Coder Social home page Coder Social logo

loggly-jslogger's Introduction

loggly-jslogger

Client-side (browser) logger to send Javascript logs from any website to Loggly. Check out Loggly’s Javascript logging documentation to learn more.

Installation

Insert the following code into your webpage, replacing your-customer-token with the key defined in the Source Setup -> Customer Tokens page:

<script type="text/javascript" src="https://cloudfront.loggly.com/js/loggly.tracker-2.2.4.min.js" async></script>
<script>
  var _LTracker = _LTracker || [];
  _LTracker.push({
    'logglyKey': 'your-customer-token',
    'sendConsoleErrors': true,
    'tag': 'javascript-logs'
  });
</script>

To get early access to the most recent updates to the tracker, use the script https://cloudfront.loggly.com/js/loggly.tracker-latest.min.js. This is not recommended in a production environment as it may include breaking changes.

Usage

Logging text:

_LTracker.push('my tracking string');

Logging JSON:

_LTracker.push({
  'text': 'my tracking string',
  'aList': [9, 2, 5],
  'anObject': {
    'id': 1,
    'value': 'foobar'
  }
});

Customization

Separate logging instance:

var myBetterLogger = new LogglyTracker();
myBetterLogger.push({'logglyKey': 'your-customer-token' });  // push a loggly key to initialize

Send Console Errors to Loggly

Keep the sendConsoleErrors value to true to send all unhandled errors to Loggly with detailed information, including error message, URL, line number and column number.

Send Tags to Loggly

Send your custom tags to Loggly by setting the tag property.

_LTracker.push({
  'logglyKey': 'your-customer-token',
  'sendConsoleErrors' : true,
  'tag' : 'tag1,tag2'
});

Special Characters Support

Set the useUtfEncoding value to true to prevent special characters from showing as odd or unusual characters in Loggly Search. Special characters will be easier to read and understand in your log events.

See the usage below:

_LTracker.push({
  'logglyKey': 'your-customer-token',
  'sendConsoleErrors' : true,
  'tag' : 'javascript-logs',
  'useUtfEncoding': true
});

Setup Proxy for Ad blockers

If the script or its requests are blocked by ad blockers, you can proxy requests from your own domain. To do this, perform following steps

Set useProxyDomain property to true

_LTracker.push({
  'logglyKey': 'your-customer-token',
  'sendConsoleErrors' : true,
  'tag' : 'javascript-logs',
  'useDomainProxy' : true
});

Use the following configuration on your server to forward the requests to Loggly

#Proxy to Loggly
location /loggly/ {
    rewrite ^/loggly/(.*)$ /$1 break;  # remove the '/loggly' part from the path, leaving /inputs/xxxxxxxx-xxxx-.../tag/xxx
    proxy_set_header Host logs-01.loggly.com;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $remote_addr;
    proxy_pass http://logs-01.loggly.com;
}

Build Production Version

Run npm run build to build production version. The output is saved in folder dist.

Run tests

In your web browser open file jasminetest/TrackerSpecRunner.html.

loggly-jslogger's People

Contributors

alestrunda avatar apackin avatar jarviscloud avatar justinmares avatar mend-for-github-com[bot] avatar mkuklis avatar mostlyjason avatar shwetajain148 avatar sirsgriffin avatar varshneyjayant avatar vhalbwachs avatar

Stargazers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

Watchers

 avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar  avatar

loggly-jslogger's Issues

CVE-2022-38900 (High) detected in decode-uri-component-0.2.0.tgz

CVE-2022-38900 - High Severity Vulnerability

Vulnerable Library - decode-uri-component-0.2.0.tgz

A better decodeURIComponent

Library home page: https://registry.npmjs.org/decode-uri-component/-/decode-uri-component-0.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/decode-uri-component/package.json

Dependency Hierarchy:

  • grunt-1.3.0.tgz (Root Library)
    • grunt-cli-1.3.2.tgz
      • liftoff-2.5.0.tgz
        • findup-sync-2.0.0.tgz
          • micromatch-3.1.10.tgz
            • snapdragon-0.8.2.tgz
              • source-map-resolve-0.5.3.tgz
                • decode-uri-component-0.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

decode-uri-component 0.2.0 is vulnerable to Improper Input Validation resulting in DoS.

Publish Date: 2022-11-28

URL: CVE-2022-38900

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2015-9251 (Medium) detected in jquery-1.8.1.min.js

CVE-2015-9251 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: loggly-jslogger/node_modules/bower/lib/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: loggly-jslogger/node_modules/bower/lib/node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

  • jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - v3.0.0

CVE-2012-6708 (Medium) detected in jquery-1.8.1.min.js

CVE-2012-6708 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: loggly-jslogger/node_modules/bower/lib/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: loggly-jslogger/node_modules/bower/lib/node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

  • jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

jQuery before 1.9.0 is vulnerable to Cross-site Scripting (XSS) attacks. The jQuery(strInput) function does not differentiate selectors from HTML in a reliable fashion. In vulnerable versions, jQuery determined whether the input was HTML by looking for the '<' character anywhere in the string, giving attackers more flexibility when attempting to construct a malicious payload. In fixed versions, jQuery only deems the input to be HTML if it explicitly starts with the '<' character, limiting exploitability only to attackers who can control the beginning of a string, which is far less common.

Publish Date: 2018-01-18

URL: CVE-2012-6708

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2012-6708

Release Date: 2018-01-18

Fix Resolution: jQuery - v1.9.0

Bower deployment

would it be possible that the library can be deployed with bower?

Library drops events that are emitted close in time to one another

Because the push function has a setTimeout, if a bunch of messages are queued, the data variable will get overridden.

Even if you wrap the setTimeout inside of a self invoking function and locally scope the data variable, I'm still getting some messages dropped. Could this be that we need to wait for the image's request to receive a response before sending the next message?

CVE-2019-1010266 (Medium) detected in lodash-3.10.1.tgz, lodash-4.3.0.tgz

CVE-2019-1010266 - Medium Severity Vulnerability

Vulnerable Libraries - lodash-3.10.1.tgz, lodash-4.3.0.tgz

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-log-1.0.0.tgz
      • lodash-3.10.1.tgz (Vulnerable Library)
lodash-4.3.0.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.3.0.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/grunt-legacy-util/node_modules/lodash/package.json,loggly-jslogger/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-util-1.0.0.tgz
      • lodash-4.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.

Publish Date: 2019-07-17

URL: CVE-2019-1010266

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1010266

Release Date: 2019-07-17

Fix Resolution: 4.17.11

CVE-2020-7598 (Medium) detected in minimist-1.2.0.tgz

CVE-2020-7598 - Medium Severity Vulnerability

Vulnerable Library - minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/minimist/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • dateformat-1.0.12.tgz
      • meow-3.7.0.tgz
        • minimist-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.

Publish Date: 2020-03-11

URL: CVE-2020-7598

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/substack/minimist/commit/63e7ed05aa4b1889ec2f3b196426db4500cbda94

Release Date: 2020-03-11

Fix Resolution: minimist - 0.2.1,1.2.3

CVE-2018-3721 (Medium) detected in lodash-3.10.1.tgz, lodash-4.3.0.tgz

CVE-2018-3721 - Medium Severity Vulnerability

Vulnerable Libraries - lodash-3.10.1.tgz, lodash-4.3.0.tgz

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-log-1.0.0.tgz
      • lodash-3.10.1.tgz (Vulnerable Library)
lodash-4.3.0.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.3.0.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/grunt-legacy-util/node_modules/lodash/package.json,loggly-jslogger/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-util-1.0.0.tgz
      • lodash-4.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.

Publish Date: 2018-06-07

URL: CVE-2018-3721

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2018-3721

Release Date: 2018-06-07

Fix Resolution: 4.17.5

WS-2019-0178 (Medium) detected in bower-1.8.0.tgz

WS-2019-0178 - Medium Severity Vulnerability

Vulnerable Library - bower-1.8.0.tgz

The browser package manager

Library home page: https://registry.npmjs.org/bower/-/bower-1.8.0.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/bower/package.json

Dependency Hierarchy:

  • bower-1.8.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

Bower versions before 1.8.8 does not verify that extracted symbolic links do not resolve to targets outside of the extraction root directory which cause Symlink Arbitrary File Overwrite

Publish Date: 2019-01-23

URL: WS-2019-0178

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://github.com/bower/bower/releases/tag/v1.8.8

Release Date: 2019-08-11

Fix Resolution: 1.8.8


  • Check this box to open an automated fix PR

WS-2018-0232 (Medium) detected in underscore.string-3.2.3.tgz

WS-2018-0232 - Medium Severity Vulnerability

Vulnerable Library - underscore.string-3.2.3.tgz

String manipulation extensions for Underscore.js javascript library.

Library home page: https://registry.npmjs.org/underscore.string/-/underscore.string-3.2.3.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/underscore.string/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-log-1.0.0.tgz
      • underscore.string-3.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

Underscore.string, before 3.3.5, is vulnerable to Regular Expression Denial of Service (ReDoS).

Publish Date: 2018-10-03

URL: WS-2018-0232

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/745

Release Date: 2018-12-30

Fix Resolution: 3.3.5

Setup Proxy in IIS

Hi, this is more a question than an Issue but I really don't know where to ask this.
How can I translate the proxy configuration to IIS?
So far I have realized that it is a Nginx config type but I am not having any success setting it up in ISS.
Any heads up on this will be appreciated.

WS-2019-0063 (High) detected in js-yaml-3.5.5.tgz

WS-2019-0063 - High Severity Vulnerability

Vulnerable Library - js-yaml-3.5.5.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.5.5.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • js-yaml-3.5.5.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

Js-yaml prior to 3.13.1 are vulnerable to Code Injection. The load() function may execute arbitrary code injected through a malicious YAML file.

Publish Date: 2019-04-05

URL: WS-2019-0063

CVSS 2 Score Details (8.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/813

Release Date: 2019-04-05

Fix Resolution: js-yaml - 3.13.1

CVE-2021-43138 (High) detected in async-1.5.2.tgz

CVE-2021-43138 - High Severity Vulnerability

Vulnerable Library - async-1.5.2.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-1.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Dependency Hierarchy:

  • grunt-1.3.0.tgz (Root Library)
    • grunt-legacy-util-2.0.0.tgz
      • async-1.5.2.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (grunt): 1.4.0


  • Check this box to open an automated fix PR

CVE-2022-3517 (High) detected in minimatch-3.0.4.tgz

CVE-2022-3517 - High Severity Vulnerability

Vulnerable Library - minimatch-3.0.4.tgz

a glob matcher in javascript

Library home page: https://registry.npmjs.org/minimatch/-/minimatch-3.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimatch/package.json

Dependency Hierarchy:

  • grunt-1.3.0.tgz (Root Library)
    • minimatch-3.0.4.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

A vulnerability was found in the minimatch package. This flaw allows a Regular Expression Denial of Service (ReDoS) when calling the braceExpand function with specific arguments, resulting in a Denial of Service.

Publish Date: 2022-10-17

URL: CVE-2022-3517

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-17

Fix Resolution: minimatch - 3.0.5

CVE-2020-28282 (High) detected in getobject-0.1.0.tgz

CVE-2020-28282 - High Severity Vulnerability

Vulnerable Library - getobject-0.1.0.tgz

get.and.set.deep.objects.easily = true

Library home page: https://registry.npmjs.org/getobject/-/getobject-0.1.0.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/getobject/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-util-1.0.0.tgz
      • getobject-0.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in 'getobject' version 0.1.0 allows an attacker to cause a denial of service and may lead to remote code execution.

Publish Date: 2020-12-29

URL: CVE-2020-28282

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

CVE-2019-5484 (High) detected in bower-1.8.0.tgz

CVE-2019-5484 - High Severity Vulnerability

Vulnerable Library - bower-1.8.0.tgz

The browser package manager

Library home page: https://registry.npmjs.org/bower/-/bower-1.8.0.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/bower/package.json

Dependency Hierarchy:

  • bower-1.8.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

Bower before 1.8.8 has a path traversal vulnerability permitting file write in arbitrary locations via install command, which allows attackers to write arbitrary files when a malicious package is extracted.

Publish Date: 2019-09-13

URL: CVE-2019-5484

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-5484

Release Date: 2019-09-13

Fix Resolution: 1.8.8


  • Check this box to open an automated fix PR

WS-2019-0032 (Medium) detected in js-yaml-3.5.5.tgz

WS-2019-0032 - Medium Severity Vulnerability

Vulnerable Library - js-yaml-3.5.5.tgz

YAML 1.2 parser and serializer

Library home page: https://registry.npmjs.org/js-yaml/-/js-yaml-3.5.5.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/js-yaml/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • js-yaml-3.5.5.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

Versions js-yaml prior to 3.13.0 are vulnerable to Denial of Service. By parsing a carefully-crafted YAML file, the node process stalls and may exhaust system resources leading to a Denial of Service.

Publish Date: 2019-03-20

URL: WS-2019-0032

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/788/versions

Release Date: 2019-03-20

Fix Resolution: js-yaml - 3.13.0

CVE-2020-7656 (Medium) detected in jquery-1.8.1.min.js

CVE-2020-7656 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: loggly-jslogger/node_modules/bower/lib/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: loggly-jslogger/node_modules/bower/lib/node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

  • jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

jquery prior to 1.9.0 allows Cross-site Scripting attacks via the load method. The load method fails to recognize and remove "<script>" HTML tags that contain a whitespace character, i.e: "</script >", which results in the enclosed script logic to be executed.

Publish Date: 2020-05-19

URL: CVE-2020-7656

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: rails/jquery-rails@8f601cb

Release Date: 2020-05-19

Fix Resolution: jquery-rails - 2.2.0

CVE-2022-1537 (High) detected in grunt-1.3.0.tgz

CVE-2022-1537 - High Severity Vulnerability

Vulnerable Library - grunt-1.3.0.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-1.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt/package.json

Dependency Hierarchy:

  • grunt-1.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

file.copy operations in GruntJS are vulnerable to a TOCTOU race condition leading to arbitrary file write in GitHub repository gruntjs/grunt prior to 1.5.3. This vulnerability is capable of arbitrary file writes which can lead to local privilege escalation to the GruntJS user if a lower-privileged user has write access to both source and destination directories as the lower-privileged user can create a symlink to the GruntJS user's .bashrc file or replace /etc/shadow file if the GruntJS user is root.

Publish Date: 2022-05-10

URL: CVE-2022-1537

CVSS 3 Score Details (7.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/0179c3e5-bc02-4fc9-8491-a1a319b51b4d/

Release Date: 2022-05-10

Fix Resolution: 1.5.3


  • Check this box to open an automated fix PR

send bulk events

I would like to use this library to send bulk events to Loggly.
I tried changing the URL to /bulk/ instead of /inputs/ but it returns a server error.

sending tags?

is there a way to attach a tag to the "push"? or do I do that manually by filtering on fields in the JSON objects I'm logging?

Browser is requesting source map, which doesn't exist on the CDN

Hi there. We're loading the Loggly JS client async from your site, like this:

load('//cloudfront.loggly.com/js/loggly.tracker.min.js', function() {
  // Init functions
});

The minified version will generate a sourcemap URL line at the bottom:

//# sourceMappingURL=loggly.tracker.min.map

which makes the browser request http://cloudfront.loggly.com/js/loggly.tracker.min.map, which doesn't exist. This produces an ugly 404 error in the JS console in browsers ...


Can you either put a source map file at http://cloudfront.loggly.com/js/loggly.tracker.min.map, or remove the source map line from the minified version of the client?

Thanks!

400 Bad Request when using NGINX proxy to avoid adblock

Hi,

I'm currently trying to get loggly js logging working trough my nginx network (see: https://github.com/loggly/loggly-jslogger#setup-proxy-for-ad-blockers). Somehow it does not work and always gives me '400 Bad Request'-errors.

I'm using the config file in the example as-is (no changes made) and the API request works just fine if I remove my own domain name from the url and replace it by: http://logs-01.loggly.com

So it works when I have no nginx in between, so I believe it's nginx to blame but I just can't place what it could be.

Anyone else having this problem? Thanks!

CVE-2020-8203 (High) detected in lodash-3.10.1.tgz, lodash-4.3.0.tgz

CVE-2020-8203 - High Severity Vulnerability

Vulnerable Libraries - lodash-3.10.1.tgz, lodash-4.3.0.tgz

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-log-1.0.0.tgz
      • lodash-3.10.1.tgz (Vulnerable Library)
lodash-4.3.0.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.3.0.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/grunt-legacy-util/node_modules/lodash/package.json,loggly-jslogger/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-util-1.0.0.tgz
      • lodash-4.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-23

Fix Resolution: lodash - 4.17.19

CVE-2020-11023 (Medium) detected in jquery-1.8.1.min.js

CVE-2020-11023 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: loggly-jslogger/node_modules/bower/lib/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: loggly-jslogger/node_modules/bower/lib/node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

  • jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11023

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0

Could not find a declaration file for module 'loggly-jslogger'

I have been trying to send my logs to Loggly using loggly-jslogger, but I am unable to do so.
I installed the package using npm-- 'npm i loggly-jslogger'.

I created the logger as shown :

import { LogglyTracker } from 'loggly-jslogger';

const logger = new LogglyTracker();

logger.push({ 'logglyKey': 'MY_CUSTOMER_TOKEN' });

export default logger;

but the error due to very first line of the code states- "Could not find a declaration file for module 'loggly-jslogger'. '/home/Desktop/LOgginAttempt/node_modules/loggly-jslogger/index.js' implicitly has an 'any' type.
Try npm i --save-dev @types/loggly-jslogger if it exists or add a new declaration (.d.ts) file containing declare module 'loggly-jslogger';"

can you please suggest as to why I am facing this issue?

Stack trace features?

Any plans for this? Nothing fancy like TrackJS's telemetry, but at least backtraces like the ones provided by Rollbar, Airbrake, or GetSentry.

CVE-2020-11022 (Medium) detected in jquery-1.8.1.min.js

CVE-2020-11022 - Medium Severity Vulnerability

Vulnerable Library - jquery-1.8.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.8.1/jquery.min.js

Path to dependency file: loggly-jslogger/node_modules/bower/lib/node_modules/redeyed/examples/browser/index.html

Path to vulnerable library: loggly-jslogger/node_modules/bower/lib/node_modules/redeyed/examples/browser/index.html

Dependency Hierarchy:

  • jquery-1.8.1.min.js (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

CVE-2018-16487 (Medium) detected in lodash-3.10.1.tgz, lodash-4.3.0.tgz

CVE-2018-16487 - Medium Severity Vulnerability

Vulnerable Libraries - lodash-3.10.1.tgz, lodash-4.3.0.tgz

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-log-1.0.0.tgz
      • lodash-3.10.1.tgz (Vulnerable Library)
lodash-4.3.0.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.3.0.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/grunt-legacy-util/node_modules/lodash/package.json,loggly-jslogger/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-util-1.0.0.tgz
      • lodash-4.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.

Publish Date: 2019-02-01

URL: CVE-2018-16487

CVSS 3 Score Details (5.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16487

Release Date: 2019-02-01

Fix Resolution: 4.17.11

WS-2019-0163 (Medium) detected in bower-1.8.0.tgz

WS-2019-0163 - Medium Severity Vulnerability

Vulnerable Library - bower-1.8.0.tgz

The browser package manager

Library home page: https://registry.npmjs.org/bower/-/bower-1.8.0.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/bower/package.json

Dependency Hierarchy:

  • bower-1.8.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

bower before 1.8.8 has an n arbitrary file write vulnerability. caused by Symlink Arbitrary File Overwrite

Publish Date: 2019-01-23

URL: WS-2019-0163

CVSS 2 Score Details (5.0)

Base Score Metrics not available

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/776

Release Date: 2019-07-15

Fix Resolution: 1.8.8


  • Check this box to open an automated fix PR

Disable logging when page is loaded by webcrawler

Is there a way that I can disable my loggly logger whenever a webpage is loaded by a web crawler ? I have a Javascript Lib that logs using loggly. It is installed on some client sites, when their sites get loaded by a webcrawler some "errors" happen and force loggly to log a bunch of false positives. How can I handle this ?

Publish to npm

Hi there,

Is there any chance you could publish this to npm as well as bower? You'll just need to update your package.json file to add an extra field like so:

browser: "src/loggly.tracker.js",

Change the version to 2.3.0 to match what's on bower, and then run npm publish

Thanks!

CVE-2022-0436 (Medium) detected in grunt-1.3.0.tgz

CVE-2022-0436 - Medium Severity Vulnerability

Vulnerable Library - grunt-1.3.0.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-1.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/grunt/package.json

Dependency Hierarchy:

  • grunt-1.3.0.tgz (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Path Traversal in GitHub repository gruntjs/grunt prior to 1.5.2.

Publish Date: 2022-04-12

URL: CVE-2022-0436

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0436

Release Date: 2022-04-12

Fix Resolution: 1.5.1


  • Check this box to open an automated fix PR

Support for levels

Is there support for levels such as info, warn, error etc?
If so, It's missing from the documentation

CVE-2019-10744 (High) detected in lodash-3.10.1.tgz, lodash-4.3.0.tgz

CVE-2019-10744 - High Severity Vulnerability

Vulnerable Libraries - lodash-3.10.1.tgz, lodash-4.3.0.tgz

lodash-3.10.1.tgz

The modern build of lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-3.10.1.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-log-1.0.0.tgz
      • lodash-3.10.1.tgz (Vulnerable Library)
lodash-4.3.0.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.3.0.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/grunt-legacy-util/node_modules/lodash/package.json,loggly-jslogger/node_modules/grunt-legacy-log-utils/node_modules/lodash/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Root Library)
    • grunt-legacy-util-1.0.0.tgz
      • lodash-4.3.0.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-26

URL: CVE-2019-10744

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jf85-cpcp-j695

Release Date: 2019-07-08

Fix Resolution: lodash-4.17.12, lodash-amd-4.17.12, lodash-es-4.17.12, lodash.defaultsdeep-4.6.1, lodash.merge- 4.6.2, lodash.mergewith-4.6.2, lodash.template-4.5.0

CVE-2020-7729 (High) detected in grunt-1.0.1.tgz

CVE-2020-7729 - High Severity Vulnerability

Vulnerable Library - grunt-1.0.1.tgz

The JavaScript Task Runner

Library home page: https://registry.npmjs.org/grunt/-/grunt-1.0.1.tgz

Path to dependency file: loggly-jslogger/package.json

Path to vulnerable library: loggly-jslogger/node_modules/grunt/package.json

Dependency Hierarchy:

  • grunt-1.0.1.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

The package grunt before 1.3.0 are vulnerable to Arbitrary Code Execution due to the default usage of the function load() instead of its secure replacement safeLoad() of the package js-yaml inside grunt.file.readYAML.

Publish Date: 2020-09-03

URL: CVE-2020-7729

CVSS 3 Score Details (7.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7729

Release Date: 2020-07-21

Fix Resolution: 1.3.0


  • Check this box to open an automated fix PR

CVE-2022-37598 (High) detected in uglify-js-3.4.10.tgz

CVE-2022-37598 - High Severity Vulnerability

Vulnerable Library - uglify-js-3.4.10.tgz

JavaScript parser, mangler/compressor and beautifier toolkit

Library home page: https://registry.npmjs.org/uglify-js/-/uglify-js-3.4.10.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/uglify-js/package.json

Dependency Hierarchy:

  • grunt-contrib-uglify-3.4.0.tgz (Root Library)
    • uglify-js-3.4.10.tgz (Vulnerable Library)

Found in HEAD commit: 3247b5841e5a8923baf2e98a1914570b38eadd97

Found in base branch: master

Vulnerability Details

** DISPUTED ** Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.

Publish Date: 2022-10-20

URL: CVE-2022-37598

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-10-20

Fix Resolution (uglify-js): 3.13.10

Direct dependency fix Resolution (grunt-contrib-uglify): 4.0.1


  • Check this box to open an automated fix PR

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.