Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

### How to read the report | Suppressing false positives | Getting Help: github issues
Sponsor

## Project: ewizard-cli

Scan Information:

- dependency-check version: 9.0.7
- Report Generated On: Fri, 2 Feb 2024 10:34:56 GMT
- Dependencies Scanned: 6829 (2143 unique)
- Vulnerable Dependencies: 19
- Vulnerabilities Found: 37
- Vulnerabilities Suppressed: 0

## Summary

Dependency | Vulnerability IDs | Package | Highest Severity | CVE Count | Confidence | Evidence Count
--- | --- | --- | --- | --- | --- | ---
ajv:5.5.2 | cpe:2.3:a:ajv.js:ajv:5.5.2:*:*:*:*:*:*:* | pkg:npm/ajv@5.5.2 | MEDIUM | 1 | Highest | 8
css-what:2.1.3 | cpe:2.3:a:css-what_project:css-what:2.1.3:*:*:*:*:*:*:* | pkg:npm/css-what@2.1.3 | HIGH | 1 | Highest | 6
css-what:3.4.2 | cpe:2.3:a:css-what_project:css-what:3.4.2:*:*:*:*:*:*:* | pkg:npm/css-what@3.4.2 | HIGH | 1 | Highest | 6
glob-parent:3.1.0 |  | pkg:npm/glob-parent@3.1.0 | HIGH | 1 |  | 8
got:6.7.1 | cpe:2.3:a:got_project:got:6.7.1:*:*:*:*:*:*:* | pkg:npm/got@6.7.1 | MEDIUM | 1 | Highest | 11
jsonwebtoken:8.5.1 | cpe:2.3:a:auth0:jsonwebtoken:8.5.1:*:*:*:*:*:*:* | pkg:npm/jsonwebtoken@8.5.1 | HIGH | 6 | Highest | 7
keycloak-connect:6.0.1 |  | pkg:npm/keycloak-connect@6.0.1 | MEDIUM | 3 |  | 9
node-forge:0.10.0 |  | pkg:npm/node-forge@0.10.0 | HIGH | 4 |  | 11
nth-check:1.0.2 | cpe:2.3:a:nth-check_project:nth-check:1.0.2:*:*:*:*:*:*:* | pkg:npm/nth-check@1.0.2 | HIGH | 1 | Highest | 8
opener:1.5.2 | cpe:2.3:a:opener_project:opener:1.5.2:*:*:*:*:*:*:* | pkg:npm/opener@1.5.2 | CRITICAL | 7 | Highest | 11
parse-url:7.0.2 | cpe:2.3:a:parse-url_project:parse-url:7.0.2:*:*:*:*:*:*:* | pkg:npm/parse-url@7.0.2 | CRITICAL | 2 | Highest | 8
postcss:7.0.39 | cpe:2.3:a:postcss:postcss:7.0.39:*:*:*:*:*:*:* | pkg:npm/postcss@7.0.39 | MEDIUM | 1 | Highest | 7
ramda:0.25.0 | cpe:2.3:a:ramdajs:ramda:0.25.0:*:*:*:*:*:*:* | pkg:npm/ramda@0.25.0 | CRITICAL | 1 | Highest | 7
ramda:0.26.1 | cpe:2.3:a:ramdajs:ramda:0.26.1:*:*:*:*:*:*:* | pkg:npm/ramda@0.26.1 | CRITICAL | 1 | Highest | 7
request:2.88.2 | cpe:2.3:a:request_project:request:2.88.2:*:*:*:*:*:*:* | pkg:npm/request@2.88.2 | MEDIUM | 2 | Highest | 10
scss-tokenizer:0.4.3 | cpe:2.3:a:scss-tokenizer_project:scss-tokenizer:0.4.3:*:*:*:*:*:*:* | pkg:npm/scss-tokenizer@0.4.3 | HIGH | 1 | Highest | 8
static-server:2.2.1 |  | pkg:npm/static-server@2.2.1 | HIGH | 1 |  | 6
tough-cookie:2.5.0 | cpe:2.3:a:salesforce:tough-cookie:2.5.0:*:*:*:*:*:*:* | pkg:npm/tough-cookie@2.5.0 | CRITICAL | 1 | Highest | 10
webpack:4.47.0 | cpe:2.3:a:webpack.js:webpack:4.47.0:*:*:*:*:*:*:* | pkg:npm/webpack@4.47.0 | CRITICAL | 1 | Highest | 7

## Dependencies

### ajv:5.5.2

Description:

    Another JSON Schema Validator

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?table:4.0.2/ajv:^5.2.3
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0/webpack:4.47.0
- ewizard-cli:1.1.0/schema-utils:3.3.0
- ewizard-cli:1.1.0
- ewizard-cli:1.1.0/schema-utils:1.0.0
- ewizard-cli:1.1.0/table:4.0.2
- ewizard-cli:1.1.0/eslint:4.19.1
- ewizard-cli:1.1.0/schema-utils:2.7.1
- ewizard-cli:1.1.0/har-validator:5.1.5

#### Related Dependencies

- ajv:5.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/ajv:5.5.2
  - pkg:npm/ajv@5.5.2
- ajv:5.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?eslint:4.19.1/ajv:^5.3.0
  - pkg:npm/ajv@5.5.2
- ajv:5.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?schema-utils:1.0.0/ajv:^6.1.0
  - pkg:npm/ajv@5.5.2
- ajv:5.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?schema-utils:3.3.0/ajv:^6.12.5
  - pkg:npm/ajv@5.5.2
- ajv:6.12.6
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/ajv:6.12.6
  - pkg:npm/ajv@6.12.6
- ajv:6.12.6
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?har-validator:5.1.5/ajv:^6.12.3
  - pkg:npm/ajv@6.12.6
- ajv:6.12.6
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?schema-utils:2.7.1/ajv:^6.12.4
  - pkg:npm/ajv@6.12.6
- ajv:6.12.6
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?webpack:4.47.0/ajv:^6.10.2
  - pkg:npm/ajv@6.12.6

#### Identifiers

- pkg:npm/ajv@5.5.2 (Confidence:Highest)
- cpe:2.3:a:ajv.js:ajv:5.5.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2020-15366 (OSSINDEX)

    An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2020-15366 for details

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSSv3:

- Base Score: MEDIUM (5.599999904632568)
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References:

- OSSINDEX - [CVE-2020-15366] CWE-1321
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15366
- OSSIndex - https://github.com/ajv-validator/ajv/releases/tag/v6.12.3

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:ajv:5.5.2:*:*:*:*:*:*:*

### css-what:2.1.3

Description:

    a CSS selector parser

License:

    BSD-2-Clause

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/css-what:2.1.3
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0/css-select:1.2.0
- ewizard-cli:1.1.0/css-select:2.1.0
- ewizard-cli:1.1.0
- ewizard-cli:1.1.0/css-select:4.3.0

#### Related Dependencies

- css-what:2.1.3
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:1.2.0/css-what:2.1
  - pkg:npm/css-what@2.1.3
- css-what:2.1.3
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:2.1.0/css-what:^3.2.1
  - pkg:npm/css-what@2.1.3
- css-what:2.1.3
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:4.3.0/css-what:^6.0.1
  - pkg:npm/css-what@2.1.3

#### Identifiers

- pkg:npm/css-what@2.1.3 (Confidence:Highest)
- cpe:2.3:a:css-what_project:css-what:2.1.3:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-21222 (OSSINDEX)

    The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2022-21222 for details

CWE-1333 Inefficient Regular Expression Complexity
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

- OSSINDEX - [CVE-2022-21222] CWE-1333
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21222
- OSSIndex - https://bugzilla.redhat.com/show_bug.cgi?id=2131335

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:css-what:2.1.3:*:*:*:*:*:*:*

### css-what:3.4.2

Description:

    a CSS selector parser

License:

    BSD-2-Clause

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/css-what:3.4.2
Referenced In Project/Scope: ewizard-cli:1.1.0

#### Identifiers

- pkg:npm/css-what@3.4.2 (Confidence:Highest)
- cpe:2.3:a:css-what_project:css-what:3.4.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-21222 (OSSINDEX)

    The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2022-21222 for details

CWE-1333 Inefficient Regular Expression Complexity
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

- OSSINDEX - [CVE-2022-21222] CWE-1333
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21222
- OSSIndex - https://bugzilla.redhat.com/show_bug.cgi?id=2131335

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:css-what:3.4.2:*:*:*:*:*:*:*

### glob-parent:3.1.0

Description:

    Strips glob magic from a string to provide the parent directory path

License:

    ISC

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?chokidar:2.1.8/glob-parent:^3.1.0
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0/copy-webpack-plugin:5.1.2
- ewizard-cli:1.1.0/chokidar:2.1.8
- ewizard-cli:1.1.0

#### Related Dependencies

- glob-parent:3.1.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/glob-parent:3.1.0
  - pkg:npm/glob-parent@3.1.0
- glob-parent:3.1.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?copy-webpack-plugin:5.1.2/glob-parent:^3.1.0
  - pkg:npm/glob-parent@3.1.0

#### Identifiers

- pkg:npm/glob-parent@3.1.0 (Confidence:Highest)

#### Published Vulnerabilities

CVE-2020-28469 (OSSINDEX)

    This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

CWE-400 Uncontrolled Resource Consumption
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

- OSSINDEX - [CVE-2020-28469] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28469
- OSSIndex - https://github.com/nadgowdas/hello-containers/pull/1#issuecomment-759710574

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:glob-parent:3.1.0:*:*:*:*:*:*:*

### got:6.7.1

Description:

    Simplified HTTP requests

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/got:6.7.1
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0/package-json:4.0.1
- ewizard-cli:1.1.0

#### Related Dependencies

- got:6.7.1
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?package-json:4.0.1/got:^6.7.1
  - pkg:npm/got@6.7.1

#### Identifiers

- pkg:npm/got@6.7.1 (Confidence:Highest)
- cpe:2.3:a:got_project:got:6.7.1:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-33987

    The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

NVD-CWE-noinfo
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

- Base Score: MEDIUM (5.3)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-33987] CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-33987
- OSSIndex - https://github.com/advisories/GHSA-pfrx-2q88-qq97
- OSSIndex - https://github.com/sindresorhus/got/pull/2047
- cve@mitre.org - PATCH,THIRD_PARTY_ADVISORY
- cve@mitre.org - PATCH,THIRD_PARTY_ADVISORY
- cve@mitre.org - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:got_project:got:*:*:*:*:*:node.js:*:* versions up to (excluding) 11.8.5

### jsonwebtoken:8.5.1

Description:

    JSON Web Token implementation (symmetric and asymmetric)

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/jsonwebtoken:8.5.1
Referenced In Project/Scope: ewizard-cli:1.1.0

#### Identifiers

- pkg:npm/jsonwebtoken@8.5.1 (Confidence:Highest)
- cpe:2.3:a:auth0:jsonwebtoken:8.5.1:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-23539

    Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you���ll need to set the `allowInvalidAsymmetricKeyTypes` option  to `true` in the `sign()` and/or `verify()` functions.

CWE-327 Use of a Broken or Risky Cryptographic Algorithm
CVSSv3:

- Base Score: HIGH (8.1)
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:2.8/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-23539] CWE-327: Use of a Broken or Risky Cryptographic Algorithm
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23539
- OSSIndex - https://github.com/auth0/node-jsonwebtoken/blob/e1fa9dcc12054a8681db4e6373da1b30cf7016e3/CHANGELOG.md#900---2022-12-21
- OSSIndex - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
- security-advisories@github.com - PATCH,THIRD_PARTY_ADVISORY
- security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* versions up to (including) 8.5.1

CVE-2022-23540

    In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don���t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.

CWE-347 Improper Verification of Cryptographic Signature, CWE-287 Improper Authentication
CVSSv3:

- Base Score: HIGH (7.6)
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L/E:2.8/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-23540] CWE-287: Improper Authentication
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23540
- OSSIndex - https://github.com/auth0/node-jsonwebtoken/blob/e1fa9dcc12054a8681db4e6373da1b30cf7016e3/CHANGELOG.md#900---2022-12-21
- OSSIndex - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
- security-advisories@github.com - PATCH
- security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* versions up to (including) 8.5.1

GHSA-qwph-4952-7xr6 (NPM)

    # Overview

    In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification.

    # Am I affected?
    You will be affected if all the following are true in the `jwt.verify()` function:
    - a token with no signature is received
    - no algorithms are specified
    - a falsy (e.g. null, false, undefined) secret or key is passed

    # How do I fix it?

    Update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method.

    # Will the fix impact my users?

    There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.

CWE-347 Improper Verification of Cryptographic Signature, CWE-327 Use of a Broken or Risky Cryptographic Algorithm, CWE-287 Improper Authentication
CVSSv3:

- Base Score: MEDIUM (6.400000095367432)
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Unscored:

- Severity: moderate

References:

- NPM Advisory reference: - https://github.com/advisories/GHSA-qwph-4952-7xr6
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
- NPM Advisory reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-23540

Vulnerable Software & Versions (NPM):

- cpe:2.3:a:*:jsonwebtoken:\<9.0.0:*:*:*:*:*:*:*

CVE-2022-23541

    jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of  forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

NVD-CWE-Other, CWE-1259 Improper Restriction of Security Token Assignment, CWE-287 Improper Authentication
CVSSv3:

- Base Score: MEDIUM (6.3)
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:2.8/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-23541] CWE-1259 CWE-287 CWE-Other
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23541
- OSSIndex - https://github.com/advisories/GHSA-hjrf-2m68-5959
- OSSIndex - https://github.com/auth0/node-jsonwebtoken/blob/e1fa9dcc12054a8681db4e6373da1b30cf7016e3/CHANGELOG.md#900---2022-12-21
- security-advisories@github.com - PATCH
- security-advisories@github.com - RELEASE_NOTES
- security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* versions up to (including) 8.5.1

GHSA-hjrf-2m68-5959 (NPM)

    # Overview

    Versions `<=8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function (referring to the `secretOrPublicKey` argument from the [readme link](https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback)) will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification  than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens.

    # Am I affected?

    You will be affected if your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function.

    # How do I fix it?

    Update to version 9.0.0.

    # Will the fix impact my users?

    There is no impact for end users

CWE-287 Improper Authentication
CVSSv3:

- Base Score: MEDIUM (5.0)
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Unscored:

- Severity: moderate

References:

- NPM Advisory reference: - https://github.com/advisories/GHSA-hjrf-2m68-5959
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
- NPM Advisory reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-23541

Vulnerable Software & Versions (NPM):

- cpe:2.3:a:*:jsonwebtoken:\<\=8.5.1:*:*:*:*:*:*:*

GHSA-8cf7-32gw-wr33 (NPM)

    # Overview

    Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm.

    # Am I affected?

    You are affected if you are using an algorithm and a key type other than the combinations mentioned below

    | Key type |  algorithm                                    |
    |----------|------------------------------------------|
    | ec           | ES256, ES384, ES512                      |
    | rsa          | RS256, RS384, RS512, PS256, PS384, PS512 |
    | rsa-pss  | PS256, PS384, PS512                      |

    And for Elliptic Curve algorithms:

    | `alg` | Curve      |
    |-------|------------|
    | ES256 | prime256v1 |
    | ES384 | secp384r1  |
    | ES512 | secp521r1  |

    # How do I fix it?

    Update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, If you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option  to `true` in the `sign()` and/or `verify()` functions.

    # Will the fix impact my users?

    There will be no impact, if you update to version 9.0.0 and you already use a valid secure combination of key type and algorithm. Otherwise,  use the  `allowInvalidAsymmetricKeyTypes` option  to `true` in the `sign()` and `verify()` functions to continue usage of invalid key type/algorithm combination in 9.0.0 for legacy compatibility.

CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Unscored:

- Severity: moderate

References:

- NPM Advisory reference: - https://github.com/advisories/GHSA-8cf7-32gw-wr33
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
- NPM Advisory reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-23539

Vulnerable Software & Versions (NPM):

- cpe:2.3:a:*:jsonwebtoken:\<\=8.5.1:*:*:*:*:*:*:*

### keycloak-connect:6.0.1

Description:

    Keycloak Connect Middleware

License:

    Apache-2.0

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/keycloak-connect:6.0.1
Referenced In Project/Scope: ewizard-cli:1.1.0

#### Identifiers

- pkg:npm/keycloak-connect@6.0.1 (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-2237 (OSSINDEX)

    A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2022-2237 for details

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CVSSv3:

- Base Score: MEDIUM (6.099999904632568)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

- OSSINDEX - [CVE-2022-2237] CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-2237
- OSSIndex - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-2237
- OSSIndex - https://github.com/keycloak/keycloak-nodejs-connect/security/advisories/GHSA-59fq-727j-hm3f

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:keycloak-connect:6.0.1:*:*:*:*:*:*:*

GHSA-59fq-727j-hm3f (NPM)

    There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using `checkSSO` with query param `prompt=none`.

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CVSSv3:

- Base Score: MEDIUM (6.099999904632568)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Unscored:

- Severity: moderate

References:

- NPM Advisory reference: - https://bugzilla.redhat.com/show_bug.cgi?id=2097007
- NPM Advisory reference: - https://github.com/advisories/GHSA-59fq-727j-hm3f
- NPM Advisory reference: - https://github.com/keycloak/keycloak-nodejs-connect/commit/190a9470e234bbd9ac5d5de43f5a19aead9a2c21
- NPM Advisory reference: - https://github.com/keycloak/keycloak-nodejs-connect/security/advisories/GHSA-59fq-727j-hm3f
- NPM Advisory reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-2237

Vulnerable Software & Versions (NPM):

- cpe:2.3:a:*:keycloak-connect:\<21.0.1:*:*:*:*:*:*:*

CVE-2020-1694 (OSSINDEX)

    A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2020-1694 for details

CWE-732 Incorrect Permission Assignment for Critical Resource
CVSSv3:

- Base Score: MEDIUM (4.900000095367432)
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References:

- OSSINDEX - [CVE-2020-1694] CWE-732: Incorrect Permission Assignment for Critical Resource
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1694
- OSSIndex - https://access.redhat.com/security/cve/cve-2020-1694
- OSSIndex - https://bugzilla.redhat.com/show_bug.cgi?id=1790759
- OSSIndex - https://github.com/keycloak/keycloak-nodejs-connect/pull/244

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:keycloak-connect:6.0.1:*:*:*:*:*:*:*

### node-forge:0.10.0

Description:

    JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

License:

    (BSD-3-Clause OR GPL-2.0)

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?selfsigned:1.10.14/node-forge:^0.10.0
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0/selfsigned:1.10.14
- ewizard-cli:1.1.0

#### Related Dependencies

- node-forge:0.10.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/node-forge:0.10.0
  - pkg:npm/node-forge@0.10.0

#### Identifiers

- pkg:npm/node-forge@0.10.0 (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-24771 (OSSINDEX)

    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

CWE-347 Improper Verification of Cryptographic Signature
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

- OSSINDEX - [CVE-2022-24771] CWE-347: Improper Verification of Cryptographic Signature
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24771
- OSSIndex - https://github.com/digitalbazaar/forge/security/advisories/GHSA-cfm4-qjh2-4765

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:node-forge:0.10.0:*:*:*:*:*:*:*

CVE-2022-24772 (OSSINDEX)

    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

CWE-347 Improper Verification of Cryptographic Signature
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

References:

- OSSINDEX - [CVE-2022-24772] CWE-347: Improper Verification of Cryptographic Signature
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24772
- OSSIndex - https://github.com/digitalbazaar/forge/security/advisories/GHSA-x4jg-mjrx-434g

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:node-forge:0.10.0:*:*:*:*:*:*:*

CVE-2022-0122 (OSSINDEX)

    forge is vulnerable to URL Redirection to Untrusted Site

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CVSSv3:

- Base Score: MEDIUM (6.099999904632568)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

- OSSINDEX - [CVE-2022-0122] CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-0122
- OSSIndex - https://github.com/digitalbazaar/forge/pull/934
- OSSIndex - https://www.huntr.dev/bounties/41852c50-3c6d-4703-8c55-4db27164a4ae/

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:node-forge:0.10.0:*:*:*:*:*:*:*

CVE-2022-24773 (OSSINDEX)

    Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not properly check `DigestInfo` for a proper ASN.1 structure. This can lead to successful verification with signatures that contain invalid structures but a valid digest. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.

CWE-347 Improper Verification of Cryptographic Signature
CVSSv3:

- Base Score: MEDIUM (5.300000190734863)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

References:

- OSSINDEX - [CVE-2022-24773] CWE-347: Improper Verification of Cryptographic Signature
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-24773
- OSSIndex - https://github.com/digitalbazaar/forge/security/advisories/GHSA-2r2c-g63r-vccr

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:node-forge:0.10.0:*:*:*:*:*:*:*

### nth-check:1.0.2

Description:

    performant nth-check parser & compiler

License:

    BSD-2-Clause

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:2.1.0/nth-check:^1.0.2
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0/css-select:1.2.0
- ewizard-cli:1.1.0/css-select:2.1.0
- ewizard-cli:1.1.0
- ewizard-cli:1.1.0/css-select:4.3.0

#### Related Dependencies

- nth-check:1.0.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/nth-check:1.0.2
  - pkg:npm/nth-check@1.0.2
- nth-check:1.0.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:1.2.0/nth-check:~1.0.1
  - pkg:npm/nth-check@1.0.2
- nth-check:1.0.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:4.3.0/nth-check:^2.0.1
  - pkg:npm/nth-check@1.0.2

#### Identifiers

- pkg:npm/nth-check@1.0.2 (Confidence:Highest)
- cpe:2.3:a:nth-check_project:nth-check:1.0.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2021-3803

    nth-check is vulnerable to Inefficient Regular Expression Complexity

CWE-1333 Inefficient Regular Expression Complexity
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2021-3803] CWE-1333
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3803
- OSSIndex - https://github.com/advisories/GHSA-rp65-9cf3-cjxr
- OSSIndex - https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0/
- security@huntr.dev - EXPLOIT,ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY
- security@huntr.dev - MAILING_LIST,THIRD_PARTY_ADVISORY
- security@huntr.dev - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:nth-check_project:nth-check:*:*:*:*:*:*:*:* versions up to (excluding) 2.0.1

### opener:1.5.2

Description:

    Opens stuff, like webpages and files and executables, cross-platform

License:

    (WTFPL OR MIT)

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?webpack-bundle-analyzer:4.10.1/opener:^1.5.2
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0/webpack-bundle-analyzer:4.10.1
- ewizard-cli:1.1.0
- ewizard-cli:1.1.0/npm-legacy:6.14.18

#### Related Dependencies

- opener:1.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/opener:1.5.2
  - pkg:npm/opener@1.5.2
- opener:1.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?npm-legacy:6.14.18/opener:^1.5.2
  - pkg:npm/opener@1.5.2

#### Identifiers

- pkg:npm/opener@1.5.2 (Confidence:Highest)
- cpe:2.3:a:opener_project:opener:1.5.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-43604

    An out-of-bounds write vulnerability exists in the GetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out-of-bounds write, potentially causing the server to crash or allow for remote code execution. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.

CWE-787 Out-of-bounds Write
CVSSv3:

- Base Score: CRITICAL (9.8)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

- talos-cna@cisco.com - EXPLOIT,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (excluding) 2022-10-18

CVE-2022-43605

    An out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out of bounds write, potentially causing the server to crash or allow for remote code execution. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.

CWE-787 Out-of-bounds Write
CVSSv3:

- Base Score: CRITICAL (9.8)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

- talos-cna@cisco.com - EXPLOIT,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (excluding) 2022-10-18

CVE-2021-27478

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may cause a denial-of-service condition.

CWE-681 Incorrect Conversion between Numeric Types
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY
- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (including) 2.3

CVE-2021-27482

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may allow the attacker to read arbitrary data.

CWE-125 Out-of-bounds Read
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY
- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (including) 2.3

CVE-2021-27498

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.

CWE-617 Reachable Assertion
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY
- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (including) 2.3

CVE-2021-27500

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.

CWE-617 Reachable Assertion
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY
- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (including) 2.3

CVE-2022-43606

    A use-of-uninitialized-pointer vulnerability exists in the Forward Open connection_management_entry functionality of EIP Stack Group OpENer development commit 58ee13c. A specially-crafted EtherNet/IP request can lead to use of a null pointer, causing the server to crash. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.

CWE-824 Access of Uninitialized Pointer
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- talos-cna@cisco.com - EXPLOIT,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (excluding) 2022-10-18

### parse-url:7.0.2

Description:

    An advanced url parser supporting git urls too.

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/parse-url:7.0.2
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0
- ewizard-cli:1.1.0/git-up:6.0.0

#### Related Dependencies

- parse-url:7.0.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?git-up:6.0.0/parse-url:^7.0.2
  - pkg:npm/parse-url@7.0.2

#### Identifiers

- pkg:npm/parse-url@7.0.2 (Confidence:Highest)
- cpe:2.3:a:parse-url_project:parse-url:7.0.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-2900

    Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.

CWE-918 Server-Side Request Forgery (SSRF)
CVSSv3:

- Base Score: CRITICAL (9.1)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-2900] CWE-918: Server-Side Request Forgery (SSRF)
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-2900
- OSSIndex - https://github.com/IonicaBizau/parse-url/pull/55
- OSSIndex - https://www.huntr.dev/bounties/1b4c972a-abc8-41eb-a2e1-696db746b5fd/
- security@huntr.dev - EXPLOIT,PATCH,THIRD_PARTY_ADVISORY
- security@huntr.dev - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:parse-url_project:parse-url:*:*:*:*:*:*:*:* versions up to (excluding) 8.1.0

CVE-2022-3224

    Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.

CWE-115 Misinterpretation of Input
CVSSv3:

- Base Score: MEDIUM (6.1)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:2.8/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-3224] CWE-115: Misinterpretation of Input
- OSSIndex - https://github.com/IonicaBizau/parse-url/pull/58
- OSSIndex - https://github.com/IonicaBizau/parse-url/pull/65
- OSSIndex - https://www.huntr.dev/bounties/3587a567-7fcd-4702-b7c9-d9ca565e3c62/
- security@huntr.dev - EXPLOIT,ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY
- security@huntr.dev - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:parse-url_project:parse-url:*:*:*:*:*:*:*:* versions up to (excluding) 8.1.0

### postcss:7.0.39

Description:

    Tool for transforming styles with JS plugins

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/postcss:7.0.39
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0/postcss-minify-selectors:4.0.2
- ewizard-cli:1.1.0/icss-utils:4.1.1
- ewizard-cli:1.1.0/postcss-reduce-initial:4.0.3
- ewizard-cli:1.1.0/postcss-discard-empty:4.0.1
- ewizard-cli:1.1.0/postcss-normalize-charset:4.0.1
- ewizard-cli:1.1.0/postcss-reduce-transforms:4.0.2
- ewizard-cli:1.1.0/postcss-loader:3.0.0
- ewizard-cli:1.1.0/autoprefixer:9.8.8
- ewizard-cli:1.1.0/stylehacks:4.0.3
- ewizard-cli:1.1.0/postcss-normalize-positions:4.0.2
- ewizard-cli:1.1.0/postcss-minify-font-values:4.0.2
- ewizard-cli:1.1.0/cssnano:4.1.11
- ewizard-cli:1.1.0/postcss-unique-selectors:4.0.1
- ewizard-cli:1.1.0/postcss-svgo:4.0.3
- ewizard-cli:1.1.0/postcss-normalize-url:4.0.1
- ewizard-cli:1.1.0/postcss-normalize-display-values:4.0.2
- ewizard-cli:1.1.0/postcss-modules-values:3.0.0
- ewizard-cli:1.1.0/postcss-modules-extract-imports:2.0.0
- ewizard-cli:1.1.0/postcss-ordered-values:4.1.2
- ewizard-cli:1.1.0/postcss-modules-scope:2.2.0
- ewizard-cli:1.1.0/postcss-minify-gradients:4.0.2
- ewizard-cli:1.1.0/@vue/component-compiler-utils:3.3.0
- ewizard-cli:1.1.0/postcss-discard-comments:4.0.2
- ewizard-cli:1.1.0/postcss-convert-values:4.0.1
- ewizard-cli:1.1.0/postcss-normalize-whitespace:4.0.2
- ewizard-cli:1.1.0/cssnano-preset-default:4.0.8
- ewizard-cli:1.1.0/postcss-colormin:4.0.3
- ewizard-cli:1.1.0/css-loader:3.6.0
- ewizard-cli:1.1.0/postcss-normalize-string:4.0.2
- ewizard-cli:1.1.0/postcss-modules-local-by-default:3.0.3
- ewizard-cli:1.1.0/postcss-merge-longhand:4.0.11
- ewizard-cli:1.1.0/postcss-minify-params:4.0.2
- ewizard-cli:1.1.0/postcss-merge-rules:4.0.3
- ewizard-cli:1.1.0/postcss-discard-duplicates:4.0.2
- ewizard-cli:1.1.0
- ewizard-cli:1.1.0/postcss-calc:7.0.5
- ewizard-cli:1.1.0/cssnano-util-raw-cache:4.0.1
- ewizard-cli:1.1.0/css-declaration-sorter:4.0.1
- ewizard-cli:1.1.0/postcss-normalize-timing-functions:4.0.2
- ewizard-cli:1.1.0/postcss-normalize-repeat-style:4.0.2
- ewizard-cli:1.1.0/postcss-normalize-unicode:4.0.1
- ewizard-cli:1.1.0/postcss-discard-overridden:4.0.1

#### Related Dependencies

- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@vue/component-compiler-utils:3.3.0/postcss:^7.0.36
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?autoprefixer:9.8.8/postcss:^7.0.32
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-declaration-sorter:4.0.1/postcss:^7.0.1
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-loader:3.6.0/postcss:^7.0.32
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?cssnano-preset-default:4.0.8/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?cssnano-util-raw-cache:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?cssnano:4.1.11/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?icss-utils:4.1.1/postcss:^7.0.14
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-calc:7.0.5/postcss:^7.0.27
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-colormin:4.0.3/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-convert-values:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-discard-comments:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-discard-duplicates:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-discard-empty:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-discard-overridden:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-loader:3.0.0/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-merge-longhand:4.0.11/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-merge-rules:4.0.3/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-minify-font-values:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-minify-gradients:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-minify-params:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-minify-selectors:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-modules-extract-imports:2.0.0/postcss:^7.0.5
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-modules-local-by-default:3.0.3/postcss:^7.0.32
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-modules-scope:2.2.0/postcss:^7.0.6
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-modules-values:3.0.0/postcss:^7.0.6
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-charset:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-display-values:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-positions:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-repeat-style:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-string:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-timing-functions:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-unicode:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-url:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-whitespace:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-ordered-values:4.1.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-reduce-initial:4.0.3/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-reduce-transforms:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-svgo:4.0.3/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-unique-selectors:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?stylehacks:4.0.3/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39

#### Identifiers

- pkg:npm/postcss@7.0.39 (Confidence:Highest)
- cpe:2.3:a:postcss:postcss:7.0.39:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2023-44270

    An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv3:

- Base Score: MEDIUM (5.3)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2023-44270] CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-44270
- OSSIndex - https://github.com/postcss/postcss/releases/tag/8.4.31
- cve@mitre.org - ISSUE_TRACKING
- cve@mitre.org - ISSUE_TRACKING
- cve@mitre.org - PATCH
- cve@mitre.org - PATCH,RELEASE_NOTES

Vulnerable Software & Versions:

- cpe:2.3:a:postcss:postcss:*:*:*:*:*:node.js:*:* versions up to (excluding) 8.4.31

### ramda:0.25.0

Description:

    A practical functional library for JavaScript programmers.

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/ramda:0.25.0
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0
- ewizard-cli:1.1.0/@ewizardjs/dev-builder:4.14.1

#### Related Dependencies

- ramda:0.25.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@ewizardjs/dev-builder:4.14.1/ramda:^0.25.0
  - pkg:npm/ramda@0.25.0

#### Identifiers

- pkg:npm/ramda@0.25.0 (Confidence:Highest)
- cpe:2.3:a:ramdajs:ramda:0.25.0:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2021-42581

    Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "__proto__") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSSv2:

- Base Score: MEDIUM (6.4)
- Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSSv3:

- Base Score: CRITICAL (9.1)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

- cve@mitre.org - EXPLOIT,THIRD_PARTY_ADVISORY
- cve@mitre.org - ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:ramdajs:ramda:*:*:*:*:*:*:*:* versions up to (including) 0.27.0

### ramda:0.26.1

Description:

    A practical functional library for JavaScript programmers.

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/ramda:0.26.1
Referenced In Project/Scope: ewizard-cli:1.1.0

#### Identifiers

- pkg:npm/ramda@0.26.1 (Confidence:Highest)
- cpe:2.3:a:ramdajs:ramda:0.26.1:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2021-42581

    Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "__proto__") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSSv2:

- Base Score: MEDIUM (6.4)
- Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSSv3:

- Base Score: CRITICAL (9.1)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

- cve@mitre.org - EXPLOIT,THIRD_PARTY_ADVISORY
- cve@mitre.org - ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:ramdajs:ramda:*:*:*:*:*:*:*:* versions up to (including) 0.27.0

### request:2.88.2

Description:

    Simplified HTTP request client.

License:

    Apache-2.0

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/request:2.88.2
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0/node-gyp:5.1.1
- ewizard-cli:1.1.0
- ewizard-cli:1.1.0/npm-legacy:6.14.18

#### Related Dependencies

- request:2.88.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?node-gyp:5.1.1/request:^2.88.0
  - pkg:npm/request@2.88.2
- request:2.88.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?npm-legacy:6.14.18/request:^2.88.2
  - pkg:npm/request@2.88.2

#### Identifiers

- pkg:npm/request@2.88.2 (Confidence:Highest)
- cpe:2.3:a:request_project:request:2.88.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2023-28155 (OSSINDEX)

    The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CWE-918 Server-Side Request Forgery (SSRF)
CVSSv3:

- Base Score: MEDIUM (6.099999904632568)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

- OSSINDEX - [CVE-2023-28155] CWE-918: Server-Side Request Forgery (SSRF)
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28155
- OSSIndex - https://github.com/advisories/GHSA-p8p7-x288-28g6
- OSSIndex - https://github.com/request/request/issues/3442
- OSSIndex - https://github.com/request/request/pull/3444

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:request:2.88.2:*:*:*:*:*:*:*

GHSA-p8p7-x288-28g6 (NPM)

    The `request` package through 2.88.2 for Node.js and the `@cypress/request` package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).

    NOTE: The `request` package is no longer supported by the maintainer.

CWE-918 Server-Side Request Forgery (SSRF)
CVSSv3:

- Base Score: MEDIUM (6.099999904632568)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Unscored:

- Severity: moderate

References:

- NPM Advisory reference: - https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf
- NPM Advisory reference: - https://github.com/advisories/GHSA-p8p7-x288-28g6
- NPM Advisory reference: - https://github.com/cypress-io/request/blob/master/lib/redirect.js#L116
- NPM Advisory reference: - https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f
- NPM Advisory reference: - https://github.com/cypress-io/request/pull/28
- NPM Advisory reference: - https://github.com/cypress-io/request/releases/tag/v3.0.0
- NPM Advisory reference: - https://github.com/github/advisory-database/pull/2500
- NPM Advisory reference: - https://github.com/request/request/blob/master/lib/redirect.js#L111
- NPM Advisory reference: - https://github.com/request/request/issues/3442
- NPM Advisory reference: - https://github.com/request/request/pull/3444
- NPM Advisory reference: - https://nvd.nist.gov/vuln/detail/CVE-2023-28155
- NPM Advisory reference: - https://security.netapp.com/advisory/ntap-20230413-0007/

Vulnerable Software & Versions (NPM):

- cpe:2.3:a:*:request:\<\=2.88.2:*:*:*:*:*:*:*

### scss-tokenizer:0.4.3

Description:

    A tokenzier for Sass' SCSS syntax

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/scss-tokenizer:0.4.3
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0
- ewizard-cli:1.1.0/sass-graph:4.0.1

#### Related Dependencies

- scss-tokenizer:0.4.3
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?sass-graph:4.0.1/scss-tokenizer:^0.4.3
  - pkg:npm/scss-tokenizer@0.4.3

#### Identifiers

- pkg:npm/scss-tokenizer@0.4.3 (Confidence:Highest)
- cpe:2.3:a:scss-tokenizer_project:scss-tokenizer:0.4.3:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-25758

    All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.

CWE-1333 Inefficient Regular Expression Complexity
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- report@snyk.io - EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY
- report@snyk.io - EXPLOIT,THIRD_PARTY_ADVISORY
- report@snyk.io - EXPLOIT,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:scss-tokenizer_project:scss-tokenizer:*:*:*:*:*:node.js:*:*

### static-server:2.2.1

Description:

    A simple http server to serve static resource files from a local directory.

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/static-server:2.2.1
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0
- ewizard-cli:1.1.0/@ewizardjs/blocks-renderer:1.1.1

#### Related Dependencies

- static-server:2.2.1
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@ewizardjs/blocks-renderer:1.1.1/static-server:^2.2.1
  - pkg:npm/static-server@2.2.1

#### Identifiers

- pkg:npm/static-server@2.2.1 (Confidence:Highest)

#### Published Vulnerabilities

CVE-2023-26152 (OSSINDEX)

    All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server.js.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2023-26152 for details

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

- OSSINDEX - [CVE-2023-26152] CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-26152
- OSSIndex - https://gist.github.com/lirantal/1f7021703a2065ecaf9ec9e06a3a346d

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:static-server:2.2.1:*:*:*:*:*:*:*

### tough-cookie:2.5.0

Description:

    RFC6265 Cookies and Cookie Jar for node.js

License:

    BSD-3-Clause

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/tough-cookie:2.5.0
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0/request-promise-native:1.0.9
- ewizard-cli:1.1.0/request:2.88.2
- ewizard-cli:1.1.0

#### Related Dependencies

- tough-cookie:2.5.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?request-promise-native:1.0.9/tough-cookie:^2.3.3
  - pkg:npm/tough-cookie@2.5.0
- tough-cookie:2.5.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?request:2.88.2/tough-cookie:~2.5.0
  - pkg:npm/tough-cookie@2.5.0

#### Identifiers

- pkg:npm/tough-cookie@2.5.0 (Confidence:Highest)
- cpe:2.3:a:salesforce:tough-cookie:2.5.0:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2023-26136

    Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSSv3:

- Base Score: CRITICAL (9.8)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2023-26136] CWE-1321
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-26136
- OSSIndex - https://github.com/salesforce/tough-cookie/issues/282
- OSSIndex - https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3
- report@snyk.io - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
- report@snyk.io - EXPLOIT,TECHNICAL_DESCRIPTION,THIRD_PARTY_ADVISORY
- report@snyk.io - PATCH
- report@snyk.io - RELEASE_NOTES

Vulnerable Software & Versions:

- cpe:2.3:a:salesforce:tough-cookie:*:*:*:*:*:node.js:*:* versions up to (excluding) 4.1.3

### webpack:4.47.0

Description:

    Packs CommonJs/AMD modules for the browser. Allows to split your codebase into multiple bundles, which can be loaded on demand. Support loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/webpack:4.47.0
Referenced In Projects/Scopes:

- ewizard-cli:1.1.0
- ewizard-cli:1.1.0/@ewizardjs/component-builder:2.3.0
- ewizard-cli:1.1.0/@ewizardjs/dev-builder:4.14.1
- ewizard-cli:1.1.0/@ewizardjs/builder-utils:5.18.1

#### Related Dependencies

- webpack:4.47.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@ewizardjs/builder-utils:5.18.1/webpack:^4.47.0
  - pkg:npm/webpack@4.47.0
- webpack:4.47.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@ewizardjs/component-builder:2.3.0/webpack:^4.46.0
  - pkg:npm/webpack@4.47.0
- webpack:4.47.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@ewizardjs/dev-builder:4.14.1/webpack:^4.43.0
  - pkg:npm/webpack@4.47.0

#### Identifiers

- pkg:npm/webpack@4.47.0 (Confidence:Highest)
- cpe:2.3:a:webpack.js:webpack:4.47.0:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2023-28154 (OSSINDEX)

    Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2023-28154 for details

CWE-noinfo
CVSSv3:

- Base Score: CRITICAL (9.800000190734863)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

- OSSINDEX - [CVE-2023-28154] CWE-noinfo
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28154
- OSSIndex - https://github.com/webpack/webpack/pull/16500

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:webpack:4.47.0:*:*:*:*:*:*:*

This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.