Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Snyk] Fix for 5 vulnerabilities #61

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

[Snyk] Fix for 5 vulnerabilities #61

wants to merge 1 commit into from
+7,878 −4,518

Conversation

geekshiv-JC
Copy link
Owner

snyk-top-banner

Snyk has created this PR to fix 5 vulnerabilities in the npm dependencies of this project.

Snyk changed the following file(s):

  • packages/node/base/package.json
  • packages/node/base/package-lock.json

Vulnerabilities that will be fixed with an upgrade:

Issue Score
high severity Uncontrolled resource consumption
SNYK-JS-BRACES-6838727		   696  
high severity Denial of Service (DoS)
SNYK-JS-WS-7266574		   696  
medium severity Uncontrolled Resource Consumption ('Resource Exhaustion')
SNYK-JS-TAR-6476909		   646  
medium severity Open Redirect
SNYK-JS-EXPRESS-6474509		   519  
medium severity Improper Input Validation
SNYK-JS-POSTCSS-5926692		   479  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Uncontrolled resource consumption
🦉 Open Redirect
🦉 Improper Input Validation

@geekshiv-JC
Copy link
Owner Author

Logo
Checkmarx One – Scan Summary & Details – 77836261-c4a4-4937-a8d6-a68832487505

New Issues

Severity Issue Source File / Package Checkmarx Insight
HIGH CVE-2023-42282 Npm-ip-1.1.5 Vulnerable Package
HIGH CVE-2024-27088 Npm-es5-ext-0.10.53 Vulnerable Package
HIGH CVE-2024-27351 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-29415 Npm-ip-1.1.5 Vulnerable Package
HIGH CVE-2024-37890 Npm-ws-8.2.3 Vulnerable Package
HIGH CVE-2024-37890 Npm-ws-7.4.6 Vulnerable Package
HIGH CVE-2024-37890 Npm-ws-7.5.6 Vulnerable Package
HIGH CVE-2024-38355 Npm-socket.io-4.4.0 Vulnerable Package
HIGH CVE-2024-38875 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-39330 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-39614 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-4068 Npm-braces-2.3.2 Vulnerable Package
HIGH CVE-2024-41989 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-41990 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-41991 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-42005 Python-Django-1.2 Vulnerable Package
HIGH CVE-2024-45296 Npm-path-to-regexp-0.1.7 Vulnerable Package
HIGH CVE-2024-45296 Npm-path-to-regexp-1.8.0 Vulnerable Package
HIGH Cx22d7540f-80c2 Npm-angular-1.8-1.8.2 Vulnerable Package
HIGH Cx7d3bd13f-4c2a Npm-angular-1.8-1.8.2 Vulnerable Package
HIGH Cxdd90df0b-e1ac Npm-angular-1.8-1.8.2 Vulnerable Package
HIGH Cxeaf4b44b-15c8 Npm-angular-mocks-1.8-1.8.2 Vulnerable Package
MEDIUM CVE-2023-26159 Npm-follow-redirects-1.14.6 Vulnerable Package
MEDIUM CVE-2024-25710 Maven-org.apache.commons:commons-compress-1.15 Vulnerable Package
MEDIUM CVE-2024-25710 Maven-org.apache.commons:commons-compress-1.20 Vulnerable Package
MEDIUM CVE-2024-28849 Npm-follow-redirects-1.14.6 Vulnerable Package
MEDIUM CVE-2024-28863 Npm-tar-4.4.19 Vulnerable Package
MEDIUM CVE-2024-28863 Npm-tar-6.1.11 Vulnerable Package
MEDIUM CVE-2024-37168 Npm-@grpc/grpc-js-1.4.4 Vulnerable Package
MEDIUM CVE-2024-38820 Maven-org.springframework:spring-core-5.3.0 Vulnerable Package
MEDIUM CVE-2024-38999 Npm-requirejs-2.3.6 Vulnerable Package
MEDIUM CVE-2024-39329 Python-Django-1.2 Vulnerable Package
MEDIUM CVE-2024-4067 Npm-micromatch-3.1.10 Vulnerable Package
MEDIUM CVE-2024-45231 Python-Django-1.2 Vulnerable Package
MEDIUM CVE-2024-47068 Npm-rollup-1.11.3 Vulnerable Package
MEDIUM CVE-2024-47068 Npm-rollup-2.59.0 Vulnerable Package
MEDIUM CVE-2024-47178 Npm-basic-auth-connect-1.0.0 Vulnerable Package
MEDIUM CVE-2024-47764 Npm-cookie-0.4.1 Vulnerable Package
LOW CVE-2024-21538 Npm-cross-spawn-6.0.5 Vulnerable Package
LOW CVE-2024-21538 Npm-cross-spawn-5.1.0 Vulnerable Package
LOW CVE-2024-21538 Npm-cross-spawn-7.0.3 Vulnerable Package
LOW CVE-2024-4128 Npm-firebase-tools-9.23.1 Vulnerable Package

Fixed Issues

Severity Issue Source File / Package
HIGH CVE-2022-25858 Npm-terser-5.10.0
HIGH CVE-2022-25858 Npm-terser-5.9.0
HIGH CVE-2022-41323 Python-Django-1.2
HIGH CVE-2023-28154 Npm-webpack-5.64.1
HIGH Cx37f28a21-b2a7 Npm-angular-1.8-1.8.2
HIGH Cx94a5c81d-63b1 Npm-angular-1.8-1.8.2
HIGH Cx9eb96c9b-eb45 Npm-angular-mocks-1.8-1.8.2
HIGH Cxcf770dcb-fd21 Npm-angular-1.8-1.8.2
HIGH Cxf6e7f2c1-dc59 Npm-yauzl-2.10.0
MEDIUM CVE-2007-2379 Npm-jquery-3.6.0
MEDIUM CVE-2014-6071 Npm-jquery-3.6.0
MEDIUM CVE-2021-23566 Npm-nanoid-3.1.30
MEDIUM CVE-2022-22950 Maven-org.springframework:spring-core-5.3.0
MEDIUM CVE-2022-22971 Maven-org.springframework:spring-core-5.3.0
MEDIUM CVE-2023-44270 Npm-postcss-7.0.39
MEDIUM CVE-2023-44270 Npm-postcss-8.3.11
LOW CVE-2023-5752 Python-pip-22.2

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@geekshiv-JC @snyk-bot