Coder Social home page Coder Social logo

levyforchh / testplan Goto Github PK

View Code? Open in Web Editor NEW

This project forked from morganstanley/testplan

0.0 1.0 0.0 3.11 MB

Testplan, a multi-testing framework, because unit tests can only go so far..

Home Page: http://testplan.readthedocs.io

License: Apache License 2.0

Python 89.15% Shell 0.14% HTML 0.05% JavaScript 10.51% CSS 0.01% CMake 0.03% C++ 0.11%

testplan's Introduction

ReadTheDocs TravisCI

https://github.com/Morgan-Stanley/testplan/blob/master/doc/images/logo/testplan.png

a multi-testing framework

..because unit tests can only go so far..

Testplan is a Python package that can start a local live environment, setup mocks, connections to services and run tests against these. It provides:

  • MultiTest a feature extensive functional testing system with a rich set of assertions and report rendering logic.
  • Built-in inheritable drivers to create a local live environment.
  • Configurable, diverse and expandable test execution mechanism including parallel execution capability.
  • Test tagging for flexible filtering and selective execution as well as generation of multiple reports (for each tag combination).
  • Integration with other unit testing frameworks (like GTest).
  • Rich, unified reports (json/PDF/XML) and soon (HTML/UI).

Basic example

This is how a very basic Testplan application looks like.

import sys

from testplan import test_plan
from testplan.testing.multitest import MultiTest, testcase, testsuite

def multiply(numA, numB):
    return numA * numB


@testsuite
class BasicSuite(object):

    @testcase
    def basic_multiply(self, env, result):
        result.equal(multiply(2, 3), 6, description='Passing assertion')
        result.equal(multiply(2, 2), 5, description='Failing assertion')


@test_plan(name='Multiply')
def main(plan):
    test = MultiTest(name='MultiplyTest',
                     suites=[BasicSuite()])
    plan.add(test)


if __name__ == '__main__':
  sys.exit(not main())

Example execution:

$ python ./test_plan.py -v
        Passing assertion - Pass
          6 == 6
        Failing assertion - Fail
          File: .../test_plan.py
          Line: 18
          4 == 5
      [basic_multiply] -> Fail
    [BasicSuite] -> Fail
  [MultiplyTest] -> Fail
[Multiply] -> Fail

System integration testing example

Testing a server and a client communication.

import sys

from testplan import test_plan
from testplan.testing.multitest import MultiTest, testsuite, testcase
from testplan.testing.multitest.driver.tcp import TCPServer, TCPClient
from testplan.common.utils.context import context


@testsuite
class TCPTestsuite(object):
    """Testsuite for server client connection testcases."""

    def setup(self, env):
        env.server.accept_connection()

    @testcase
    def send_and_receive_msg(self, env, result):
        """Basic send and receive hello message testcase."""
        msg = env.client.cfg.name
        result.log('Client is sending his name: {}'.format(msg))
        bytes_sent = env.client.send_text(msg)

        received = env.server.receive_text(size=bytes_sent)
        result.equal(received, msg, 'Server received client name')

        response = 'Hello {}'.format(received)
        result.log('Server is responding: {}'.format(response))
        bytes_sent = env.server.send_text(response)

        received = env.client.receive_text(size=bytes_sent)
        result.equal(received, response, 'Client received response')


@test_plan(name='TCPConnections')
def main(plan):
    test = MultiTest(name='TCPConnectionsTest',
                     suites=[TCPTestsuite()],
                     environment=[
                         TCPServer(name='server'),
                         TCPClient(name='client',
                                   host=context('server', '{{host}}'),
                                   port=context('server', '{{port}}'))])
    plan.add(test)


if __name__ == '__main__':
    sys.exit(not main())

Example execution:

$ python ./test_plan.py -v
        Client is sending: client
        Server received - Pass
          client == client
        Server is responding: Hello client
        Client received - Pass
          Hello client == Hello client
      [send_and_receive_msg] -> Pass
    [TCPTestsuite] -> Pass
  [TCPConnectionsTest] -> Pass
[TCPConnections] -> Pass

A persistent and human readable test evidence PDF report:

$ python ./test_plan.py --pdf report.pdf
  [TCPConnectionsTest] -> Pass
[TCPConnections] -> Pass
PDF generated at report.pdf

https://github.com/Morgan-Stanley/testplan/blob/master/doc/images/pdf/readme_server_client.png

Documentation

For complete documentation that includes downloadable examples, visit this link.

To generate the documentation locally:

$ cd doc/en
python sphinx-build -b html . ./html

Contribution

A step by step guide to contribute to Testplan framework can be found here.

License

License information here.

testplan's People

Contributors

johnchiotis avatar lambchr avatar ryan-collingham avatar canbascilms avatar raoyitao avatar pyifan avatar kelliott55 avatar mend-for-github-com[bot] avatar

Watchers

James Cloos avatar

testplan's Issues

WS-2018-0236 (Medium) detected in mem-1.1.0.tgz

WS-2018-0236 - Medium Severity Vulnerability

Vulnerable Library - mem-1.1.0.tgz

Memoize functions - An optimization used to speed up consecutive function calls by caching the result of calls with identical input

Library home page: https://registry.npmjs.org/mem/-/mem-1.1.0.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/mem/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-3.8.1.tgz
      • yargs-8.0.2.tgz
        • os-locale-2.1.0.tgz
          • mem-1.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

In nodejs-mem before version 4.0.0 there is a memory leak due to old results not being removed from the cache despite reaching maxAge. Exploitation of this can lead to exhaustion of memory and subsequent denial of service.

Publish Date: 2019-05-30

URL: WS-2018-0236

CVSS 2 Score Details (5.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=1623744

Release Date: 2019-05-30

Fix Resolution: 4.0.0

CVE-2020-10177 (Medium) detected in Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

CVE-2020-10177 - Medium Severity Vulnerability

Vulnerable Library - Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/85/5e/e91792f198bbc5a0d7d3055ad552bc4062942d27eaf75c3e2783cf64eae5/Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: testplan

Path to vulnerable library: testplan,testplan/requirements.txt

Dependency Hierarchy:

  • Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl (Vulnerable Library)

Vulnerability Details

Pillow before 7.1.0 has multiple out-of-bounds reads in libImaging/FliDecode.c.

Publish Date: 2020-06-25

URL: CVE-2020-10177

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: python-pillow/Pillow@41b554b

Release Date: 2020-06-25

Fix Resolution: 7.1.0


  • Check this box to open an automated fix PR

CVE-2015-9251 (Medium) detected in jquery-1.7.1.min.js, jquery-2.1.4.min.js

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.7.1.min.js, jquery-2.1.4.min.js

jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: testplan/testplan/web_ui/testing/node_modules/sockjs/examples/express-3.x/index.html

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/sockjs/examples/express-3.x/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/hapi/html/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/multiplex/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/echo/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)
jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: testplan/testplan/web_ui/testing/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

CVE-2020-15168 (Medium) detected in node-fetch-1.7.3.tgz

CVE-2020-15168 - Medium Severity Vulnerability

Vulnerable Library - node-fetch-1.7.3.tgz

A light-weight module that brings window.fetch to node.js and io.js

Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-1.7.3.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/node-fetch/package.json

Dependency Hierarchy:

  • ag-grid-react-19.0.0.tgz (Root Library)
    • prop-types-15.6.0.tgz
      • fbjs-0.8.17.tgz
        • isomorphic-fetch-2.2.1.tgz
          • node-fetch-1.7.3.tgz (Vulnerable Library)

Vulnerability Details

node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.

Publish Date: 2020-09-10

URL: CVE-2020-15168

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w7rc-rwvf-8q5r

Release Date: 2020-07-21

Fix Resolution: 2.6.1,3.0.0-beta.9

CVE-2020-10379 (High) detected in Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

CVE-2020-10379 - High Severity Vulnerability

Vulnerable Library - Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/85/5e/e91792f198bbc5a0d7d3055ad552bc4062942d27eaf75c3e2783cf64eae5/Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: testplan

Path to vulnerable library: testplan,testplan/requirements.txt

Dependency Hierarchy:

  • Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl (Vulnerable Library)

Vulnerability Details

In Pillow before 7.1.0, there are two Buffer Overflows in libImaging/TiffDecode.c.

Publish Date: 2020-06-25

URL: CVE-2020-10379

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: python-pillow/Pillow@41b554b

Release Date: 2020-06-25

Fix Resolution: 7.1.0


  • Check this box to open an automated fix PR

WS-2020-0091 (High) detected in http-proxy-1.18.0.tgz

WS-2020-0091 - High Severity Vulnerability

Vulnerable Library - http-proxy-1.18.0.tgz

HTTP proxying for the masses

Library home page: https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.0.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/http-proxy/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-dev-server-2.9.4.tgz
      • http-proxy-middleware-0.17.4.tgz
        • http-proxy-1.18.0.tgz (Vulnerable Library)

Vulnerability Details

Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.

Publish Date: 2020-05-14

URL: WS-2020-0091

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1486

Release Date: 2020-05-26

Fix Resolution: http-proxy - 1.18.1

CVE-2020-5313 (High) detected in Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

CVE-2020-5313 - High Severity Vulnerability

Vulnerable Library - Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/85/5e/e91792f198bbc5a0d7d3055ad552bc4062942d27eaf75c3e2783cf64eae5/Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: testplan

Path to vulnerable library: testplan,testplan/requirements.txt

Dependency Hierarchy:

  • Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

libImaging/FliDecode.c in Pillow before 6.2.2 has an FLI buffer overflow.

Publish Date: 2020-01-03

URL: CVE-2020-5313

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5313

Release Date: 2020-01-03

Fix Resolution: Pillow - 6.2.2


  • Check this box to open an automated fix PR

WS-2019-0381 (Medium) detected in kind-of-6.0.2.tgz

WS-2019-0381 - Medium Severity Vulnerability

Vulnerable Library - kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/nanomatch/node_modules/kind-of/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • micromatch-2.3.11.tgz
          • braces-1.8.5.tgz
            • expand-range-1.8.2.tgz
              • fill-range-2.2.4.tgz
                • randomatic-3.1.1.tgz
                  • kind-of-6.0.2.tgz (Vulnerable Library)

Vulnerability Details

Versions of kind-of 6.x prior to 6.0.3 are vulnerable to a Validation Bypass. A maliciously crafted object can alter the result of the type check, allowing attackers to bypass the type checking validation.

Publish Date: 2020-03-18

URL: WS-2019-0381

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jonschlinkert/kind-of@975c13a

Release Date: 2020-03-18

Fix Resolution: kind-of - 6.0.3

WS-2019-0333 (Medium) detected in handlebars-4.1.2.tgz

WS-2019-0333 - Medium Severity Vulnerability

Vulnerable Library - handlebars-4.1.2.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.7.tgz
          • istanbul-reports-1.5.1.tgz
            • handlebars-4.1.2.tgz (Vulnerable Library)

Vulnerability Details

Prototype Pollution vulnerability found in handlebars 1.0.6 before 4.5.3. It is possible to add or modify properties to the Object prototype through a malicious template. Attacker may crash the application or execute Arbitrary Code in specific conditions.

Publish Date: 2019-12-05

URL: WS-2019-0333

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1325

Release Date: 2019-12-05

Fix Resolution: handlebars - 4.5.3

WS-2020-0068 (High) detected in multiple libraries

WS-2020-0068 - High Severity Vulnerability

Vulnerable Libraries - yargs-parser-5.0.0.tgz, yargs-parser-4.2.1.tgz, yargs-parser-7.0.0.tgz

yargs-parser-5.0.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-5.0.0.tgz

Path to dependency file: /tmp/ws-scm/testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/ws-scm/testplan/testplan/web_ui/testing/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • yargs-7.1.0.tgz
          • yargs-parser-5.0.0.tgz (Vulnerable Library)
yargs-parser-4.2.1.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-4.2.1.tgz

Path to dependency file: /tmp/ws-scm/testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/ws-scm/testplan/testplan/web_ui/testing/node_modules/webpack-dev-server/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-dev-server-2.9.4.tgz
      • yargs-6.6.0.tgz
        • yargs-parser-4.2.1.tgz (Vulnerable Library)
yargs-parser-7.0.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-7.0.0.tgz

Path to dependency file: /tmp/ws-scm/testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/ws-scm/testplan/testplan/web_ui/testing/node_modules/webpack/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-3.8.1.tgz
      • yargs-8.0.2.tgz
        • yargs-parser-7.0.0.tgz (Vulnerable Library)

Vulnerability Details

Affected versions of yargs-parser are vulnerable to prototype pollution. Arguments are not properly sanitized, allowing an attacker to modify the prototype of Object, causing the addition or modification of an existing property that will exist on all objects. Parsing the argument --foo.proto.bar baz' adds a bar property with value baz to all objects. This is only exploitable if attackers have control over the arguments being passed to yargs-parser.

Publish Date: 2020-05-01

URL: WS-2020-0068

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/package/yargs-parser

Release Date: 2020-05-04

Fix Resolution: https://www.npmjs.com/package/yargs-parser/v/18.1.2,https://www.npmjs.com/package/yargs-parser/v/15.0.1

CVE-2019-20149 (Medium) detected in multiple libraries

CVE-2019-20149 - Medium Severity Vulnerability

Vulnerable Libraries - kind-of-3.2.2.tgz, kind-of-4.0.0.tgz, kind-of-6.0.2.tgz, kind-of-5.1.0.tgz

kind-of-3.2.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-3.2.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/chokidar/node_modules/expand-brackets/node_modules/is-accessor-descriptor/node_modules/kind-of/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • micromatch-2.3.11.tgz
          • kind-of-3.2.2.tgz (Vulnerable Library)
kind-of-4.0.0.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-4.0.0.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/has-values/node_modules/kind-of/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-3.8.1.tgz
      • watchpack-1.6.0.tgz
        • chokidar-2.1.6.tgz
          • braces-2.3.2.tgz
            • snapdragon-0.8.2.tgz
              • base-0.11.2.tgz
                • cache-base-1.0.1.tgz
                  • has-value-1.0.0.tgz
                    • has-values-1.0.0.tgz
                    • kind-of-4.0.0.tgz (Vulnerable Library)
kind-of-6.0.2.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/nanomatch/node_modules/kind-of/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • micromatch-2.3.11.tgz
          • braces-1.8.5.tgz
            • expand-range-1.8.2.tgz
              • fill-range-2.2.4.tgz
                • randomatic-3.1.1.tgz
                  • kind-of-6.0.2.tgz (Vulnerable Library)
kind-of-5.1.0.tgz

Get the native type of a value.

Library home page: https://registry.npmjs.org/kind-of/-/kind-of-5.1.0.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/chokidar/node_modules/expand-brackets/node_modules/kind-of/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-3.8.1.tgz
      • watchpack-1.6.0.tgz
        • chokidar-2.1.6.tgz
          • anymatch-2.0.0.tgz
            • micromatch-3.1.10.tgz
              • extglob-2.0.4.tgz
                • expand-brackets-2.1.4.tgz
                  • define-property-0.2.5.tgz
                    • is-descriptor-0.1.6.tgz
                    • kind-of-5.1.0.tgz (Vulnerable Library)

Vulnerability Details

ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.

Publish Date: 2019-12-30

URL: CVE-2019-20149

CVSS 2 Score Details (5.0)

Base Score Metrics not available

CVE-2020-5310 (High) detected in Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

CVE-2020-5310 - High Severity Vulnerability

Vulnerable Library - Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/85/5e/e91792f198bbc5a0d7d3055ad552bc4062942d27eaf75c3e2783cf64eae5/Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: testplan

Path to vulnerable library: testplan,testplan/requirements.txt

Dependency Hierarchy:

  • Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

libImaging/TiffDecode.c in Pillow before 6.2.2 has a TIFF decoding integer overflow, related to realloc.

Publish Date: 2020-01-03

URL: CVE-2020-5310

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5310

Release Date: 2020-01-03

Fix Resolution: Pillow - 6.2.2


  • Check this box to open an automated fix PR

CVE-2020-7656 (Medium) detected in jquery-1.7.1.min.js

CVE-2020-7656 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: testplan/testplan/web_ui/testing/node_modules/sockjs/examples/express-3.x/index.html

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/sockjs/examples/express-3.x/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/hapi/html/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/multiplex/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/echo/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Vulnerability Details

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Publish Date: 2020-05-19

URL: CVE-2020-7656

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: rails/jquery-rails@8f601cb

Release Date: 2020-05-19

Fix Resolution: jquery-rails - 2.2.0

WS-2020-0070 (High) detected in lodash-4.17.15.tgz

WS-2020-0070 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /tmp/ws-scm/testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/ws-scm/testplan/testplan/web_ui/testing/node_modules/lodash/package.json

Dependency Hierarchy:

  • eslint-5.10.0.tgz (Root Library)
    • lodash-4.17.15.tgz (Vulnerable Library)

Vulnerability Details

a prototype pollution vulnerability in lodash. It allows an attacker to inject properties on Object.prototype

Publish Date: 2020-04-28

URL: WS-2020-0070

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2020-13822 (High) detected in elliptic-6.5.2.tgz

CVE-2020-13822 - High Severity Vulnerability

Vulnerable Library - elliptic-6.5.2.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/elliptic/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-3.8.1.tgz
      • node-libs-browser-2.2.1.tgz
        • crypto-browserify-3.12.0.tgz
          • browserify-sign-4.0.4.tgz
            • elliptic-6.5.2.tgz (Vulnerable Library)

Vulnerability Details

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Publish Date: 2020-06-04

URL: CVE-2020-13822

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/indutny/elliptic/tree/v6.5.3

Release Date: 2020-06-04

Fix Resolution: v6.5.3

CVE-2020-5312 (High) detected in Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

CVE-2020-5312 - High Severity Vulnerability

Vulnerable Library - Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/85/5e/e91792f198bbc5a0d7d3055ad552bc4062942d27eaf75c3e2783cf64eae5/Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: testplan

Path to vulnerable library: testplan,testplan/requirements.txt

Dependency Hierarchy:

  • Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

libImaging/PcxDecode.c in Pillow before 6.2.2 has a PCX P mode buffer overflow.

Publish Date: 2020-01-03

URL: CVE-2020-5312

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5312

Release Date: 2020-01-03

Fix Resolution: Pillow - 6.2.2


  • Check this box to open an automated fix PR

WS-2019-0019 Medium Severity Vulnerability detected by WhiteSource

WS-2019-0019 - Medium Severity Vulnerability

Vulnerable Library - braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.

Library home page: https://registry.npmjs.org/braces/-/braces-1.8.5.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/braces/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • micromatch-2.3.11.tgz
          • braces-1.8.5.tgz (Vulnerable Library)

Vulnerability Details

Version of braces prior to 2.3.1 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.

Publish Date: 2019-03-25

URL: WS-2019-0019

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/786

Release Date: 2019-02-21

Fix Resolution: 2.3.1


Step up your Open Source Security Game with WhiteSource here

CVE-2020-10994 (Medium) detected in Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

CVE-2020-10994 - Medium Severity Vulnerability

Vulnerable Library - Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/85/5e/e91792f198bbc5a0d7d3055ad552bc4062942d27eaf75c3e2783cf64eae5/Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: testplan

Path to vulnerable library: testplan,testplan/requirements.txt

Dependency Hierarchy:

  • Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl (Vulnerable Library)

Vulnerability Details

In libImaging/Jpeg2KDecode.c in Pillow before 7.1.0, there are multiple out-of-bounds reads via a crafted JP2 file.

Publish Date: 2020-06-25

URL: CVE-2020-10994

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: python-pillow/Pillow@41b554b

Release Date: 2020-06-25

Fix Resolution: 7.1.0


  • Check this box to open an automated fix PR

CVE-2020-7720 (High) detected in node-forge-0.9.0.tgz

CVE-2020-7720 - High Severity Vulnerability

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/node-forge/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-dev-server-2.9.4.tgz
      • selfsigned-1.10.7.tgz
        • node-forge-0.9.0.tgz (Vulnerable Library)

Vulnerability Details

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

Publish Date: 2020-09-01

URL: CVE-2020-7720

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md

Release Date: 2020-09-13

Fix Resolution: node-forge - 0.10.0

CVE-2020-5311 (High) detected in Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

CVE-2020-5311 - High Severity Vulnerability

Vulnerable Library - Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/85/5e/e91792f198bbc5a0d7d3055ad552bc4062942d27eaf75c3e2783cf64eae5/Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: testplan

Path to vulnerable library: testplan,testplan/requirements.txt

Dependency Hierarchy:

  • Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

libImaging/SgiRleDecode.c in Pillow before 6.2.2 has an SGI buffer overflow.

Publish Date: 2020-01-03

URL: CVE-2020-5311

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5311

Release Date: 2020-01-03

Fix Resolution: Pillow - 6.2.2


  • Check this box to open an automated fix PR

CVE-2019-11358 (Medium) detected in jquery-2.1.4.min.js

CVE-2019-11358 - Medium Severity Vulnerability

Vulnerable Library - jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: testplan/testplan/web_ui/testing/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: 3.4.0

CVE-2019-19911 (High) detected in Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

CVE-2019-19911 - High Severity Vulnerability

Vulnerable Library - Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/85/5e/e91792f198bbc5a0d7d3055ad552bc4062942d27eaf75c3e2783cf64eae5/Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: testplan

Path to vulnerable library: testplan,testplan/requirements.txt

Dependency Hierarchy:

  • Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

There is a DoS vulnerability in Pillow before 6.2.2 caused by FpxImagePlugin.py calling the range function on an unvalidated 32-bit integer if the number of bands is large. On Windows running 32-bit Python, this results in an OverflowError or MemoryError due to the 2 GB limit. However, on Linux running 64-bit Python this results in the process being terminated by the OOM killer.

Publish Date: 2020-01-05

URL: CVE-2019-19911

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/python-pillow/Pillow/tree/6.2.2

Release Date: 2020-01-05

Fix Resolution: Pillow - 6.2.2


  • Check this box to open an automated fix PR

CVE-2020-11023 (Medium) detected in jquery-1.7.1.min.js, jquery-2.1.4.min.js

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.7.1.min.js, jquery-2.1.4.min.js

jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: testplan/testplan/web_ui/testing/node_modules/sockjs/examples/express-3.x/index.html

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/sockjs/examples/express-3.x/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/hapi/html/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/multiplex/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/echo/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)
jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: testplan/testplan/web_ui/testing/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0

CVE-2019-10742 (High) detected in axios-0.18.0.tgz

CVE-2019-10742 - High Severity Vulnerability

Vulnerable Library - axios-0.18.0.tgz

Promise based HTTP client for the browser and node.js

Library home page: https://registry.npmjs.org/axios/-/axios-0.18.0.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/axios/package.json

Dependency Hierarchy:

  • axios-0.18.0.tgz (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

Axios up to and including 0.18.0 allows attackers to cause a denial of service (application crash) by continuing to accepting content after maxContentLength is exceeded.

Publish Date: 2019-05-07

URL: CVE-2019-10742

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: axios/axios#1098

Release Date: 2019-05-31

Fix Resolution: 0.19.0


  • Check this box to open an automated fix PR

CVE-2019-10746 (High) detected in mixin-deep-1.3.2.tgz

CVE-2019-10746 - High Severity Vulnerability

Vulnerable Library - mixin-deep-1.3.2.tgz

Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.

Library home page: https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/mixin-deep/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-3.8.1.tgz
      • watchpack-1.6.0.tgz
        • chokidar-2.1.6.tgz
          • braces-2.3.2.tgz
            • snapdragon-0.8.2.tgz
              • base-0.11.2.tgz
                • mixin-deep-1.3.2.tgz (Vulnerable Library)

Vulnerability Details

mixin-deep before 1.3.2 is vulnerable to Prototype Pollution.

Publish Date: 2019-07-11

URL: CVE-2019-10746

CVSS 2 Score Details (7.5)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: jonschlinkert/mixin-deep@8f464c8

Release Date: 2019-07-11

Fix Resolution: 1.3.2

WS-2019-0424 (Medium) detected in elliptic-6.5.2.tgz

WS-2019-0424 - Medium Severity Vulnerability

Vulnerable Library - elliptic-6.5.2.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/elliptic/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-3.8.1.tgz
      • node-libs-browser-2.2.1.tgz
        • crypto-browserify-3.12.0.tgz
          • browserify-sign-4.0.4.tgz
            • elliptic-6.5.2.tgz (Vulnerable Library)

Vulnerability Details

all versions of elliptic are vulnerable to Timing Attack through side-channels.

Publish Date: 2019-11-13

URL: WS-2019-0424

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Adjacent
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

WS-2020-0042 (Medium) detected in multiple libraries

WS-2020-0042 - Medium Severity Vulnerability

Vulnerable Libraries - acorn-4.0.13.tgz, acorn-5.7.3.tgz, acorn-6.2.1.tgz

acorn-4.0.13.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-4.0.13.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/acorn-globals/node_modules/acorn/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • jest-environment-jsdom-20.0.3.tgz
          • jsdom-9.12.0.tgz
            • acorn-globals-3.1.0.tgz
              • acorn-4.0.13.tgz (Vulnerable Library)
acorn-5.7.3.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-5.7.3.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/webpack/node_modules/acorn/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-3.8.1.tgz
      • acorn-5.7.3.tgz (Vulnerable Library)
acorn-6.2.1.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-6.2.1.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/acorn/package.json

Dependency Hierarchy:

  • eslint-5.10.0.tgz (Root Library)
    • espree-5.0.1.tgz
      • acorn-6.2.1.tgz (Vulnerable Library)

Vulnerability Details

acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.

Publish Date: 2020-03-08

URL: WS-2020-0042

CVSS 3 Score Details (5.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: N/A
    • Attack Complexity: N/A
    • Privileges Required: N/A
    • User Interaction: N/A
    • Scope: N/A
  • Impact Metrics:
    • Confidentiality Impact: N/A
    • Integrity Impact: N/A
    • Availability Impact: N/A

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1488

Release Date: 2020-03-08

Fix Resolution: 7.1.1

CVE-2020-7608 (Medium) detected in multiple libraries

CVE-2020-7608 - Medium Severity Vulnerability

Vulnerable Libraries - yargs-parser-5.0.0.tgz, yargs-parser-4.2.1.tgz, yargs-parser-7.0.0.tgz

yargs-parser-5.0.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-5.0.0.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • yargs-7.1.0.tgz
          • yargs-parser-5.0.0.tgz (Vulnerable Library)
yargs-parser-4.2.1.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-4.2.1.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/webpack-dev-server/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-dev-server-2.9.4.tgz
      • yargs-6.6.0.tgz
        • yargs-parser-4.2.1.tgz (Vulnerable Library)
yargs-parser-7.0.0.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-7.0.0.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/webpack/node_modules/yargs-parser/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-3.8.1.tgz
      • yargs-8.0.2.tgz
        • yargs-parser-7.0.0.tgz (Vulnerable Library)

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: yargs/yargs-parser@63810ca

Release Date: 2020-06-05

Fix Resolution: 5.0.1;13.1.2;15.0.1;18.1.1

WS-2019-0331 (Medium) detected in handlebars-4.1.2.tgz

WS-2019-0331 - Medium Severity Vulnerability

Vulnerable Library - handlebars-4.1.2.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.7.tgz
          • istanbul-reports-1.5.1.tgz
            • handlebars-4.1.2.tgz (Vulnerable Library)

Vulnerability Details

Arbitrary Code Execution vulnerability found in handlebars before 4.5.2. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.

Publish Date: 2019-12-05

URL: WS-2019-0331

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1316

Release Date: 2019-12-05

Fix Resolution: handlebars - 4.5.2

CVE-2018-17175 (Medium) detected in marshmallow-3.0.0b2-py2.py3-none-any.whl

CVE-2018-17175 - Medium Severity Vulnerability

Vulnerable Library - marshmallow-3.0.0b2-py2.py3-none-any.whl

A lightweight library for converting complex datatypes to and from native Python datatypes.

Library home page: https://files.pythonhosted.org/packages/be/ae/94a6d1854be8ded2528cd29fde90c70dc30a360b11ef71cfe9c5e7000ff9/marshmallow-3.0.0b2-py2.py3-none-any.whl

Path to dependency file: testplan/requirements.txt

Path to vulnerable library: testplan/requirements.txt,testplan

Dependency Hierarchy:

  • marshmallow-3.0.0b2-py2.py3-none-any.whl (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

In the marshmallow library before 2.15.1 and 3.x before 3.0.0b9 for Python, the schema "only" option treats an empty list as implying no "only" option, which allows a request that was intended to expose no fields to instead expose all fields (if the schema is being filtered dynamically using the "only" option, and there is a user role that produces an empty value for "only").

Publish Date: 2018-09-18

URL: CVE-2018-17175

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-17175

Release Date: 2018-09-18

Fix Resolution: 2.15.1,3.0.0b9


  • Check this box to open an automated fix PR

CVE-2020-7693 (Medium) detected in sockjs-0.3.18.tgz

CVE-2020-7693 - Medium Severity Vulnerability

Vulnerable Library - sockjs-0.3.18.tgz

SockJS-node is a server counterpart of SockJS-client a JavaScript library that provides a WebSocket-like object in the browser. SockJS gives you a coherent, cross-browser, Javascript API which creates a low latency, full duplex, cross-domain communication

Library home page: https://registry.npmjs.org/sockjs/-/sockjs-0.3.18.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/sockjs/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-dev-server-2.9.4.tgz
      • sockjs-0.3.18.tgz (Vulnerable Library)

Vulnerability Details

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.

Publish Date: 2020-07-09

URL: CVE-2020-7693

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: sockjs/sockjs-node#265

Release Date: 2020-07-09

Fix Resolution: sockjs - 0.3.20

CVE-2019-16865 (High) detected in Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

CVE-2019-16865 - High Severity Vulnerability

Vulnerable Library - Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/85/5e/e91792f198bbc5a0d7d3055ad552bc4062942d27eaf75c3e2783cf64eae5/Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: testplan

Path to vulnerable library: testplan,testplan/requirements.txt

Dependency Hierarchy:

  • Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

An issue was discovered in Pillow before 6.2.0. When reading specially crafted invalid image files, the library can either allocate very large amounts of memory or take an extremely long period of time to process the image.

Publish Date: 2019-10-04

URL: CVE-2019-16865

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16865

Release Date: 2019-10-04

Fix Resolution: 6.2.0


  • Check this box to open an automated fix PR

WS-2019-0032 (Medium) detected in js-yaml-3.7.0.tgz

WS-2019-0032 - Medium Severity Vulnerability

Vulnerable Library - js-yaml-3.7.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.7.0.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/svgo/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • css-loader-0.28.7.tgz
      • cssnano-3.10.0.tgz
        • postcss-svgo-2.1.6.tgz
          • svgo-0.7.2.tgz
            • js-yaml-3.7.0.tgz (Vulnerable Library)

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-20

URL: WS-2019-0032

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-20

Fix Resolution: js-yaml - 3.13.0

CVE-2019-19919 (High) detected in handlebars-4.1.2.tgz

CVE-2019-19919 - High Severity Vulnerability

Vulnerable Library - handlebars-4.1.2.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.7.tgz
          • istanbul-reports-1.5.1.tgz
            • handlebars-4.1.2.tgz (Vulnerable Library)

Vulnerability Details

Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Publish Date: 2019-12-20

URL: CVE-2019-19919

CVSS 2 Score Details (7.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1164

Release Date: 2019-12-20

Fix Resolution: 4.3.0

CVE-2020-11022 (Medium) detected in jquery-1.7.1.min.js, jquery-2.1.4.min.js

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Libraries - jquery-1.7.1.min.js, jquery-2.1.4.min.js

jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: testplan/testplan/web_ui/testing/node_modules/sockjs/examples/express-3.x/index.html

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/sockjs/examples/express-3.x/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/hapi/html/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/multiplex/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/echo/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)
jquery-2.1.4.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/2.1.4/jquery.min.js

Path to dependency file: testplan/testplan/web_ui/testing/node_modules/js-base64/.attic/test-moment/index.html

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/js-base64/.attic/test-moment/index.html

Dependency Hierarchy:

  • jquery-2.1.4.min.js (Vulnerable Library)

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

WS-2019-0063 (High) detected in js-yaml-3.7.0.tgz

WS-2019-0063 - High Severity Vulnerability

Vulnerable Library - js-yaml-3.7.0.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.7.0.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/svgo/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • css-loader-0.28.7.tgz
      • cssnano-3.10.0.tgz
        • postcss-svgo-2.1.6.tgz
          • svgo-0.7.2.tgz
            • js-yaml-3.7.0.tgz (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-05

URL: WS-2019-0063

CVSS 2 Score Details (8.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-05

Fix Resolution: js-yaml - 3.13.1

CVE-2012-6708 (Medium) detected in jquery-1.7.1.min.js

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.7.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.7.1/jquery.min.js

Path to dependency file: testplan/testplan/web_ui/testing/node_modules/sockjs/examples/express-3.x/index.html

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/sockjs/examples/express-3.x/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/hapi/html/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/multiplex/index.html,testplan/testplan/web_ui/testing/node_modules/sockjs/examples/echo/index.html

Dependency Hierarchy:

  • jquery-1.7.1.min.js (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

WS-2019-0291 (High) detected in handlebars-4.1.2.tgz

WS-2019-0291 - High Severity Vulnerability

Vulnerable Library - handlebars-4.1.2.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.7.tgz
          • istanbul-reports-1.5.1.tgz
            • handlebars-4.1.2.tgz (Vulnerable Library)

Vulnerability Details

handlebars before 4.3.0 is vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Objects' proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.

Publish Date: 2019-10-06

URL: WS-2019-0291

CVSS 2 Score Details (7.3)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1164

Release Date: 2019-10-06

Fix Resolution: 4.3.0

CVE-2020-8203 (High) detected in lodash-4.17.15.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/lodash/package.json

Dependency Hierarchy:

  • eslint-5.10.0.tgz (Root Library)
    • lodash-4.17.15.tgz (Vulnerable Library)

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-23

Fix Resolution: lodash - 4.17.19

WS-2019-0318 (Medium) detected in handlebars-4.1.2.tgz

WS-2019-0318 - Medium Severity Vulnerability

Vulnerable Library - handlebars-4.1.2.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.7.tgz
          • istanbul-reports-1.5.1.tgz
            • handlebars-4.1.2.tgz (Vulnerable Library)

Vulnerability Details

A Denial of Service vulnerability found in handlebars 4.x before 4.4.5.While processing specially-crafted templates, the parser may be forced into endless loop. Attackers may exhaust system resources.

Publish Date: 2019-12-01

URL: WS-2019-0318

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1300

Release Date: 2019-12-01

Fix Resolution: handlebars - 4.4.5

WS-2017-3757 (Medium) detected in content-type-parser-1.0.2.tgz

WS-2017-3757 - Medium Severity Vulnerability

Vulnerable Library - content-type-parser-1.0.2.tgz

Parse the value of the Content-Type header

Library home page: https://registry.npmjs.org/content-type-parser/-/content-type-parser-1.0.2.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/content-type-parser/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • jest-environment-jsdom-20.0.3.tgz
          • jsdom-9.12.0.tgz
            • content-type-parser-1.0.2.tgz (Vulnerable Library)

Vulnerability Details

all versions prior to 2.0.0 of content-type-parser npm package are vulnerable to ReDoS via the user agent parser. the vulnerability was fixed by reintroducing a new parser and deleting the old one.

Publish Date: 2017-12-10

URL: WS-2017-3757

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: jsdom/whatwg-mimetype#3

Release Date: 2020-04-30

Fix Resolution: v2.0.0

WS-2019-0332 (Medium) detected in handlebars-4.1.2.tgz

WS-2019-0332 - Medium Severity Vulnerability

Vulnerable Library - handlebars-4.1.2.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.7.tgz
          • istanbul-reports-1.5.1.tgz
            • handlebars-4.1.2.tgz (Vulnerable Library)

Vulnerability Details

Arbitrary Code Execution vulnerability found in handlebars before 4.5.3. Lookup helper fails to validate templates. Attack may submit templates that execute arbitrary JavaScript in the system.It is due to an incomplete fix for a WS-2019-0331.

Publish Date: 2019-12-05

URL: WS-2019-0332

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1324

Release Date: 2019-12-05

Fix Resolution: handlebars - 4.5.3

WS-2019-0369 (Medium) detected in handlebars-4.1.2.tgz

WS-2019-0369 - Medium Severity Vulnerability

Vulnerable Library - handlebars-4.1.2.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.7.tgz
          • istanbul-reports-1.5.1.tgz
            • handlebars-4.1.2.tgz (Vulnerable Library)

Vulnerability Details

Prototype Pollution vulnerability found in handlebars.js before 4.5.3. Attacker may use Remote-Code-Execution exploits.

Publish Date: 2020-01-08

URL: WS-2019-0369

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/wycats/handlebars.js/blob/master/release-notes.md#v453---november-18th-2019

Release Date: 2020-01-08

Fix Resolution: handlebars - 4.5.3

CVE-2020-10378 (Medium) detected in Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

CVE-2020-10378 - Medium Severity Vulnerability

Vulnerable Library - Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/85/5e/e91792f198bbc5a0d7d3055ad552bc4062942d27eaf75c3e2783cf64eae5/Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: testplan

Path to vulnerable library: testplan,testplan/requirements.txt

Dependency Hierarchy:

  • Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl (Vulnerable Library)

Vulnerability Details

In libImaging/PcxDecode.c in Pillow before 7.1.0, an out-of-bounds read can occur when reading PCX files where state->shuffle is instructed to read beyond state->buffer.

Publish Date: 2020-06-25

URL: CVE-2020-10378

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: python-pillow/Pillow@41b554b

Release Date: 2020-06-25

Fix Resolution: 7.1.0


  • Check this box to open an automated fix PR

CVE-2019-15657 (Medium) detected in eslint-utils-1.4.0.tgz

CVE-2019-15657 - Medium Severity Vulnerability

Vulnerable Library - eslint-utils-1.4.0.tgz

Utilities for ESLint plugins.

Library home page: https://registry.npmjs.org/eslint-utils/-/eslint-utils-1.4.0.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/eslint-utils/package.json

Dependency Hierarchy:

  • eslint-5.10.0.tgz (Root Library)
    • eslint-utils-1.4.0.tgz (Vulnerable Library)

Vulnerability Details

In eslint-utils before 1.4.1, the getStaticValue function can execute arbitrary code.

Publish Date: 2019-08-26

URL: CVE-2019-15657

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-15657

Release Date: 2019-08-26

Fix Resolution: 1.4.1

CVE-2020-8116 (High) detected in dot-prop-4.2.0.tgz

CVE-2020-8116 - High Severity Vulnerability

Vulnerable Library - dot-prop-4.2.0.tgz

Get, set, or delete a property from a nested object using a dot path

Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/dot-prop/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • sw-precache-webpack-plugin-0.11.4.tgz
      • sw-precache-5.2.1.tgz
        • update-notifier-2.5.0.tgz
          • configstore-3.1.2.tgz
            • dot-prop-4.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Publish Date: 2020-02-04

URL: CVE-2020-8116

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116

Release Date: 2020-02-04

Fix Resolution: dot-prop - 5.1.1

CVE-2018-14732 (High) detected in webpack-dev-server-2.9.4.tgz

CVE-2018-14732 - High Severity Vulnerability

Vulnerable Library - webpack-dev-server-2.9.4.tgz

Serves a webpack app. Updates the browser on changes.

Library home page: https://registry.npmjs.org/webpack-dev-server/-/webpack-dev-server-2.9.4.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/webpack-dev-server/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-dev-server-2.9.4.tgz (Vulnerable Library)

Found in HEAD commit: 3cca8821acd4df569ae495009317deeb8ba5f3f0

Vulnerability Details

An issue was discovered in lib/Server.js in webpack-dev-server before 3.1.6. Attackers are able to steal developer's code because the origin of requests is not checked by the WebSocket server, which is used for HMR (Hot Module Replacement). Anyone can receive the HMR message sent by the WebSocket server via a ws://127.0.0.1:8080/ connection from any origin.

Publish Date: 2018-09-21

URL: CVE-2018-14732

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-14732

Release Date: 2018-09-21

Fix Resolution: 3.1.6

WS-2019-0368 (Low) detected in handlebars-4.1.2.tgz

WS-2019-0368 - Low Severity Vulnerability

Vulnerable Library - handlebars-4.1.2.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration

Library home page: https://registry.npmjs.org/handlebars/-/handlebars-4.1.2.tgz

Path to dependency file: /testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: /tmp/git/testplan/testplan/web_ui/testing/node_modules/handlebars/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • jest-20.0.4.tgz
      • jest-cli-20.0.4.tgz
        • istanbul-api-1.3.7.tgz
          • istanbul-reports-1.5.1.tgz
            • handlebars-4.1.2.tgz (Vulnerable Library)

Vulnerability Details

Security vulnerability found in handlebars.js before 4.3.0.

Publish Date: 2020-01-08

URL: WS-2019-0368

CVSS 2 Score Details (3.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: handlebars-lang/handlebars.js@2078c72

Release Date: 2020-01-08

Fix Resolution: handlebars - 4.3.0

CVE-2020-11538 (High) detected in Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

CVE-2020-11538 - High Severity Vulnerability

Vulnerable Library - Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Python Imaging Library (Fork)

Library home page: https://files.pythonhosted.org/packages/85/5e/e91792f198bbc5a0d7d3055ad552bc4062942d27eaf75c3e2783cf64eae5/Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl

Path to dependency file: testplan

Path to vulnerable library: testplan,testplan/requirements.txt

Dependency Hierarchy:

  • Pillow-5.4.1-cp36-cp36m-manylinux1_x86_64.whl (Vulnerable Library)

Vulnerability Details

In libImaging/SgiRleDecode.c in Pillow through 7.0.0, a number of out-of-bounds reads exist in the parsing of SGI image files, a different issue than CVE-2020-5311.

Publish Date: 2020-06-25

URL: CVE-2020-11538

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: python-pillow/Pillow@41b554b

Release Date: 2020-06-25

Fix Resolution: 7.1.0


  • Check this box to open an automated fix PR

WS-2019-0307 (Medium) detected in mem-1.1.0.tgz

WS-2019-0307 - Medium Severity Vulnerability

Vulnerable Library - mem-1.1.0.tgz

Memoize functions - An optimization used to speed up consecutive function calls by caching the result of calls with identical input

Library home page: https://registry.npmjs.org/mem/-/mem-1.1.0.tgz

Path to dependency file: testplan/testplan/web_ui/testing/package.json

Path to vulnerable library: testplan/testplan/web_ui/testing/node_modules/mem/package.json

Dependency Hierarchy:

  • react-scripts-1.1.1.tgz (Root Library)
    • webpack-3.8.1.tgz
      • yargs-8.0.2.tgz
        • os-locale-2.1.0.tgz
          • mem-1.1.0.tgz (Vulnerable Library)

Vulnerability Details

In 'mem' before v4.0.0 there is a Denial of Service (DoS) vulnerability as a result of a failure in removal old values from the cache.

Publish Date: 2018-08-27

URL: WS-2019-0307

CVSS 3 Score Details (5.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1084

Release Date: 2019-12-01

Fix Resolution: mem - 4.0.0

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.