billgr17 / sen Goto Github PK
View Code? Open in Web Editor NEWSqlite Express Nodejs
Sqlite Express Nodejs
A library for finding and using SSH public keys
Library home page: https://registry.npmjs.org/sshpk/-/sshpk-1.13.1.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/sqlite3/node_modules/sshpk/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
sshpk is vulnerable to ReDoS when parsing crafted invalid public keys.
Publish Date: 2018-06-07
URL: CVE-2018-3737
Base Score Metrics:
Type: Upgrade version
Origin: https://hackerone.com/reports/319593
Release Date: 2018-06-07
Fix Resolution: 1.13.2
Step up your Open Source Security Game with WhiteSource here
Encode and decode streams into string streams
Library home page: https://registry.npmjs.org/stringstream/-/stringstream-0.0.5.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/sqlite3/node_modules/stringstream/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
All versions of stringstream are vulnerable to out-of-bounds read as it allocates uninitialized Buffers when number is passed in input stream on Node.js 4.x and below.
Publish Date: 2018-05-16
URL: WS-2018-0103
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/664/versions
Release Date: 2019-06-05
Fix Resolution: 0.0.6,1.0.0
Step up your Open Source Security Game with WhiteSource here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.3.5.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
A Denial of Service vulnerability found in handlebars 4.x before 4.4.5.While processing specially-crafted templates, the parser may be forced into endless loop. Attackers may exhaust system resources.
Publish Date: 2019-10-20
URL: WS-2019-0318
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1300
Release Date: 2019-12-01
Fix Resolution: handlebars - 4.4.5
Step up your Open Source Security Game with WhiteSource here
tar for node
Library home page: https://registry.npmjs.org/tar/-/tar-2.2.1.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/sqlite3/node_modules/tar/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
A vulnerability was found in node-tar before version 4.4.2 (excluding version 2.2.2). An Arbitrary File Overwrite issue exists when extracting a tarball containing a hardlink to a file that already exists on the system, in conjunction with a later plain file with the same name as the hardlink. This plain file content replaces the existing file content. A patch has been applied to node-tar v2.2.2).
Publish Date: 2019-04-30
URL: CVE-2018-20834
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20834
Release Date: 2019-04-30
Fix Resolution: tar - 2.2.2,4.4.2
Step up your Open Source Security Game with WhiteSource here
small debugging utility
Library home page: https://registry.npmjs.org/debug/-/debug-2.6.7.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/body-parser/node_modules/debug/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
The debug module is vulnerable to regular expression denial of service when untrusted user input is passed into the o formatter. It takes around 50k characters to block for 2 seconds making this a low severity issue.
Publish Date: 2018-06-07
URL: CVE-2017-16137
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16137
Release Date: 2019-06-05
Fix Resolution: 2.6.9,3.1.0
Step up your Open Source Security Game with WhiteSource here
Port of jQuery.extend for node.js and the browser
Library home page: https://registry.npmjs.org/extend/-/extend-3.0.1.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/sqlite3/node_modules/extend/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
A prototype pollution vulnerability was found in module extend <2.0.2, ~<3.0.2 that allows an attacker to inject arbitrary properties onto Object.prototype.
Publish Date: 2019-02-01
URL: CVE-2018-16492
Base Score Metrics:
Type: Upgrade version
Origin: https://hackerone.com/reports/381185
Release Date: 2019-02-01
Fix Resolution: extend - v3.0.2,v2.0.2
Step up your Open Source Security Game with WhiteSource here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.3.5.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
Prototype Pollution vulnerability found in handlebars.js before 4.5.3. Attacker may use Remote-Code-Execution exploits.
Publish Date: 2019-11-17
URL: WS-2019-0369
Base Score Metrics:
Type: Upgrade version
Origin: https://github.com/wycats/handlebars.js/blob/master/release-notes.md#v453---november-18th-2019
Release Date: 2020-01-08
Fix Resolution: handlebars - 4.5.3
Step up your Open Source Security Game with WhiteSource here
A library for finding and using SSH public keys
Library home page: https://registry.npmjs.org/sshpk/-/sshpk-1.13.1.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/sqlite3/node_modules/sshpk/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
Versions of sshpk before 1.14.1 are vulnerable to regular expression denial of service when parsing crafted invalid public keys.
Publish Date: 2018-04-25
URL: WS-2018-0084
Type: Upgrade version
Origin: https://nodesecurity.io/advisories/606
Release Date: 2018-01-27
Fix Resolution: 1.14.1
Step up your Open Source Security Game with WhiteSource here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.3.5.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
Prototype Pollution vulnerability found in handlebars 1.0.6 before 4.5.3. It is possible to add or modify properties to the Object prototype through a malicious template. Attacker may crash the application or execute Arbitrary Code in specific conditions.
Publish Date: 2019-11-18
URL: WS-2019-0333
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1325
Release Date: 2019-12-05
Fix Resolution: handlebars - 4.5.3
Step up your Open Source Security Game with WhiteSource here
A comprehensive library for mime-type mapping
Library home page: https://registry.npmjs.org/mime/-/mime-1.3.4.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/mime/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
Affected version of mime (1.0.0 throw 1.4.0 and 2.0.0 throw 2.0.2), are vulnerable to regular expression denial of service.
Publish Date: 2017-09-27
URL: WS-2017-0330
Type: Upgrade version
Origin: broofa/mime@1df903f
Release Date: 2019-04-03
Fix Resolution: 1.4.1,2.0.3
Step up your Open Source Security Game with WhiteSource here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.3.5.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
Arbitrary Code Execution vulnerability found in handlebars before 4.5.2. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.
Publish Date: 2019-11-13
URL: WS-2019-0331
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1316
Release Date: 2019-12-05
Fix Resolution: handlebars - 4.5.2
Step up your Open Source Security Game with WhiteSource here
General purpose node utilities
Library home page: https://registry.npmjs.org/hoek/-/hoek-2.16.3.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/sqlite3/node_modules/hoek/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
hoek node module before 4.2.0 and 5.0.x before 5.0.3 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via 'merge' and 'applyToDefaults' functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
Publish Date: 2018-03-30
URL: CVE-2018-3728
Base Score Metrics:
Type: Upgrade version
Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3728
Release Date: 2018-03-30
Fix Resolution: 4.2.1,5.0.3
Step up your Open Source Security Game with WhiteSource here
Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.3.5.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/handlebars/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
Arbitrary Code Execution vulnerability found in handlebars before 4.5.3. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.It is due to an incomplete fix for a WS-2019-0331.
Publish Date: 2019-11-17
URL: WS-2019-0332
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1324
Release Date: 2019-12-05
Fix Resolution: handlebars - 4.5.3
Step up your Open Source Security Game with WhiteSource here
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/sqlite3/node_modules/minimist/package.json
Dependency Hierarchy:
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/minimist/package.json
Dependency Hierarchy:
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/sqlite3/node_modules/rc/node_modules/minimist/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.
Publish Date: 2020-03-11
URL: CVE-2020-7598
Base Score Metrics:
Type: Upgrade version
Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94
Release Date: 2020-03-11
Fix Resolution: minimist - 0.2.1,1.2.3
Step up your Open Source Security Game with WhiteSource here
A comprehensive library for mime-type mapping
Library home page: https://registry.npmjs.org/mime/-/mime-1.3.4.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/mime/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
The mime module < 1.4.1, 2.0.1, 2.0.2 is vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.
Publish Date: 2018-06-07
URL: CVE-2017-16138
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-16138
Release Date: 2018-06-07
Fix Resolution: 1.4.1,2.0.3
Step up your Open Source Security Game with WhiteSource here
Advanced file system stream things
Library home page: https://registry.npmjs.org/fstream/-/fstream-1.0.11.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/sqlite3/node_modules/fstream/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
fstream before 1.0.12 is vulnerable to Arbitrary File Overwrite. Extracting tarballs containing a hardlink to a file that already exists in the system, and a file that matches the hardlink, will overwrite the system's file with the contents of the extracted file. The fstream.DirWriter() function is vulnerable.
Publish Date: 2019-07-02
URL: CVE-2019-13173
Base Score Metrics:
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-13173
Release Date: 2019-07-02
Fix Resolution: 1.0.12
Step up your Open Source Security Game with WhiteSource here
General purpose crypto utilities
Library home page: https://registry.npmjs.org/cryptiles/-/cryptiles-2.0.5.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/sqlite3/node_modules/cryptiles/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
Eran Hammer cryptiles version 4.1.1 earlier contains a CWE-331: Insufficient Entropy vulnerability in randomDigits() method that can result in An attacker is more likely to be able to brute force something that was supposed to be random.. This attack appear to be exploitable via Depends upon the calling application.. This vulnerability appears to have been fixed in 4.1.2.
Publish Date: 2018-07-09
URL: CVE-2018-1000620
Base Score Metrics:
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2018-1000620
Release Date: 2018-07-09
Fix Resolution: v4.1.2
Step up your Open Source Security Game with WhiteSource here
Recursive object extending
Library home page: https://registry.npmjs.org/deep-extend/-/deep-extend-0.4.2.tgz
Path to dependency file: /tmp/ws-scm/SEN/package.json
Path to vulnerable library: /tmp/ws-scm/SEN/node_modules/sqlite3/node_modules/deep-extend/package.json
Dependency Hierarchy:
Found in HEAD commit: ae3a979a8ced8cd7f8704c9cb4dc24d9adf7f151
The utilities function in all versions <= 0.5.0 of the deep-extend node module can be tricked into modifying the prototype of Object when the attacker can control part of the structure passed to this function. This can let an attacker add or modify existing properties that will exist on all objects.
Publish Date: 2018-07-03
URL: CVE-2018-3750
Base Score Metrics:
Type: Upgrade version
Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3750
Release Date: 2019-01-24
Fix Resolution: 0.5.1
Step up your Open Source Security Game with WhiteSource here
A declarative, efficient, and flexible JavaScript library for building user interfaces.
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google ❤️ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.