Coder Social home page Coder Social logo

levyforchh / superglue Goto Github PK

View Code? Open in Web Editor NEW

This project forked from intuit/superglue

0.0 1.0 0.0 45.23 MB

Superglue is a lineage-tracking tool built to help visualize the propagation of data through complex pipelines composed of tables, jobs and reports.

License: Apache License 2.0

Shell 0.04% Scala 76.09% Dockerfile 0.04% JavaScript 19.03% HTML 0.11% CSS 4.68%

superglue's Introduction

Superglue

Join the chat at https://gitter.im/intuit/superglue

Superglue is a lineage-tracking tool to help visualize the propagation of data through complex pipelines.

Superglue demo

Quick Start

Dependencies:

  • JDK 8
  • Docker

The first-time setup takes about five minutes.

Superglue setup

Note: The gifs show superglue being hosted at http://localhost:3000, but that has since changed. Be sure to use http://localhost:8080 instead!

Detailed instructions below!

Launch the development environment with Docker

We've included a docker configuration to set up all of the services that superglue needs to run. To launch the development image, run

docker-compose -f deployments/development/docker-compose.yml up

This launches

  • A MySQL database on port 3314
  • The superglue frontend at http://localhost:8080
  • The superglue backend at http://localhost:8080/api
  • An elasticsearch server at http://localhost:8080/elasticsearch

Note: By default, docker allocates 2GB of memory for containers, but you may need to increase this limit, otherwise elasticsearch will shut down.

Install the command-line client

To install the superglue command-line client, run

./gradlew installDist

This will put the superglue executable into ~/.superglue/bin/. Add this directory to your path to use it as a command by pasting the following line to the end of your ~/.bashrc:

export PATH="${HOME}/.superglue/bin:${PATH}"

Get started with sample data

We've included a sample SQL script with some dummy statements to illustrate Superglue's usefulness. The next steps will assume you successfully installed the superglue command-line tool and have the docker development containers running.

The first thing we need to do is initialize the database. To do this, we need a configuration file with the database's location and credentials. We've provided one for this exercise in examples/superglue.conf.

cd examples
superglue init --database

Note: The superglue tool automatically searches for a file called superglue.conf in the current directory to use as its configuration.

Next, we need to parse our sample data (in examples/demo.sql) and get it into the database. Our configuration file also lists the files that should be parsed, and again, the command-line tool will automatically use superglue.conf.

# In examples/
superglue parse

If everything works out, superglue should print out a json blurb that describes the data it parsed, then it will pause for a few seconds as it inserts the data into the database.

The last setup step is to load our data into elasticsearch so that we'll be able to search through the data from the UI.

superglue elastic --load

Once all of that's done, head on over to a browser and open up http://localhost:8080. You should be able to start searching for table names, and click one to see it's lineage.

Note: The sample data tables are named using Lorem Ipsum, so try searching one of those words.

Tests

To run all of the tests, run:

./gradlew test

To check the code's test coverage, run:

# To just generate a report
./gradlew reportScoverage

# To pass or fail based on coverage threshold (75%)
./gradlew checkScoverage

After running reportScoverage (and also checkScoverage if it passed), you can view the coverage report by opening a module's build/reports/scoverage/index.html file in a browser.

Contributing

If you'd like to contribute to Superglue, be sure to check out our contributing guidelines and feel free to open an issue or pull request!

superglue's People

Contributors

shashankviswanadha avatar dependabot[bot] avatar sambekar15 avatar levyforchh avatar gitter-badger avatar mend-for-github-com[bot] avatar

Watchers

James Cloos avatar

superglue's Issues

CVE-2019-17531 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-17531 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the apache-log4j-extra (version 1.2.x) jar in the classpath, and an attacker can provide a JNDI service to access, it is possible to make the service execute a malicious payload.

Publish Date: 2019-10-12

URL: CVE-2019-17531

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-17531

Release Date: 2019-10-12

Fix Resolution: 2.10

CVE-2019-14540 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-14540 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariConfig.

Publish Date: 2019-09-15

URL: CVE-2019-14540

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14540

Release Date: 2019-09-15

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.5,2.9.10,2.10.0.pr3,2.11.0.rc1

CVE-2018-11695 (High) detected in node-sass-v4.13.1

CVE-2018-11695 - High Severity Vulnerability

Vulnerable Library - node-sassv4.13.1

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Library Source Files (66)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

  • /superglue/frontend/node_modules/node-sass/src/sass_types/number.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/emitter.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/color.h
  • /superglue/frontend/node_modules/node-sass/src/sass_context_wrapper.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/parser.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/operation.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/bind.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/emitter.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/cssize.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/error_handling.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/factory.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/context.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/inspect.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/list.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/values.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/expand.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/util.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/parser.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/list.cpp
  • /superglue/frontend/node_modules/node-sass/src/custom_importer_bridge.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/to_value.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/operators.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/prelexer.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/boolean.h
  • /superglue/frontend/node_modules/node-sass/src/sass_types/null.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/eval.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/color.cpp
  • /superglue/frontend/node_modules/node-sass/src/custom_function_bridge.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/operators.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/to_value.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/functions.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/sass.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/to_c.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/output.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/constants.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/eval.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/extend.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/cssize.cpp
  • /superglue/frontend/node_modules/node-sass/src/callback_bridge.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/functions.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/expand.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/map.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_context_wrapper.cpp
  • /superglue/frontend/node_modules/node-sass/src/custom_importer_bridge.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/debugger.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/inspect.hpp
  • /superglue/frontend/node_modules/node-sass/src/binding.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/check_nesting.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/value.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/backtrace.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/util.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/boolean.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/check_nesting.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/file.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/error_handling.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/sass_values.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/sass_context.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/context.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/prelexer.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/constants.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/string.cpp

Vulnerability Details

An issue was discovered in LibSass through 3.5.2. A NULL pointer dereference was found in the function Sass::Expand::operator which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.

Publish Date: 2018-06-04

URL: CVE-2018-11695

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11695

Release Date: 2018-06-04

Fix Resolution: 3.6.0

CVE-2018-19362 (High) detected in jackson-databind-2.9.6.jar

CVE-2018-19362 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the jboss-common-core class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-19362

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19362

Release Date: 2019-01-02

Fix Resolution: 2.9.8

CVE-2018-19838 (Medium) detected in node-sass-4.14.0.tgz, node-sassv4.13.1

CVE-2018-19838 - Medium Severity Vulnerability

Vulnerable Libraries - node-sass-4.14.0.tgz, node-sassv4.13.1

node-sass-4.14.0.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.0.tgz

Path to dependency file: superglue/frontend/package.json

Path to vulnerable library: superglue/frontend/node_modules/node-sass/package.json

Dependency Hierarchy:

  • node-sass-4.14.0.tgz (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

In LibSass prior to 3.5.5, functions inside ast.cpp for IMPLEMENT_AST_OPERATORS expansion allow attackers to cause a denial-of-service resulting from stack consumption via a crafted sass file, as demonstrated by recursive calls involving clone(), cloneChildren(), and copy().

Publish Date: 2018-12-04

URL: CVE-2018-19838

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: sass/libsass#2660

Release Date: 2018-12-04

Fix Resolution: libsass - 3.6.1


  • Check this box to open an automated fix PR

CVE-2019-11358 (Medium) detected in jquery-1.12.4.min.js, jquery-2.1.4.min.js

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.12.4.min.js, jquery-2.1.4.min.js

jquery-1.12.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js

Path to dependency file: superglue/frontend/node_modules/vis-network/docs/network/physics.html

Path to vulnerable library: superglue/frontend/node_modules/vis-network/docs/network/physics.html

Dependency Hierarchy:

  • jquery-1.12.4.min.js (Vulnerable Library)
jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: superglue/frontend/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: superglue/frontend/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0

CVE-2012-0881 (High) detected in xercesImpl-2.11.0.jar

CVE-2012-0881 - High Severity Vulnerability

Vulnerable Library - xercesImpl-2.11.0.jar

Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.

The Apache Xerces2 parser is the reference implementation of XNI but other parser components, configurations, and parsers can be written using the Xerces Native Interface. For complete design and implementation documents, refer to the XNI Manual.

Xerces2 is a fully conforming XML Schema 1.0 processor. A partial experimental implementation of the XML Schema 1.1 Structures and Datatypes Working Drafts (December 2009) and an experimental implementation of the XML Schema Definition Language (XSD): Component Designators (SCD) Candidate Recommendation (January 2010) are provided for evaluation. For more information, refer to the XML Schema page.

Xerces2 also provides a complete implementation of the Document Object Model Level 3 Core and Load/Save W3C Recommendations and provides a complete implementation of the XML Inclusions (XInclude) W3C Recommendation. It also provides support for OASIS XML Catalogs v1.1.

Xerces2 is able to parse documents written according to the XML 1.1 Recommendation, except that it does not yet provide an option to enable normalization checking as described in section 2.13 of this specification. It also handles namespaces according to the XML Namespaces 1.1 Recommendation, and will correctly serialize XML 1.1 documents if the DOM level 3 load/save APIs are in use.</p>

Library home page: https://xerces.apache.org/xerces2-j/

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204521/xercesImpl-2.11.0.jar,/tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204521/xercesImpl-2.11.0.jar

Dependency Hierarchy:

  • scalatestplus-play_2.12-3.1.2.jar (Root Library)
    • selenium-java-3.5.3.jar
      • xercesImpl-2.11.0.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

Apache Xerces2 Java Parser before 2.12.0 allows remote attackers to cause a denial of service (CPU consumption) via a crafted message to an XML service, which triggers hash table collisions.

Publish Date: 2017-10-30

URL: CVE-2012-0881

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0881

Release Date: 2017-10-30

Fix Resolution: 2.12.0

CVE-2018-19826 (Medium) detected in node-sass-v4.13.1

CVE-2018-19826 - Medium Severity Vulnerability

Vulnerable Library - node-sassv4.13.1

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Library Source Files (66)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

  • /superglue/frontend/node_modules/node-sass/src/sass_types/number.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/emitter.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/color.h
  • /superglue/frontend/node_modules/node-sass/src/sass_context_wrapper.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/parser.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/operation.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/bind.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/emitter.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/cssize.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/error_handling.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/factory.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/context.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/inspect.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/list.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/values.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/expand.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/util.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/parser.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/list.cpp
  • /superglue/frontend/node_modules/node-sass/src/custom_importer_bridge.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/to_value.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/operators.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/prelexer.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/boolean.h
  • /superglue/frontend/node_modules/node-sass/src/sass_types/null.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/eval.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/color.cpp
  • /superglue/frontend/node_modules/node-sass/src/custom_function_bridge.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/operators.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/to_value.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/functions.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/sass.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/to_c.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/output.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/constants.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/eval.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/extend.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/cssize.cpp
  • /superglue/frontend/node_modules/node-sass/src/callback_bridge.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/functions.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/expand.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/map.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_context_wrapper.cpp
  • /superglue/frontend/node_modules/node-sass/src/custom_importer_bridge.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/debugger.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/inspect.hpp
  • /superglue/frontend/node_modules/node-sass/src/binding.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/check_nesting.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/value.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/backtrace.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/util.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/boolean.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/check_nesting.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/file.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/error_handling.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/sass_values.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/sass_context.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/context.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/prelexer.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/constants.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/string.cpp

Vulnerability Details

** DISPUTED ** In inspect.cpp in LibSass 3.5.5, a high memory footprint caused by an endless loop (containing a Sass::Inspect::operator()(Sass::String_Quoted*) stack frame) may cause a Denial of Service via crafted sass input files with stray '&' or '/' characters. NOTE: Upstream comments indicate this issue is closed as "won't fix" and "works as intended" by design.

Publish Date: 2018-12-03

URL: CVE-2018-19826

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Change files

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19826

Release Date: 2019-09-01

Fix Resolution: Replace or update the following file: LibSass - 3.6.0

CVE-2018-14719 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2018-14719 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the blaze-ds-opt and blaze-ds-core classes from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-14719

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14719

Release Date: 2019-01-02

Fix Resolution: 2.9.7

CVE-2019-12086 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-12086 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.

Publish Date: 2019-05-17

URL: CVE-2019-12086

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12086

Release Date: 2019-05-17

Fix Resolution: 2.9.9

CVE-2018-19797 (Medium) detected in node-sass-4.14.0.tgz, CSS::Sassv3.6.0

CVE-2018-19797 - Medium Severity Vulnerability

Vulnerable Libraries - node-sass-4.14.0.tgz, CSS::Sassv3.6.0

node-sass-4.14.0.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.0.tgz

Path to dependency file: superglue/frontend/package.json

Path to vulnerable library: superglue/frontend/node_modules/node-sass/package.json

Dependency Hierarchy:

  • node-sass-4.14.0.tgz (Vulnerable Library)

Vulnerability Details

In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.

Publish Date: 2018-12-03

URL: CVE-2018-19797

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19797

Release Date: 2018-12-03

Fix Resolution: libsass-3.6.0


  • Check this box to open an automated fix PR

CVE-2019-17267 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-17267 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to net.sf.ehcache.hibernate.EhcacheJtaTransactionManagerLookup.

Publish Date: 2019-10-07

URL: CVE-2019-17267

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2460

Release Date: 2019-10-07

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.5,2.9.10

CVE-2019-12814 (Medium) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-12814 - Medium Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.

Publish Date: 2019-06-19

URL: CVE-2019-12814

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2341

Release Date: 2019-06-19

Fix Resolution: 2.7.9.6, 2.8.11.4, 2.9.9.1, 2.10.0

CVE-2019-14439 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-14439 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9.2. This occurs when Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the logback jar in the classpath.

Publish Date: 2019-07-30

URL: CVE-2019-14439

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14439

Release Date: 2019-07-30

Fix Resolution: 2.9.9.2

CVE-2018-11697 (High) detected in node-sassv4.13.1, CSS::Sassv3.6.0

CVE-2018-11697 - High Severity Vulnerability

Vulnerable Libraries - node-sassv4.13.1, CSS::Sassv3.6.0

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::exactly() which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.

Publish Date: 2018-06-04

URL: CVE-2018-11697

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11697

Release Date: 2019-09-01

Fix Resolution: LibSass - 3.6.0

CVE-2018-5968 (High) detected in jackson-databind-2.9.6.jar

CVE-2018-5968 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: /tmp/ws-scm/superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

FasterXML jackson-databind through 2.8.11 and 2.9.x through 2.9.3 allows unauthenticated remote code execution because of an incomplete fix for the CVE-2017-7525 and CVE-2017-17485 deserialization flaws. This is exploitable via two different gadgets that bypass a blacklist.

Publish Date: 2018-01-22

URL: CVE-2018-5968

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-5968

Release Date: 2018-01-22

Fix Resolution: 2.8.11.1, 2.9.4

CVE-2018-11499 (High) detected in node-sassv4.13.1

CVE-2018-11499 - High Severity Vulnerability

Vulnerable Library - node-sassv4.13.1

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerable Source Files (1)

cpp

Vulnerability Details

A use-after-free vulnerability exists in handle_error() in sass_context.cpp in LibSass 3.4.x and 3.5.x through 3.5.4 that could be leveraged to cause a denial of service (application crash) or possibly unspecified other impact.

Publish Date: 2018-05-26

URL: CVE-2018-11499

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11499

Release Date: 2018-05-26

Fix Resolution: LibSass - 3.6.0

CVE-2019-20330 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-20330 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.10.2 lacks certain net.sf.ehcache blocking.

Publish Date: 2020-01-03

URL: CVE-2019-20330

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2526

Release Date: 2020-01-03

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.7.9.7,2.8.11.5,2.9.10.2

CVE-2019-16943 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-16943 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the p6spy (3.8.6) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of com.p6spy.engine.spy.P6DataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16943

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16943

Release Date: 2019-10-01

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.6.7.3,2.7.9.7,2.8.11.5,2.9.10.1

CVE-2018-10237 (Medium) detected in guava-23.6.1-jre.jar, guava-19.0.jar

CVE-2018-10237 - Medium Severity Vulnerability

Vulnerable Libraries - guava-23.6.1-jre.jar, guava-19.0.jar

guava-23.6.1-jre.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Library home page: https://github.com/google/guava

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/23.6.1-jre/c18ab06b4b7646be581211ad59be1b6e1ea4c278/guava-23.6.1-jre.jar,/root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/23.6.1-jre/c18ab06b4b7646be581211ad59be1b6e1ea4c278/guava-23.6.1-jre.jar

Dependency Hierarchy:

  • jimfs-1.1.jar (Root Library)
    • guava-23.6.1-jre.jar (Vulnerable Library)
guava-19.0.jar

Guava is a suite of core and expanded libraries that include utility classes, google's collections, io classes, and much much more.

Guava has only one code dependency - javax.annotation,
per the JSR-305 spec.</p>

Library home page: https://github.com/google/guava

Path to dependency file: superglue/parser/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/19.0/6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9/guava-19.0.jar,/root/.gradle/caches/modules-2/files-2.1/com.google.guava/guava/19.0/6ce200f6b23222af3d8abb6b6459e6c44f4bb0e9/guava-19.0.jar

Dependency Hierarchy:

  • jimfs-1.1.jar (Root Library)
    • guava-19.0.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

Unbounded memory allocation in Google Guava 11.0 through 24.x before 24.1.1 allows remote attackers to conduct denial of service attacks against servers that depend on this library and deserialize attacker-provided data, because the AtomicDoubleArray class (when serialized with Java serialization) and the CompoundOrdering class (when serialized with GWT serialization) perform eager allocation without appropriate checks on what a client has sent and whether the data size is reasonable.

Publish Date: 2018-04-26

URL: CVE-2018-10237

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-10237

Release Date: 2018-04-26

Fix Resolution: 24.1.1-jre, 24.1.1-android

CVE-2019-12384 (Medium) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-12384 - Medium Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.9.1 might allow attackers to have a variety of impacts by leveraging failure to block the logback-core class from polymorphic deserialization. Depending on the classpath content, remote code execution may be possible.

Publish Date: 2019-06-24

URL: CVE-2019-12384

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12384

Release Date: 2019-06-24

Fix Resolution: 2.9.9.1

CVE-2018-12536 (Medium) detected in jetty-util-9.4.5.v20170502.jar

CVE-2018-12536 - Medium Severity Vulnerability

Vulnerable Library - jetty-util-9.4.5.v20170502.jar

Utility classes for Jetty

Library home page: http://www.eclipse.org/jetty

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204521/jetty-util-9.4.5.v20170502.jar,/tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204521/jetty-util-9.4.5.v20170502.jar

Dependency Hierarchy:

  • scalatestplus-play_2.12-3.1.2.jar (Root Library)
    • selenium-java-3.5.3.jar
      • jetty-util-9.4.5.v20170502.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.

Publish Date: 2018-06-27

URL: CVE-2018-12536

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jetty/jetty.project@ad4dceb

Release Date: 2018-06-27

Fix Resolution: org.eclipse.jetty:jetty-server:9.3.24.v20180605,9.4.11.v20180605,org.eclipse.jetty:jetty-util:9.3.24.v20180605,9.4.11.v20180605,org.eclipse.jetty:jetty-servlet:9.3.24.v20180605,9.4.11.v20180605

CVE-2017-7657 (High) detected in jetty-http-9.4.5.v20170502.jar

CVE-2017-7657 - High Severity Vulnerability

Vulnerable Library - jetty-http-9.4.5.v20170502.jar

The Eclipse Jetty Project

Library home page: http://www.eclipse.org/jetty

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204522/jetty-http-9.4.5.v20170502.jar,/tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204522/jetty-http-9.4.5.v20170502.jar

Dependency Hierarchy:

  • scalatestplus-play_2.12-3.1.2.jar (Root Library)
    • selenium-java-3.5.3.jar
      • jetty-http-9.4.5.v20170502.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.

Publish Date: 2018-06-26

URL: CVE-2017-7657

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugs.eclipse.org/bugs/show_bug.cgi?id=535668

Release Date: 2018-06-26

Fix Resolution: org.eclipse.jetty:jetty-server:9.3.24.v20180605,9.4.11.v20180605;org.eclipse.jetty:jetty-http:9.3.24.v20180605,9.4.11.v20180605

CVE-2012-6708 (Medium) detected in jquery-1.7.1.min.js

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: superglue/frontend/node_modules/sockjs/examples/echo/index.html

Path to vulnerable library: superglue/frontend/node_modules/sockjs/examples/echo/index.html,superglue/frontend/node_modules/sockjs/examples/multiplex/index.html,superglue/frontend/node_modules/sockjs/examples/hapi/html/index.html,superglue/frontend/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

WS-2017-3734 (Medium) detected in httpclient-4.5.2.jar

WS-2017-3734 - Medium Severity Vulnerability

Vulnerable Library - httpclient-4.5.2.jar

Apache HttpComponents Client

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.5.2/733db77aa8d9b2d68015189df76ab06304406e50/httpclient-4.5.2.jar,/root/.gradle/caches/modules-2/files-2.1/org.apache.httpcomponents/httpclient/4.5.2/733db77aa8d9b2d68015189df76ab06304406e50/httpclient-4.5.2.jar

Dependency Hierarchy:

  • elastic4s-http_2.12-6.5.1.jar (Root Library)
    • elasticsearch-rest-client-6.5.2.jar
      • httpclient-4.5.2.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

Apache httpclient before 4.5.3 are vulnerable to Directory Traversal. The user-provided path was able to override the specified host, resulting in giving network access to a sensitive environment.

Publish Date: 2017-01-21

URL: WS-2017-3734

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://issues.apache.org/jira/browse/HTTPCLIENT-1803

Release Date: 2017-01-21

Fix Resolution: org.apache.httpcomponents:httpclient:4.5.3

WS-2018-0347 (Medium) detected in eslint-2.13.1.tgz

WS-2018-0347 - Medium Severity Vulnerability

Vulnerable Library - eslint-2.13.1.tgz

An AST-based pattern checker for JavaScript.

Library home page: https://registry.npmjs.org/eslint/-/eslint-2.13.1.tgz

Path to dependency file: superglue/frontend/package.json

Path to vulnerable library: superglue/frontend/node_modules/sass-lint/node_modules/eslint/package.json

Dependency Hierarchy:

  • sass-lint-1.13.1.tgz (Root Library)
    • eslint-2.13.1.tgz (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

A vulnerability was descovered in eslint before 4.18.2. One of the regexes in eslint is vulnerable to catastrophic backtracking.

Publish Date: 2018-02-27

URL: WS-2018-0347

CVSS 3 Score Details (4.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: eslint/eslint#10002

Release Date: 2019-06-16

Fix Resolution: 4.18.2

CVE-2017-7658 (High) detected in jetty-http-9.4.5.v20170502.jar

CVE-2017-7658 - High Severity Vulnerability

Vulnerable Library - jetty-http-9.4.5.v20170502.jar

The Eclipse Jetty Project

Library home page: http://www.eclipse.org/jetty

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204522/jetty-http-9.4.5.v20170502.jar,/tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204522/jetty-http-9.4.5.v20170502.jar

Dependency Hierarchy:

  • scalatestplus-play_2.12-3.1.2.jar (Root Library)
    • selenium-java-3.5.3.jar
      • jetty-http-9.4.5.v20170502.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Publish Date: 2018-06-26

URL: CVE-2017-7658

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-7658

Release Date: 2018-06-26

Fix Resolution: org.eclipse.jetty:jetty-server:9.4.11.v20180605,9.3.24.v20180605,9.2.25.v20180606;org.eclipse.jetty.aggregate:jetty-client:9.4.11.v20180605,9.3.24.v20180605,9.2.25.v20180606;org.eclipse.jetty:jetty-http:9.4.11.v20180605,9.3.24.v20180605,9.2.25.v20180606

CVE-2018-11698 (High) detected in node-sass-4.14.0.tgz, node-sassv4.13.1

CVE-2018-11698 - High Severity Vulnerability

Vulnerable Libraries - node-sass-4.14.0.tgz, node-sassv4.13.1

node-sass-4.14.0.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.0.tgz

Path to dependency file: superglue/frontend/package.json

Path to vulnerable library: superglue/frontend/node_modules/node-sass/package.json

Dependency Hierarchy:

  • node-sass-4.14.0.tgz (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::handle_error which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.

Publish Date: 2018-06-04

URL: CVE-2018-11698

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-11698

Release Date: 2018-06-04

Fix Resolution: Libsass-3.6.0


  • Check this box to open an automated fix PR

CVE-2019-16335 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-16335 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind before 2.9.10. It is related to com.zaxxer.hikari.HikariDataSource. This is a different vulnerability than CVE-2019-14540.

Publish Date: 2019-09-15

URL: CVE-2019-16335

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/FasterXML/jackson-databind/blob/master/release-notes/VERSION-2.x

Release Date: 2020-10-20

Fix Resolution: 2.9.10

CVE-2018-20821 (Medium) detected in node-sass-4.14.0.tgz, node-sassv4.13.1

CVE-2018-20821 - Medium Severity Vulnerability

Vulnerable Libraries - node-sass-4.14.0.tgz, node-sassv4.13.1

node-sass-4.14.0.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.0.tgz

Path to dependency file: superglue/frontend/package.json

Path to vulnerable library: superglue/frontend/node_modules/node-sass/package.json

Dependency Hierarchy:

  • node-sass-4.14.0.tgz (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

The parsing component in LibSass through 3.5.5 allows attackers to cause a denial-of-service (uncontrolled recursion in Sass::Parser::parse_css_variable_value in parser.cpp).

Publish Date: 2019-04-23

URL: CVE-2018-20821

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20821

Release Date: 2019-04-23

Fix Resolution: LibSass - 3.6.0


  • Check this box to open an automated fix PR

CVE-2020-8116 (High) detected in dot-prop-4.2.0.tgz

CVE-2020-8116 - High Severity Vulnerability

Vulnerable Library - dot-prop-4.2.0.tgz

Get, set, or delete a property from a nested object using a dot path

Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz

Path to dependency file: superglue/frontend/package.json

Path to vulnerable library: superglue/frontend/node_modules/dot-prop/package.json

Dependency Hierarchy:

  • webpack-command-0.4.2.tgz (Root Library)
    • update-notifier-2.5.0.tgz
      • configstore-3.1.2.tgz
        • dot-prop-4.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Publish Date: 2020-02-04

URL: CVE-2020-8116

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116

Release Date: 2020-02-04

Fix Resolution: dot-prop - 5.1.1

CVE-2015-9251 (Medium) detected in multiple libraries

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.7.1.min.js, jquery-1.12.4.min.js, jquery-2.1.4.min.js

jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: superglue/frontend/node_modules/sockjs/examples/echo/index.html

Path to vulnerable library: superglue/frontend/node_modules/sockjs/examples/echo/index.html,superglue/frontend/node_modules/sockjs/examples/multiplex/index.html,superglue/frontend/node_modules/sockjs/examples/hapi/html/index.html,superglue/frontend/node_modules/sockjs/examples/express-3.x/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)
jquery-1.12.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js

Path to dependency file: superglue/frontend/node_modules/vis-network/docs/network/physics.html

Path to vulnerable library: superglue/frontend/node_modules/vis-network/docs/network/physics.html

Dependency Hierarchy:

  • jquery-1.12.4.min.js (Vulnerable Library)
jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: superglue/frontend/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: superglue/frontend/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

CVE-2018-11694 (High) detected in node-sass-4.14.0.tgz, node-sassv4.13.1

CVE-2018-11694 - High Severity Vulnerability

Vulnerable Libraries - node-sass-4.14.0.tgz, node-sassv4.13.1

node-sass-4.14.0.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.0.tgz

Path to dependency file: superglue/frontend/package.json

Path to vulnerable library: superglue/frontend/node_modules/node-sass/package.json

Dependency Hierarchy:

  • node-sass-4.14.0.tgz (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. A NULL pointer dereference was found in the function Sass::Functions::selector_append which could be leveraged by an attacker to cause a denial of service (application crash) or possibly have unspecified other impact.

Publish Date: 2018-06-04

URL: CVE-2018-11694

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11694

Release Date: 2018-06-04

Fix Resolution: LibSass - 3.6.0


  • Check this box to open an automated fix PR

CVE-2018-14718 (High) detected in jackson-databind-2.9.6.jar

CVE-2018-14718 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to execute arbitrary code by leveraging failure to block the slf4j-ext class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-14718

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14718

Release Date: 2019-01-02

Fix Resolution: 2.9.7

CVE-2019-16942 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-16942 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.0.0 through 2.9.10. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has the commons-dbcp (1.4) jar in the classpath, and an attacker can find an RMI service endpoint to access, it is possible to make the service execute a malicious payload. This issue exists because of org.apache.commons.dbcp.datasources.SharedPoolDataSource and org.apache.commons.dbcp.datasources.PerUserPoolDataSource mishandling.

Publish Date: 2019-10-01

URL: CVE-2019-16942

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16942

Release Date: 2019-10-01

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.6.7.3,2.7.9.7,2.8.11.5,2.9.10.1

CVE-2019-16769 (Medium) detected in serialize-javascript-1.9.1.tgz

CVE-2019-16769 - Medium Severity Vulnerability

Vulnerable Library - serialize-javascript-1.9.1.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.9.1.tgz

Path to dependency file: superglue/frontend/package.json

Path to vulnerable library: superglue/frontend/node_modules/uglifyjs-webpack-plugin/node_modules/serialize-javascript/package.json

Dependency Hierarchy:

  • uglifyjs-webpack-plugin-2.2.0.tgz (Root Library)
    • serialize-javascript-1.9.1.tgz (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

Publish Date: 2019-12-05

URL: CVE-2019-16769

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16769

Release Date: 2019-12-05

Fix Resolution: v2.1.1

CVE-2018-20190 (Medium) detected in node-sass-4.14.0.tgz, node-sassv4.13.1

CVE-2018-20190 - Medium Severity Vulnerability

Vulnerable Libraries - node-sass-4.14.0.tgz, node-sassv4.13.1

node-sass-4.14.0.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.0.tgz

Path to dependency file: superglue/frontend/package.json

Path to vulnerable library: superglue/frontend/node_modules/node-sass/package.json

Dependency Hierarchy:

  • node-sass-4.14.0.tgz (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Eval::operator()(Sass::Supports_Operator*) in eval.cpp may cause a Denial of Service (application crash) via a crafted sass input file.

Publish Date: 2018-12-17

URL: CVE-2018-20190

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20190

Release Date: 2018-12-17

Fix Resolution: LibSass - 3.6.0


  • Check this box to open an automated fix PR

CVE-2017-9735 (High) detected in jetty-util-9.4.5.v20170502.jar

CVE-2017-9735 - High Severity Vulnerability

Vulnerable Library - jetty-util-9.4.5.v20170502.jar

Utility classes for Jetty

Library home page: http://www.eclipse.org/jetty

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204521/jetty-util-9.4.5.v20170502.jar,/tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204521/jetty-util-9.4.5.v20170502.jar

Dependency Hierarchy:

  • scalatestplus-play_2.12-3.1.2.jar (Root Library)
    • selenium-java-3.5.3.jar
      • jetty-util-9.4.5.v20170502.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

Publish Date: 2017-06-16

URL: CVE-2017-9735

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-5784

Release Date: 2017-06-16

Fix Resolution: 9.4.7.RC0

CVE-2018-1000873 (Medium) detected in jackson-datatype-jsr310-2.8.11.jar

CVE-2018-1000873 - Medium Severity Vulnerability

Vulnerable Library - jackson-datatype-jsr310-2.8.11.jar

Add-on module to support JSR-310 (Java 8 Date & Time API) data types.

Library home page: https://github.com/FasterXML/jackson-modules-java8/

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.datatype/jackson-datatype-jsr310/2.8.11/6d8fbd79634b348d1f1ab99a13da28a5717049e6/jackson-datatype-jsr310-2.8.11.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.datatype/jackson-datatype-jsr310/2.8.11/6d8fbd79634b348d1f1ab99a13da28a5717049e6/jackson-datatype-jsr310-2.8.11.jar

Dependency Hierarchy:

  • play-json_2.12-2.6.10.jar (Root Library)
    • jackson-datatype-jsr310-2.8.11.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

Fasterxml Jackson version Before 2.9.8 contains a CWE-20: Improper Input Validation vulnerability in Jackson-Modules-Java8 that can result in Causes a denial-of-service (DoS). This attack appear to be exploitable via The victim deserializes malicious input, specifically very large values in the nanoseconds field of a time value. This vulnerability appears to have been fixed in 2.9.8.

Publish Date: 2018-12-20

URL: CVE-2018-1000873

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1665601

Fix Resolution: Upgrade to version jackson-modules-java8 2.9.8 or greater

CVE-2018-19361 (High) detected in jackson-databind-2.9.6.jar

CVE-2018-19361 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the openjpa class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-19361

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19361

Release Date: 2019-01-02

Fix Resolution: 2.9.8

CVE-2020-8840 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2020-8840 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

FasterXML jackson-databind 2.0.0 through 2.9.10.2 lacks certain xbean-reflect/JNDI blocking, as demonstrated by org.apache.xbean.propertyeditor.JndiConverter.

Publish Date: 2020-02-10

URL: CVE-2020-8840

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: FasterXML/jackson-databind#2620

Release Date: 2020-02-10

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.10.3

CVE-2018-19827 (High) detected in multiple libraries

CVE-2018-19827 - High Severity Vulnerability

Vulnerable Libraries - node-sass-4.14.0.tgz, node-sassv4.13.1, CSS::Sassv3.6.0

node-sass-4.14.0.tgz

Wrapper around libsass

Library home page: https://registry.npmjs.org/node-sass/-/node-sass-4.14.0.tgz

Path to dependency file: superglue/frontend/package.json

Path to vulnerable library: superglue/frontend/node_modules/node-sass/package.json

Dependency Hierarchy:

  • node-sass-4.14.0.tgz (Vulnerable Library)

Vulnerability Details

In LibSass 3.5.5, a use-after-free vulnerability exists in the SharedPtr class in SharedPtr.cpp (or SharedPtr.hpp) that may cause a denial of service (application crash) or possibly have unspecified other impact.

Publish Date: 2018-12-03

URL: CVE-2018-19827

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: sass/libsass#2784

Release Date: 2019-08-29

Fix Resolution: LibSass - 3.6.0


  • Check this box to open an automated fix PR

CVE-2019-14379 (High) detected in jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

CVE-2019-14379 - High Severity Vulnerability

Vulnerable Libraries - jackson-databind-2.9.6.jar, jackson-databind-2.8.11.3.jar

jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)
jackson-databind-2.8.11.3.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.8.11.3/844df5aba5a1a56e00905b165b12bb34116ee858/jackson-databind-2.8.11.3.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.8.11.3.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

SubTypeValidator.java in FasterXML jackson-databind before 2.9.9.2 mishandles default typing when ehcache is used (because of net.sf.ehcache.transaction.manager.DefaultTransactionManagerLookup), leading to remote code execution.

Publish Date: 2019-07-29

URL: CVE-2019-14379

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14379

Release Date: 2019-07-29

Fix Resolution: 2.9.9.2

CVE-2018-14721 (High) detected in jackson-databind-2.9.6.jar

CVE-2018-14721 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.7 might allow remote attackers to conduct server-side request forgery (SSRF) attacks by leveraging failure to block the axis2-jaxws class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-14721

CVSS 3 Score Details (10.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-14721

Release Date: 2019-01-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.9.7,2.8.11.3,2.7.9.5,2.6.7.3

WS-2016-0090 (Medium) detected in multiple libraries

WS-2016-0090 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.7.1.min.js, jquery-1.12.4.min.js, jquery-2.1.4.min.js

jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: /tmp/ws-scm/superglue/frontend/node_modules/sockjs/examples/express-3.x/index.html

Path to vulnerable library: /superglue/frontend/node_modules/sockjs/examples/express-3.x/index.html,/superglue/frontend/node_modules/sockjs/examples/multiplex/index.html,/superglue/frontend/node_modules/sockjs/examples/echo/index.html,/superglue/frontend/node_modules/sockjs/examples/hapi/html/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)
jquery-1.12.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.12.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/superglue/frontend/node_modules/vis-network/docs/network/physics.html

Path to vulnerable library: /superglue/frontend/node_modules/vis-network/docs/network/physics.html

Dependency Hierarchy:

  • jquery-1.12.4.min.js (Vulnerable Library)
jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: /tmp/ws-scm/superglue/frontend/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: /superglue/frontend/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

JQuery, before 2.2.0, is vulnerable to Cross-site Scripting (XSS) attacks via text/javascript response with arbitrary code execution.

Publish Date: 2016-11-27

URL: WS-2016-0090

CVSS 2 Score Details (4.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jquery/jquery@b078a62

Release Date: 2019-04-08

Fix Resolution: 2.2.0

CVE-2018-11693 (High) detected in node-sass-v4.13.1

CVE-2018-11693 - High Severity Vulnerability

Vulnerable Library - node-sassv4.13.1

🌈 Node.js bindings to libsass

Library home page: https://github.com/sass/node-sass.git

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Library Source Files (66)

* The source files were matched to this source library based on a best effort match. Source libraries are selected from a list of probable public libraries.

  • /superglue/frontend/node_modules/node-sass/src/sass_types/number.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/emitter.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/color.h
  • /superglue/frontend/node_modules/node-sass/src/sass_context_wrapper.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/parser.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/operation.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/bind.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/emitter.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/cssize.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/error_handling.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/factory.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/context.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/inspect.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/list.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/values.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/expand.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/util.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/parser.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/list.cpp
  • /superglue/frontend/node_modules/node-sass/src/custom_importer_bridge.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/to_value.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/operators.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/prelexer.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/boolean.h
  • /superglue/frontend/node_modules/node-sass/src/sass_types/null.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/eval.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/color.cpp
  • /superglue/frontend/node_modules/node-sass/src/custom_function_bridge.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/operators.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/to_value.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/functions.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/sass.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/to_c.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/output.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/constants.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/eval.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/extend.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast_def_macros.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/cssize.cpp
  • /superglue/frontend/node_modules/node-sass/src/callback_bridge.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/functions.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/expand.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/map.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_context_wrapper.cpp
  • /superglue/frontend/node_modules/node-sass/src/custom_importer_bridge.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/debugger.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/inspect.hpp
  • /superglue/frontend/node_modules/node-sass/src/binding.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/ast_fwd_decl.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/check_nesting.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/value.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/backtrace.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/util.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/boolean.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/check_nesting.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/file.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/error_handling.hpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/sass_value_wrapper.h
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/sass_values.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/sass_context.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/context.hpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/prelexer.cpp
  • /superglue/frontend/node_modules/node-sass/src/libsass/src/constants.cpp
  • /superglue/frontend/node_modules/node-sass/src/sass_types/string.cpp

Vulnerability Details

An issue was discovered in LibSass through 3.5.4. An out-of-bounds read of a memory region was found in the function Sass::Prelexer::skip_over_scopes which could be leveraged by an attacker to disclose information or manipulated to read from unmapped memory causing a denial of service.

Publish Date: 2018-06-04

URL: CVE-2018-11693

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-11693

Release Date: 2018-06-04

Fix Resolution: LibSass - 3.5.5

CVE-2017-18640 (High) detected in snakeyaml-1.18.jar

CVE-2017-18640 - High Severity Vulnerability

Vulnerable Library - snakeyaml-1.18.jar

YAML 1.1 parser and emitter for Java

Library home page: http://www.snakeyaml.org

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.18/e4a441249ade301985cb8d009d4e4a72b85bf68e/snakeyaml-1.18.jar,/root/.gradle/caches/modules-2/files-2.1/org.yaml/snakeyaml/1.18/e4a441249ade301985cb8d009d4e4a72b85bf68e/snakeyaml-1.18.jar

Dependency Hierarchy:

  • calcite-core-1.18.0.jar (Root Library)
    • jackson-dataformat-yaml-2.9.6.jar
      • snakeyaml-1.18.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

The Alias feature in SnakeYAML 1.18 allows entity expansion during a load operation, a related issue to CVE-2003-1564.

Publish Date: 2019-12-12

URL: CVE-2017-18640

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-18640

Release Date: 2019-12-12

Fix Resolution: org.yaml:snakeyaml:1.26

CVE-2018-14720 (High) detected in jackson-databind-2.9.6.jar

CVE-2018-14720 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.7 might allow attackers to conduct external XML entity (XXE) attacks by leveraging failure to block unspecified JDK classes from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-14720

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14720

Release Date: 2019-01-02

Fix Resolution: 2.9.7

CVE-2018-19360 (High) detected in jackson-databind-2.9.6.jar

CVE-2018-19360 - High Severity Vulnerability

Vulnerable Library - jackson-databind-2.9.6.jar

General data-binding functionality for Jackson: works on core streaming API

Library home page: http://github.com/FasterXML/jackson

Path to dependency file: superglue/cli/build.gradle

Path to vulnerable library: /root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar,/root/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.6/cfa4f316351a91bfd95cb0644c6a2c95f52db1fc/jackson-databind-2.9.6.jar

Dependency Hierarchy:

  • logstash-logback-encoder-4.11.jar (Root Library)
    • jackson-databind-2.9.6.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

FasterXML jackson-databind 2.x before 2.9.8 might allow attackers to have unspecified impact by leveraging failure to block the axis2-transport-jms class from polymorphic deserialization.

Publish Date: 2019-01-02

URL: CVE-2018-19360

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19360

Release Date: 2019-01-02

Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.7.9.5,2.8.11.3,2.9.8,2.10.0.pr1

CVE-2013-4002 (High) detected in xercesImpl-2.11.0.jar

CVE-2013-4002 - High Severity Vulnerability

Vulnerable Library - xercesImpl-2.11.0.jar

Xerces2 is the next generation of high performance, fully compliant XML parsers in the Apache Xerces family. This new version of Xerces introduces the Xerces Native Interface (XNI), a complete framework for building parser components and configurations that is extremely modular and easy to program.

The Apache Xerces2 parser is the reference implementation of XNI but other parser components, configurations, and parsers can be written using the Xerces Native Interface. For complete design and implementation documents, refer to the XNI Manual.

Xerces2 is a fully conforming XML Schema 1.0 processor. A partial experimental implementation of the XML Schema 1.1 Structures and Datatypes Working Drafts (December 2009) and an experimental implementation of the XML Schema Definition Language (XSD): Component Designators (SCD) Candidate Recommendation (January 2010) are provided for evaluation. For more information, refer to the XML Schema page.

Xerces2 also provides a complete implementation of the Document Object Model Level 3 Core and Load/Save W3C Recommendations and provides a complete implementation of the XML Inclusions (XInclude) W3C Recommendation. It also provides support for OASIS XML Catalogs v1.1.

Xerces2 is able to parse documents written according to the XML 1.1 Recommendation, except that it does not yet provide an option to enable normalization checking as described in section 2.13 of this specification. It also handles namespaces according to the XML Namespaces 1.1 Recommendation, and will correctly serialize XML 1.1 documents if the DOM level 3 load/save APIs are in use.</p>

Library home page: https://xerces.apache.org/xerces2-j/

Path to dependency file: superglue/api/build.gradle

Path to vulnerable library: /tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204521/xercesImpl-2.11.0.jar,/tmp/ws-ua_20200424203945/downloadResource_4b8df0d7-6a8c-4c14-9fc3-517987ee2474/20200424204521/xercesImpl-2.11.0.jar

Dependency Hierarchy:

  • scalatestplus-play_2.12-3.1.2.jar (Root Library)
    • selenium-java-3.5.3.jar
      • xercesImpl-2.11.0.jar (Vulnerable Library)

Found in HEAD commit: 7a708af56446441da5694d317b0cc0de8ad0141b

Vulnerability Details

XMLscanner.java in Apache Xerces2 Java Parser before 2.12.0, as used in the Java Runtime Environment (JRE) in IBM Java 5.0 before 5.0 SR16-FP3, 6 before 6 SR14, 6.0.1 before 6.0.1 SR6, and 7 before 7 SR5 as well as Oracle Java SE 7u40 and earlier, Java SE 6u60 and earlier, Java SE 5.0u51 and earlier, JRockit R28.2.8 and earlier, JRockit R27.7.6 and earlier, Java SE Embedded 7u40 and earlier, and possibly other products allows remote attackers to cause a denial of service via vectors related to XML attribute names.

Publish Date: 2013-07-23

URL: CVE-2013-4002

CVSS 2 Score Details (7.1)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4002

Release Date: 2013-07-23

Fix Resolution: xerces:xercesImpl:Xerces-J_2_12_0

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.