONAGE_API_SIGNATURE_SECRET Vonage SIGNATURE_SECRET from the Dashboard. This is different to the usual API_SECRET.
CODE User Supplied Verification code (for checking verify requests)
SMS_CALLBACK_URL Callback URL that you would like to receive SMS webhooks to
DIGITS DTMF Digits to play into app
API_KEY API key to apply an update to
VOICE_CALLBACK_VALUE A SIP URI, telephone number or app ID (depending on VOICE_CALLBACK_TYPE)
VOICE_CALLBACK_TYPE sip, tel or app
VONAGE_NUMBER Vonage Number used for Caller ID or lvn you want to purchase/cancel/update
VONAGE_NUMBER_FEATURES VOICE or SMS or VOICE,SMS
TO_NUMBER Number to send an SMS to.
TEXT Text to be played into call via text-to-speech
VONAGE_REDACT_ID Vonage ID to use for redaction
REQUEST_ID The ID of the request to search (returned when the request is started) - also request to operate on for verify
INSIGHT_NUMBER The number to provide insight information for.
VONAGE_BRAND_NAME The alphanumeric string that represents the name or number of the organisation sending the message.
UUID The UUID of the call leg to modify.
NUMBER_SEARCH_PATTERN Whether to look for NUMBER_SEARCH_CRITERIA at the beginning of the number (0), anywhere within the number (1) or at the end of the number (2)
NUMBER_SEARCH_CRITERIA The number pattern you want to search for, e.g. 234
RECIPIENT_NUMBER Telephone number to verify, in E.164 format
NCCO_URL The URL of the NCCO to transfer control to, eg https://raw.githubusercontent.com/nexmo-community/ncco-examples/gh-pages/text-to-speech.json
VOICE_STATUS_URL The webhook URL that Vonage makes a request to when a call completes
BRAND_NAME Included in the message to explain who is confirming the phone number
VONAGE_NUMBER_TYPE landline, mobile-lvn or landline-toll-free
COUNTRY_CODE The two-character country code for the number you want to purchase, e.g. GB
RECORDING_URL This is the URL to the recording supplied in the record even webhook
URL The URL of the audio file that will be played.
FROM_NUMBER The phone number you are sending the message from.
VONAGE_REDACT_TYPE Type of transaction to redact Outbound or Inbound
VONAGE_REDACT_PRODUCT Product you are redacting for: Sms, Voice, NumberInsight, Verify, VerifySdk, Messages
VONAGE_SECRET_ID The secret to revoke/retrieve
NEW_SECRET The new secret to use with this API key

Other option for setting Environment Variables

If you just want to set the environment variables via code you can do so by:

  1. Remove the field from the Properties/launchSettings.Json file
  2. In the snippet - edit the string values on the right side of the ?? :
var VONAGE_API_KEY = Environment.GetEnvironmentVariable("VONAGE_API_KEY") ?? "CHANGE_ME";

As the environment variable has been removed from the launchSettings.json file it will return null when read into the environment - causing the app to default to the alternate string value.

Running the Code Snippets

CLI Code Snippets

The non-webhook snippets are designed to be run from the cli - in order to run any given snippet you will need to pass in the argument -s or -snippet and set it equal to the partially qualified name of the snippet, e.g.

dotnet run --project .\DotNetCliCodeSnippets\DotnetCliCodeSnippets.csproj --s=Messaging.SendSms

Webhook snippets

The webhook code snippets are designed to be run in an MVC controller in IIS or IIS Express. Each controller defines its own snippet or set of snippets.

For example the inbound-sms snippet is located at

/sms/webhooks/inbound-sms

Using Ngrok

In order to test the incoming webhook data from Vonage, the Vonage API needs an externally accessible URL to send that data to. A commonly used service for development and testing is ngrok. The service will provide you with an externally available web address that creates a secure tunnel to your local environment. The Vonage API Developer Platform has a guide to getting started with testing with ngrok.

Once you have your ngrok URL, you can enter your Vonage Dashboard and supply it as the EVENT URL for any Vonage service that sends event data via a webhook. A good test case is creating a Voice application and providing the ngrok URL in the following format as the event url:

The snippet webhook path above is then translated to:

#{ngrok URL}/sms/webhooks/inbound-sms

When routed through ngrok.

working with Numbers

For some of the examples, you will need to buy a number.

TLS Upgrade

Vonage permanently disabled support of legacy TLSv1 and TLSv1.1 protocols. Vulnerabilities within these TLS versions are serious and, left unaddressed, put organizations at risk of being breached. The only supported encryption protocol for HTTPS connections is now TLSv1.2. All API requests and all web requests to the Vonage Dashboard using legacy TLS protocols will be rejected.

In case you are still using a legacy TLS protocol, make sure to force your app to TLSv1.2 by adding this line of code :

System.Net.ServicePointManager.SecurityProtocol =  System.Net.SecurityProtocolType.Tls12;

Request an Example

Please raise an issue to request an example that isn't present within the code snippets. Pull requests will be gratefully received.

Contributing

We โค๏ธ contributions from everyone! Bug reports, bug fixes and feedback on the application is always appreciated. Look at the Contributor Guidelines for more information and please follow the GitHub Flow.

License

This code is licensed under the MIT license.

vonage-dotnet-code-snippets's People

Contributors

andreathniah avatar leggetter avatar lornajane avatar matt-lethargic avatar mheap avatar palmemanuel avatar rabebothmani avatar sidsharma27 avatar slorello89 avatar superchilled avatar tommorris avatar tr00d avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

vonage-dotnet-code-snippets's Issues

Make a call using In-App voice via JS SDK.

We need a good example which demonstrates how to make a call using the JS SDK and C# web api.
Also, since the existing Nexmo chsarp library does not support JWT generation directly we need a sample for the same. So far following the vue.js sample on the Nexmo blog did help. But it takes up a lot of time translating it all into a Microsoft stack.

microsoft.entityframeworkcore.sqlserver.3.0.0.nupkg: 1 vulnerabilities (highest severity is: 5.8) - autoclosed

Vulnerable Library - microsoft.entityframeworkcore.sqlserver.3.0.0.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.data.sqlclient/1.0.19249.1/microsoft.data.sqlclient.1.0.19249.1.nupkg

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (microsoft.entityframeworkcore.sqlserver.3.0.0.nupkg version) Remediation Possible**
CVE-2022-41064 Medium 5.8 microsoft.data.sqlclient.1.0.19249.1.nupkg Transitive N/A* โŒ

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-41064

Vulnerable Library - microsoft.data.sqlclient.1.0.19249.1.nupkg

Provides the data provider for SQL Server. These classes provide access to versions of SQL Server an...

Library home page: https://api.nuget.org/packages/microsoft.data.sqlclient.1.0.19249.1.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.data.sqlclient/1.0.19249.1/microsoft.data.sqlclient.1.0.19249.1.nupkg

Dependency Hierarchy:

  • microsoft.entityframeworkcore.sqlserver.3.0.0.nupkg (Root Library)
    • โŒ microsoft.data.sqlclient.1.0.19249.1.nupkg (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

.NET Framework Information Disclosure Vulnerability
Mend Note: Converted from WS-2022-0377, on 2022-11-10.

Publish Date: 2022-11-09

URL: CVE-2022-41064

CVSS 3 Score Details (5.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8g2p-5pqh-5jmc

Release Date: 2022-11-09

Fix Resolution: Microsoft.Data.SqlClient - 1.1.4,2.1.2;System.Data.SqlClient - 4.8.5

No chance to make an inbound call inbound Call in Net Core

Hi,
I've been searching for this everywhere, on google/bing, on git, on the nexmo website, and so on.

So, here's my issue :

I'm currently trying to follow this tutorial : https://www.nexmo.com/blog/2018/11/21/how-to-receive-a-phone-call-with-nexmo-voice-api-asp-core-core-and-nancyfx-dr/.

One major issue : when I try to contact the number I bought (using my phone then), it seems to disconnect the call even before it can respond. I almost sound like it's going to pick up but then I only hear beeps (the same kind produced when a phone is disconnected : https://www.youtube.com/watch?v=CU7F5qKX07w).

I can't find any documentation or tutorial that works in dotnet core. I tried with NodeJS, which works but I wish this could be in c#.

Any idea where the problem could be?

  • I'm working with windows 10
  • I have the last version of Visual Studio.
  • Everything works with postman.
  • The number was bought in Belgium, don't know if it's a factor.
  • I didn't divert from the tutorial at all. I updated the appsettings of course.

Will there be any working dotnet sample displaying how to receive call (inbound voice call)?

Thanks in advance

vonage.6.0.1-rc.nupkg: 1 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - vonage.6.0.1-rc.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/9.0.1/newtonsoft.json.9.0.1.nupkg

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (vonage.6.0.1-rc.nupkg version) Remediation Available
WS-2022-0161 High 7.5 newtonsoft.json.9.0.1.nupkg Transitive N/A* โŒ

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

WS-2022-0161

Vulnerable Library - newtonsoft.json.9.0.1.nupkg

Json.NET is a popular high-performance JSON framework for .NET

Library home page: https://api.nuget.org/packages/newtonsoft.json.9.0.1.nupkg

Path to dependency file: /DotNetCliCodeSnippets/DotnetCliCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/newtonsoft.json/9.0.1/newtonsoft.json.9.0.1.nupkg

Dependency Hierarchy:

  • vonage.6.0.1-rc.nupkg (Root Library)
    • jose-jwt.2.3.0.nupkg
      • โŒ newtonsoft.json.9.0.1.nupkg (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

Improper Handling of Exceptional Conditions in Newtonsoft.Json.
Newtonsoft.Json prior to version 13.0.1 is vulnerable to Insecure Defaults due to improper handling of StackOverFlow exception (SOE) whenever nested expressions are being processed. Exploiting this vulnerability results in Denial Of Service (DoS), and it is exploitable when an attacker sends 5 requests that cause SOE in time frame of 5 minutes. This vulnerability affects Internet Information Services (IIS) Applications.

Publish Date: 2022-06-22

URL: WS-2022-0161

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-06-22

Fix Resolution: Newtonsoft.Json - 13.0.1;Microsoft.Extensions.ApiDescription.Server - 6.0.0

jquery.validate-1.17.0.min.js: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - jquery.validate-1.17.0.min.js

Client-side form validation made easy

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/jquery.validate.min.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery-validation/dist/jquery.validate.min.js

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jquery.validate version) Remediation Possible**
CVE-2022-31147 High 7.5 jquery.validate-1.17.0.min.js Direct jquery-validation - 1.19.5 โŒ
CVE-2021-21252 High 7.5 jquery.validate-1.17.0.min.js Direct jquery-validation - 1.19.3 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-31147

Vulnerable Library - jquery.validate-1.17.0.min.js

Client-side form validation made easy

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/jquery.validate.min.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery-validation/dist/jquery.validate.min.js

Dependency Hierarchy:

  • โŒ jquery.validate-1.17.0.min.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.

Publish Date: 2022-07-14

URL: CVE-2022-31147

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-ffmh-x56j-9rc3

Release Date: 2022-07-14

Fix Resolution: jquery-validation - 1.19.5

CVE-2021-21252

Vulnerable Library - jquery.validate-1.17.0.min.js

Client-side form validation made easy

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/jquery.validate.min.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery-validation/dist/jquery.validate.min.js

Dependency Hierarchy:

  • โŒ jquery.validate-1.17.0.min.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.

Publish Date: 2021-01-13

URL: CVE-2021-21252

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jxwx-85vp-gvwm

Release Date: 2021-01-13

Fix Resolution: jquery-validation - 1.19.3

Problems with dotnet integration

Related to issues found by Bill Garland

  • I have tried to integrate V2 of your .NET API into my build but it requires 30 (!!!!) other packages and installing these breaks my App

  • I have tried to integrate V1 of your .NET API which only requires a JSON package but this throws an exception

  • Maybe I will try again with V3.

microsoft.entityframeworkcore.sqlserver.7.0.12.nupkg: 3 vulnerabilities (highest severity is: 8.8) - autoclosed

Vulnerable Library - microsoft.entityframeworkcore.sqlserver.7.0.12.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.data.sqlclient/5.1.1/microsoft.data.sqlclient.5.1.1.nupkg

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (microsoft.entityframeworkcore.sqlserver.7.0.12.nupkg version) Remediation Possible**
CVE-2023-36414 High 8.8 azure.identity.1.7.0.nupkg Transitive N/A* โŒ
CVE-2024-0056 High 8.7 microsoft.data.sqlclient.5.1.1.nupkg Transitive N/A* โŒ
CVE-2024-21319 Medium 6.8 detected in multiple dependencies Transitive N/A* โŒ

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-36414

Vulnerable Library - azure.identity.1.7.0.nupkg

This is the implementation of the Azure SDK Client Library for Azure Identity

Library home page: https://api.nuget.org/packages/azure.identity.1.7.0.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/azure.identity/1.7.0/azure.identity.1.7.0.nupkg

Dependency Hierarchy:

  • microsoft.entityframeworkcore.sqlserver.7.0.12.nupkg (Root Library)
    • microsoft.data.sqlclient.5.1.1.nupkg
      • โŒ azure.identity.1.7.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

Azure Identity SDK Remote Code Execution Vulnerability

Publish Date: 2023-10-10

URL: CVE-2023-36414

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2023-36414

Release Date: 2023-10-10

Fix Resolution: Azure.Identity - 1.10.2

CVE-2024-0056

Vulnerable Library - microsoft.data.sqlclient.5.1.1.nupkg

Provides the data provider for SQL Server.

Library home page: https://api.nuget.org/packages/microsoft.data.sqlclient.5.1.1.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.data.sqlclient/5.1.1/microsoft.data.sqlclient.5.1.1.nupkg

Dependency Hierarchy:

  • microsoft.entityframeworkcore.sqlserver.7.0.12.nupkg (Root Library)
    • โŒ microsoft.data.sqlclient.5.1.1.nupkg (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

Microsoft.Data.SqlClient and System.Data.SqlClient SQL Data Provider Security Feature Bypass Vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-0056

CVSS 3 Score Details (8.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-98g6-xh36-x2p7

Release Date: 2024-01-09

Fix Resolution: Microsoft.Data.SqlClient - 2.1.7,3.1.5,4.0.5,5.1.3, System.Data.SqlClient - 4.8.6

CVE-2024-21319

Vulnerable Libraries - microsoft.identitymodel.jsonwebtokens.6.24.0.nupkg, system.identitymodel.tokens.jwt.6.24.0.nupkg

microsoft.identitymodel.jsonwebtokens.6.24.0.nupkg

Includes types that provide support for creating, serializing and validating JSON Web Tokens.

Library home page: https://api.nuget.org/packages/microsoft.identitymodel.jsonwebtokens.6.24.0.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.identitymodel.jsonwebtokens/6.24.0/microsoft.identitymodel.jsonwebtokens.6.24.0.nupkg

Dependency Hierarchy:

  • microsoft.entityframeworkcore.sqlserver.7.0.12.nupkg (Root Library)
    • microsoft.data.sqlclient.5.1.1.nupkg
      • โŒ microsoft.identitymodel.jsonwebtokens.6.24.0.nupkg (Vulnerable Library)

system.identitymodel.tokens.jwt.6.24.0.nupkg

Includes types that provide support for creating, serializing and validating JSON Web Tokens.

Library home page: https://api.nuget.org/packages/system.identitymodel.tokens.jwt.6.24.0.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.identitymodel.tokens.jwt/6.24.0/system.identitymodel.tokens.jwt.6.24.0.nupkg

Dependency Hierarchy:

  • microsoft.entityframeworkcore.sqlserver.7.0.12.nupkg (Root Library)
    • microsoft.data.sqlclient.5.1.1.nupkg
      • microsoft.identitymodel.protocols.openidconnect.6.24.0.nupkg
        • โŒ system.identitymodel.tokens.jwt.6.24.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

Microsoft Identity Denial of service vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-21319

CVSS 3 Score Details (6.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8g9c-28fc-mcx2

Release Date: 2024-01-09

Fix Resolution: System.IdentityModel.Tokens.Jwt - 5.7.0,6.34.0,7.1.2, Microsoft.IdentityModel.JsonWebTokens - 5.7.0,6.34.0,7.1.2

jquery-3.3.1.min.js: 4 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - jquery-3.3.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery/dist/jquery.min.js

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (jquery version) Remediation Possible** Reachability
CVE-2020-23064 Medium 6.1 Not Defined 0.1% jquery-3.3.1.min.js Direct jquery - 3.5.0 โŒ
CVE-2020-11023 Medium 6.1 Proof of concept 1.9% jquery-3.3.1.min.js Direct jquery - 3.5.0;jquery-rails - 4.4.0 โŒ
CVE-2020-11022 Medium 6.1 Proof of concept 6.1% jquery-3.3.1.min.js Direct jQuery - 3.5.0 โŒ
CVE-2019-11358 Medium 6.1 Proof of concept 3.5% jquery-3.3.1.min.js Direct jquery - 3.4.0 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-23064

Vulnerable Library - jquery-3.3.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery/dist/jquery.min.js

Dependency Hierarchy:

  • โŒ jquery-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

Cross Site Scripting vulnerability in jQuery 2.2.0 through 3.x before 3.5.0 allows a remote attacker to execute arbitrary code via the element.

Publish Date: 2023-06-26

URL: CVE-2020-23064

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2023-06-26

Fix Resolution: jquery - 3.5.0

CVE-2020-11023

Vulnerable Library - jquery-3.3.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery/dist/jquery.min.js

Dependency Hierarchy:

  • โŒ jquery-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 1.9%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

CVE-2020-11022

Vulnerable Library - jquery-3.3.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery/dist/jquery.min.js

Dependency Hierarchy:

  • โŒ jquery-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 6.1%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

CVE-2019-11358

Vulnerable Library - jquery-3.3.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.min.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery/dist/jquery.min.js

Dependency Hierarchy:

  • โŒ jquery-3.3.1.min.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 3.5%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0

jquery.validate-1.17.0.js: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - jquery.validate-1.17.0.js

Client-side form validation made easy

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/jquery.validate.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery-validation/dist/jquery.validate.js

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (jquery.validate version) Remediation Possible** Reachability
CVE-2022-31147 High 7.5 Not Defined 0.1% jquery.validate-1.17.0.js Direct jquery-validation - 1.19.5 โŒ
CVE-2021-21252 High 7.5 Not Defined 0.4% jquery.validate-1.17.0.js Direct jquery-validation - 1.19.3 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-31147

Vulnerable Library - jquery.validate-1.17.0.js

Client-side form validation made easy

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/jquery.validate.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery-validation/dist/jquery.validate.js

Dependency Hierarchy:

  • โŒ jquery.validate-1.17.0.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

The jQuery Validation Plugin (jquery-validation) provides drop-in validation for forms. Versions of jquery-validation prior to 1.19.5 are vulnerable to regular expression denial of service (ReDoS) when an attacker is able to supply arbitrary input to the url2 method. This is due to an incomplete fix for CVE-2021-43306. Users should upgrade to version 1.19.5 to receive a patch.

Publish Date: 2022-07-14

URL: CVE-2022-31147

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-ffmh-x56j-9rc3

Release Date: 2022-07-14

Fix Resolution: jquery-validation - 1.19.5

CVE-2021-21252

Vulnerable Library - jquery.validate-1.17.0.js

Client-side form validation made easy

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery-validate/1.17.0/jquery.validate.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery-validation/dist/jquery.validate.js

Dependency Hierarchy:

  • โŒ jquery.validate-1.17.0.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

The jQuery Validation Plugin provides drop-in validation for your existing forms. It is published as an npm package "jquery-validation". jquery-validation before version 1.19.3 contains one or more regular expressions that are vulnerable to ReDoS (Regular Expression Denial of Service). This is fixed in 1.19.3.

Publish Date: 2021-01-13

URL: CVE-2021-21252

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.4%

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jxwx-85vp-gvwm

Release Date: 2021-01-13

Fix Resolution: jquery-validation - 1.19.3

Messages API Webhook Sample Requested

Howdy!

I'm interested in some sample code for the Messages API webhooks - specifically Delivery Receipt and Inbound Message. Pretty much what the SmsController does: https://github.com/Vonage/vonage-dotnet-code-snippets/blob/master/DotNetWebhookCodeSnippets/Controllers/SmsController.cs

Related:

  1. Vonage/vonage-dotnet-sdk#297
  2. Vonage/vonage-dotnet-sdk#298

Ideally, I could just replace:
"var sms = WebhookParser.ParseQuery(Request.Query);"
with
"var message = WebhookParser.ParseQuery(Request.Query);"

At least, I think that is ideal. Is there already a way? If so, please point me in the right direction.

Thanks!

microsoft.visualstudio.web.codegeneration.design.7.0.10.nupkg: 3 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - microsoft.visualstudio.web.codegeneration.design.7.0.10.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/nuget.packaging/6.6.1/nuget.packaging.6.6.1.nupkg

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (microsoft.visualstudio.web.codegeneration.design.7.0.10.nupkg version) Remediation Possible**
CVE-2024-0057 Critical 9.8 nuget.packaging.6.6.1.nupkg Transitive N/A* โŒ
CVE-2019-0820 High 7.5 system.text.regularexpressions.4.3.0.nupkg Transitive N/A* โŒ
CVE-2018-8292 Medium 5.3 system.net.http.4.3.0.nupkg Transitive N/A* โŒ

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2024-0057

Vulnerable Library - nuget.packaging.6.6.1.nupkg

NuGet's understanding of packages. Reading nuspec, nupkgs and package signing.

Library home page: https://api.nuget.org/packages/nuget.packaging.6.6.1.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/nuget.packaging/6.6.1/nuget.packaging.6.6.1.nupkg

Dependency Hierarchy:

  • microsoft.visualstudio.web.codegeneration.design.7.0.10.nupkg (Root Library)
    • microsoft.visualstudio.web.codegenerators.mvc.7.0.10.nupkg
      • microsoft.visualstudio.web.codegeneration.7.0.10.nupkg
        • microsoft.visualstudio.web.codegeneration.entityframeworkcore.7.0.10.nupkg
          • microsoft.visualstudio.web.codegeneration.core.7.0.10.nupkg
            • microsoft.visualstudio.web.codegeneration.templating.7.0.10.nupkg
              • microsoft.visualstudio.web.codegeneration.utils.7.0.10.nupkg
                • microsoft.dotnet.scaffolding.shared.7.0.10.nupkg
                  • nuget.projectmodel.6.6.1.nupkg
                    • nuget.dependencyresolver.core.6.6.1.nupkg
                    • nuget.protocol.6.6.1.nupkg
                    • โŒ nuget.packaging.6.6.1.nupkg (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

NET, .NET Framework, and Visual Studio Security Feature Bypass Vulnerability

Publish Date: 2024-01-09

URL: CVE-2024-0057

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-68w7-72jg-6qpp

Release Date: 2024-01-09

Fix Resolution: NuGet.CommandLine - 5.11.6,6.0.6,6.3.4,6.4.3,6.6.2,6.7.1,6.8.1, NuGet.Packaging - 5.11.6,6.0.6,6.3.4,6.4.3,6.6.2,6.7.1,6.8.1

CVE-2019-0820

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.visualstudio.web.codegeneration.design.7.0.10.nupkg (Root Library)
    • microsoft.visualstudio.web.codegenerators.mvc.7.0.10.nupkg
      • microsoft.visualstudio.web.codegeneration.7.0.10.nupkg
        • microsoft.visualstudio.web.codegeneration.entityframeworkcore.7.0.10.nupkg
          • microsoft.visualstudio.web.codegeneration.core.7.0.10.nupkg
            • microsoft.visualstudio.web.codegeneration.templating.7.0.10.nupkg
              • microsoft.visualstudio.web.codegeneration.utils.7.0.10.nupkg
                • microsoft.dotnet.scaffolding.shared.7.0.10.nupkg
                  • microsoft.codeanalysis.csharp.features.4.4.0.nupkg
                    • microsoft.codeanalysis.features.4.4.0.nupkg
                    • microsoft.diasymreader.1.4.0.nupkg
                    • netstandard.library.1.6.1.nupkg
                    • system.xml.xdocument.4.3.0.nupkg
                    • system.xml.readerwriter.4.3.0.nupkg
                    • โŒ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1

CVE-2018-8292

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that allow applications to consume web services over HTTP and HTTP components that can be used by both clients and servers for parsing HTTP headers.

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.visualstudio.web.codegeneration.design.7.0.10.nupkg (Root Library)
    • microsoft.visualstudio.web.codegenerators.mvc.7.0.10.nupkg
      • microsoft.visualstudio.web.codegeneration.7.0.10.nupkg
        • microsoft.visualstudio.web.codegeneration.entityframeworkcore.7.0.10.nupkg
          • microsoft.visualstudio.web.codegeneration.core.7.0.10.nupkg
            • microsoft.visualstudio.web.codegeneration.templating.7.0.10.nupkg
              • microsoft.visualstudio.web.codegeneration.utils.7.0.10.nupkg
                • microsoft.dotnet.scaffolding.shared.7.0.10.nupkg
                  • microsoft.codeanalysis.csharp.features.4.4.0.nupkg
                    • microsoft.codeanalysis.features.4.4.0.nupkg
                    • microsoft.diasymreader.1.4.0.nupkg
                    • netstandard.library.1.6.1.nupkg
                    • โŒ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

Create hangup example

Add sample code to showcase how to :

  1. Make a call
  2. Put the call in a state where it won't automatically hangup eg. talk loop
  3. Hangup the call based on the status ( if "answered" --> hangup)

microsoft.visualstudio.web.codegeneration.design.3.0.0.nupkg: 3 vulnerabilities (highest severity is: 7.5) - autoclosed

Vulnerable Library - microsoft.visualstudio.web.codegeneration.design.3.0.0.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (microsoft.visualstudio.web.codegeneration.design.3.0.0.nupkg version) Remediation Possible**
CVE-2018-8292 High 7.5 system.net.http.4.3.0.nupkg Transitive N/A* โŒ
CVE-2019-0820 High 7.5 system.text.regularexpressions.4.3.0.nupkg Transitive N/A* โŒ
CVE-2020-11022 Medium 6.1 microsoft.visualstudio.web.codegenerators.mvc.3.0.0.nupkg Transitive N/A* โŒ

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2018-8292

Vulnerable Library - system.net.http.4.3.0.nupkg

Provides a programming interface for modern HTTP applications, including HTTP client components that allow applications to consume web services over HTTP and HTTP components that can be used by both clients and servers for parsing HTTP headers.

Library home page: https://api.nuget.org/packages/system.net.http.4.3.0.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.net.http/4.3.0/system.net.http.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.visualstudio.web.codegeneration.design.3.0.0.nupkg (Root Library)
    • microsoft.visualstudio.web.codegenerators.mvc.3.0.0.nupkg
      • microsoft.visualstudio.web.codegeneration.3.0.0.nupkg
        • microsoft.visualstudio.web.codegeneration.entityframeworkcore.3.0.0.nupkg
          • microsoft.visualstudio.web.codegeneration.core.3.0.0.nupkg
            • microsoft.visualstudio.web.codegeneration.templating.3.0.0.nupkg
              • microsoft.visualstudio.web.codegeneration.utils.3.0.0.nupkg
                • nuget.frameworks.4.7.0.nupkg
                  • netstandard.library.1.6.1.nupkg
                    • โŒ system.net.http.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

An information disclosure vulnerability exists in .NET Core when authentication information is inadvertently exposed in a redirect, aka ".NET Core Information Disclosure Vulnerability." This affects .NET Core 2.1, .NET Core 1.0, .NET Core 1.1, PowerShell Core 6.0.

Publish Date: 2018-10-10

URL: CVE-2018-8292

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2018-10-10

Fix Resolution: System.Net.Http - 4.3.4;Microsoft.PowerShell.Commands.Utility - 6.1.0-rc.1

CVE-2019-0820

Vulnerable Library - system.text.regularexpressions.4.3.0.nupkg

Provides the System.Text.RegularExpressions.Regex class, an implementation of a regular expression e...

Library home page: https://api.nuget.org/packages/system.text.regularexpressions.4.3.0.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/system.text.regularexpressions/4.3.0/system.text.regularexpressions.4.3.0.nupkg

Dependency Hierarchy:

  • microsoft.visualstudio.web.codegeneration.design.3.0.0.nupkg (Root Library)
    • microsoft.visualstudio.web.codegenerators.mvc.3.0.0.nupkg
      • microsoft.visualstudio.web.codegeneration.3.0.0.nupkg
        • microsoft.visualstudio.web.codegeneration.entityframeworkcore.3.0.0.nupkg
          • microsoft.visualstudio.web.codegeneration.core.3.0.0.nupkg
            • microsoft.visualstudio.web.codegeneration.templating.3.0.0.nupkg
              • microsoft.visualstudio.web.codegeneration.utils.3.0.0.nupkg
                • nuget.frameworks.4.7.0.nupkg
                  • netstandard.library.1.6.1.nupkg
                    • system.xml.xdocument.4.3.0.nupkg
                    • system.xml.readerwriter.4.3.0.nupkg
                    • โŒ system.text.regularexpressions.4.3.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

A denial of service vulnerability exists when .NET Framework and .NET Core improperly process RegEx strings, aka '.NET Framework and .NET Core Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0980, CVE-2019-0981.
Mend Note: After conducting further research, Mend has determined that CVE-2019-0820 only affects environments with versions 4.3.0 and 4.3.1 only on netcore50 environment of system.text.regularexpressions.nupkg.

Publish Date: 2019-05-16

URL: CVE-2019-0820

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cmhx-cq75-c4mj

Release Date: 2019-05-16

Fix Resolution: System.Text.RegularExpressions - 4.3.1

CVE-2020-11022

Vulnerable Library - microsoft.visualstudio.web.codegenerators.mvc.3.0.0.nupkg

Code Generators for ASP.NET Core MVC. Contains code generators for MVC Controllers and Views.

This ...

Library home page: https://api.nuget.org/packages/microsoft.visualstudio.web.codegenerators.mvc.3.0.0.nupkg

Path to dependency file: /DotNetWebhookCodeSnippets/DotnetWebhookCodeSnippets.csproj

Path to vulnerable library: /home/wss-scanner/.nuget/packages/microsoft.visualstudio.web.codegenerators.mvc/3.0.0/microsoft.visualstudio.web.codegenerators.mvc.3.0.0.nupkg

Dependency Hierarchy:

  • microsoft.visualstudio.web.codegeneration.design.3.0.0.nupkg (Root Library)
    • โŒ microsoft.visualstudio.web.codegenerators.mvc.3.0.0.nupkg (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

Transfer a call sample code

According to the Voice API Reference, there are 6 possible actions that can be used to modify an in-progress call: hangup, mute, unmute, earmuff, unearmuff, and transfer.

The VoiceController shows how to perform all but the last action, so I would like to contribute to the repository by implementing the transfer call sample code.

jquery-3.3.1.js: 4 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery/dist/jquery.js

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Vulnerabilities

CVE Severity CVSS Exploit Maturity EPSS Dependency Type Fixed in (jquery version) Remediation Possible** Reachability
CVE-2020-23064 Medium 6.1 Not Defined 0.1% jquery-3.3.1.js Direct jquery - 3.5.0 โŒ
CVE-2020-11023 Medium 6.1 Proof of concept 1.9% jquery-3.3.1.js Direct jquery - 3.5.0;jquery-rails - 4.4.0 โŒ
CVE-2020-11022 Medium 6.1 Proof of concept 6.1% jquery-3.3.1.js Direct jQuery - 3.5.0 โŒ
CVE-2019-11358 Medium 6.1 Proof of concept 3.5% jquery-3.3.1.js Direct jquery - 3.4.0 โŒ

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-23064

Vulnerable Library - jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery/dist/jquery.js

Dependency Hierarchy:

  • โŒ jquery-3.3.1.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

Cross Site Scripting vulnerability in jQuery 2.2.0 through 3.x before 3.5.0 allows a remote attacker to execute arbitrary code via the element.

Publish Date: 2023-06-26

URL: CVE-2020-23064

Threat Assessment

Exploit Maturity: Not Defined

EPSS: 0.1%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2023-06-26

Fix Resolution: jquery - 3.5.0

CVE-2020-11023

Vulnerable Library - jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery/dist/jquery.js

Dependency Hierarchy:

  • โŒ jquery-3.3.1.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 1.9%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

CVE-2020-11022

Vulnerable Library - jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery/dist/jquery.js

Dependency Hierarchy:

  • โŒ jquery-3.3.1.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 6.1%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

CVE-2019-11358

Vulnerable Library - jquery-3.3.1.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/3.3.1/jquery.js

Path to vulnerable library: /DotNetWebhookCodeSnippets/wwwroot/lib/jquery/dist/jquery.js

Dependency Hierarchy:

  • โŒ jquery-3.3.1.js (Vulnerable Library)

Found in HEAD commit: 3edaf92a0a3aa3d7441e08d996d889594d4650f6

Found in base branch: master

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

Threat Assessment

Exploit Maturity: Proof of concept

EPSS: 3.5%

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0

OutBound Call not working

When init Call.Do ==> throws exception
**

Value cannot be null

**

Do I need to update my library ?

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    ๐Ÿ–– Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. ๐Ÿ“Š๐Ÿ“ˆ๐ŸŽ‰

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google โค๏ธ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.