Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

### How to read the report | Suppressing false positives | Getting Help: github issues
Sponsor

## Project: ewizard-cli

Scan Information:

- dependency-check version: 9.0.9
- Report Generated On: Mon, 25 Mar 2024 13:51:34 GMT
- Dependencies Scanned: 6841 (2154 unique)
- Vulnerable Dependencies: 20
- Vulnerabilities Found: 35
- Vulnerabilities Suppressed: 0

## Summary

Dependency | Vulnerability IDs | Package | Highest Severity | CVE Count | Confidence | Evidence Count
--- | --- | --- | --- | --- | --- | ---
ajv:5.5.2 | cpe:2.3:a:ajv.js:ajv:5.5.2:*:*:*:*:*:*:* | pkg:npm/ajv@5.5.2 | MEDIUM | 1 | Highest | 8
css-what:2.1.3 | cpe:2.3:a:css-what_project:css-what:2.1.3:*:*:*:*:*:*:* | pkg:npm/css-what@2.1.3 | HIGH | 1 | Highest | 6
css-what:3.4.2 | cpe:2.3:a:css-what_project:css-what:3.4.2:*:*:*:*:*:*:* | pkg:npm/css-what@3.4.2 | HIGH | 1 | Highest | 6
glob-parent:3.1.0 |  | pkg:npm/glob-parent@3.1.0 | HIGH | 1 |  | 8
got:6.7.1 | cpe:2.3:a:got_project:got:6.7.1:*:*:*:*:*:*:* | pkg:npm/got@6.7.1 | MEDIUM | 1 | Highest | 11
ip:1.1.5 | cpe:2.3:a:fedorindutny:ip:1.1.5:*:*:*:*:*:*:* | pkg:npm/ip@1.1.5 | CRITICAL | 1 | Highest | 12
jsonwebtoken:8.5.1 | cpe:2.3:a:auth0:jsonwebtoken:8.5.1:*:*:*:*:*:*:* | pkg:npm/jsonwebtoken@8.5.1 | HIGH | 6 | Highest | 7
keycloak-connect:6.0.1 |  | pkg:npm/keycloak-connect@6.0.1 | MEDIUM | 3 |  | 9
nth-check:1.0.2 | cpe:2.3:a:nth-check_project:nth-check:1.0.2:*:*:*:*:*:*:* | pkg:npm/nth-check@1.0.2 | HIGH | 1 | Highest | 8
opener:1.5.2 | cpe:2.3:a:opener_project:opener:1.5.2:*:*:*:*:*:*:* | pkg:npm/opener@1.5.2 | CRITICAL | 7 | Highest | 11
parse-url:7.0.2 | cpe:2.3:a:parse-url_project:parse-url:7.0.2:*:*:*:*:*:*:* | pkg:npm/parse-url@7.0.2 | CRITICAL | 2 | Highest | 8
postcss:7.0.39 | cpe:2.3:a:postcss:postcss:7.0.39:*:*:*:*:*:*:* | pkg:npm/postcss@7.0.39 | MEDIUM | 1 | Highest | 7
ramda:0.26.1 | cpe:2.3:a:ramdajs:ramda:0.26.1:*:*:*:*:*:*:* | pkg:npm/ramda@0.26.1 | CRITICAL | 1 | Highest | 7
request:2.88.2 | cpe:2.3:a:request_project:request:2.88.2:*:*:*:*:*:*:* | pkg:npm/request@2.88.2 | MEDIUM | 2 | Highest | 10
scss-tokenizer:0.4.3 | cpe:2.3:a:scss-tokenizer_project:scss-tokenizer:0.4.3:*:*:*:*:*:*:* | pkg:npm/scss-tokenizer@0.4.3 | HIGH | 1 | Highest | 8
static-server:2.2.1 |  | pkg:npm/static-server@2.2.1 | HIGH | 1 |  | 6
tar:4.4.19 | cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:*:*:* | pkg:npm/tar@4.4.19 | MEDIUM | 1 | Highest | 10
tough-cookie:2.5.0 | cpe:2.3:a:salesforce:tough-cookie:2.5.0:*:*:*:*:*:*:* | pkg:npm/tough-cookie@2.5.0 | CRITICAL | 1 | Highest | 10
webpack-dev-server:4.15.2 | cpe:2.3:a:webpack.js:webpack-dev-server:4.15.2:*:*:*:*:*:*:* | pkg:npm/webpack-dev-server@4.15.2 | HIGH | 1 | Highest | 8
webpack:4.47.0 | cpe:2.3:a:webpack.js:webpack:4.47.0:*:*:*:*:*:*:* | pkg:npm/webpack@4.47.0 | CRITICAL | 1 | Highest | 7

## Dependencies

### ajv:5.5.2

Description:

    Another JSON Schema Validator

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?table:4.0.2/ajv:^5.2.3
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/table:4.0.2
- ewizard-cli:1.3.1/schema-utils:3.3.0
- ewizard-cli:1.3.1/schema-utils:2.7.1
- ewizard-cli:1.3.1/eslint:4.19.1
- ewizard-cli:1.3.1/schema-utils:1.0.0
- ewizard-cli:1.3.1
- ewizard-cli:1.3.1/html-validate:7.18.1
- ewizard-cli:1.3.1/ajv-formats:2.1.1
- ewizard-cli:1.3.1/har-validator:5.1.5
- ewizard-cli:1.3.1/schema-utils:4.2.0
- ewizard-cli:1.3.1/webpack:4.47.0

#### Related Dependencies

- ajv:5.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/ajv:5.5.2
  - pkg:npm/ajv@5.5.2
- ajv:5.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?eslint:4.19.1/ajv:^5.3.0
  - pkg:npm/ajv@5.5.2
- ajv:5.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?schema-utils:1.0.0/ajv:^6.1.0
  - pkg:npm/ajv@5.5.2
- ajv:5.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?schema-utils:3.3.0/ajv:^6.12.5
  - pkg:npm/ajv@5.5.2
- ajv:5.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?schema-utils:4.2.0/ajv:^8.9.0
  - pkg:npm/ajv@5.5.2
- ajv:6.12.6
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/ajv:6.12.6
  - pkg:npm/ajv@6.12.6
- ajv:6.12.6
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?har-validator:5.1.5/ajv:^6.12.3
  - pkg:npm/ajv@6.12.6
- ajv:6.12.6
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?schema-utils:2.7.1/ajv:^6.12.4
  - pkg:npm/ajv@6.12.6
- ajv:6.12.6
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?webpack:4.47.0/ajv:^6.10.2
  - pkg:npm/ajv@6.12.6
- ajv:8.12.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/ajv:8.12.0
  - pkg:npm/ajv@8.12.0
- ajv:8.12.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?ajv-formats:2.1.1/ajv:^8.0.0
  - pkg:npm/ajv@8.12.0
- ajv:8.12.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?html-validate:7.18.1/ajv:^8.0.0
  - pkg:npm/ajv@8.12.0

#### Identifiers

- pkg:npm/ajv@5.5.2 (Confidence:Highest)
- cpe:2.3:a:ajv.js:ajv:5.5.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2020-15366 (OSSINDEX)

    An issue was discovered in ajv.validate() in Ajv (aka Another JSON Schema Validator) 6.12.2. A carefully crafted JSON schema could be provided that allows execution of other code by prototype pollution. (While untrusted schemas are recommended against, the worst case of an untrusted schema should be a denial of service, not execution of code.)

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2020-15366 for details

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSSv3:

- Base Score: MEDIUM (5.599999904632568)
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References:

- OSSINDEX - [CVE-2020-15366] CWE-1321
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-15366
- OSSIndex - https://github.com/ajv-validator/ajv/releases/tag/v6.12.3

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:ajv:5.5.2:*:*:*:*:*:*:*

### css-what:2.1.3

Description:

    a CSS selector parser

License:

    BSD-2-Clause

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/css-what:2.1.3
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/css-select:4.3.0
- ewizard-cli:1.3.1/css-select:2.1.0
- ewizard-cli:1.3.1/css-select:1.2.0
- ewizard-cli:1.3.1

#### Related Dependencies

- css-what:2.1.3
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:1.2.0/css-what:2.1
  - pkg:npm/css-what@2.1.3
- css-what:2.1.3
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:2.1.0/css-what:^3.2.1
  - pkg:npm/css-what@2.1.3
- css-what:2.1.3
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:4.3.0/css-what:^6.0.1
  - pkg:npm/css-what@2.1.3

#### Identifiers

- pkg:npm/css-what@2.1.3 (Confidence:Highest)
- cpe:2.3:a:css-what_project:css-what:2.1.3:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-21222 (OSSINDEX)

    The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2022-21222 for details

CWE-1333 Inefficient Regular Expression Complexity
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

- OSSINDEX - [CVE-2022-21222] CWE-1333
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21222
- OSSIndex - https://bugzilla.redhat.com/show_bug.cgi?id=2131335

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:css-what:2.1.3:*:*:*:*:*:*:*

### css-what:3.4.2

Description:

    a CSS selector parser

License:

    BSD-2-Clause

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/css-what:3.4.2
Referenced In Project/Scope: ewizard-cli:1.3.1

#### Identifiers

- pkg:npm/css-what@3.4.2 (Confidence:Highest)
- cpe:2.3:a:css-what_project:css-what:3.4.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-21222 (OSSINDEX)

    The package css-what before 2.1.3 are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of insecure regular expression in the re_attr variable of index.js. The exploitation of this vulnerability could be triggered via the parse function.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2022-21222 for details

CWE-1333 Inefficient Regular Expression Complexity
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

- OSSINDEX - [CVE-2022-21222] CWE-1333
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-21222
- OSSIndex - https://bugzilla.redhat.com/show_bug.cgi?id=2131335

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:css-what:3.4.2:*:*:*:*:*:*:*

### glob-parent:3.1.0

Description:

    Strips glob magic from a string to provide the parent directory path

License:

    ISC

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?chokidar:2.1.8/glob-parent:^3.1.0
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/chokidar:2.1.8
- ewizard-cli:1.3.1
- ewizard-cli:1.3.1/copy-webpack-plugin:5.1.2

#### Related Dependencies

- glob-parent:3.1.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/glob-parent:3.1.0
  - pkg:npm/glob-parent@3.1.0
- glob-parent:3.1.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?copy-webpack-plugin:5.1.2/glob-parent:^3.1.0
  - pkg:npm/glob-parent@3.1.0

#### Identifiers

- pkg:npm/glob-parent@3.1.0 (Confidence:Highest)

#### Published Vulnerabilities

CVE-2020-28469 (OSSINDEX)

    This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

CWE-400 Uncontrolled Resource Consumption
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

References:

- OSSINDEX - [CVE-2020-28469] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-28469
- OSSIndex - https://github.com/nadgowdas/hello-containers/pull/1#issuecomment-759710574

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:glob-parent:3.1.0:*:*:*:*:*:*:*

### got:6.7.1

Description:

    Simplified HTTP requests

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/got:6.7.1
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/package-json:4.0.1
- ewizard-cli:1.3.1

#### Related Dependencies

- got:6.7.1
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?package-json:4.0.1/got:^6.7.1
  - pkg:npm/got@6.7.1

#### Identifiers

- pkg:npm/got@6.7.1 (Confidence:Highest)
- cpe:2.3:a:got_project:got:6.7.1:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-33987

    The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.

NVD-CWE-noinfo
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSSv3:

- Base Score: MEDIUM (5.3)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-33987] CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-33987
- OSSIndex - https://github.com/advisories/GHSA-pfrx-2q88-qq97
- OSSIndex - https://github.com/sindresorhus/got/pull/2047
- cve@mitre.org - PATCH,THIRD_PARTY_ADVISORY
- cve@mitre.org - PATCH,THIRD_PARTY_ADVISORY
- cve@mitre.org - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:got_project:got:*:*:*:*:*:node.js:*:* versions up to (excluding) 11.8.5

### ip:1.1.5

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?socks:2.3.3/ip:1.1.5
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/socks:2.3.3
- ewizard-cli:1.3.1

#### Related Dependencies

- ip:1.1.5
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/ip:1.1.5
  - pkg:npm/ip@1.1.5

#### Identifiers

- pkg:npm/ip@1.1.5 (Confidence:Highest)
- cpe:2.3:a:fedorindutny:ip:1.1.5:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2023-42282

    An issue in NPM IP Package v.1.1.8 and before allows an attacker to execute arbitrary code and obtain sensitive information via the isPublic() function.

CWE-918 Server-Side Request Forgery (SSRF)
CVSSv3:

- Base Score: CRITICAL (9.8)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2023-42282] CWE-918: Server-Side Request Forgery (SSRF)
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-42282
- OSSIndex - https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
- OSSIndex - https://github.com/advisories/GHSA-78xj-cgh5-2h22
- cve@mitre.org - EXPLOIT,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:fedorindutny:ip:*:*:*:*:*:node.js:*:* versions up to (including) 1.1.8

### jsonwebtoken:8.5.1

Description:

    JSON Web Token implementation (symmetric and asymmetric)

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/jsonwebtoken:8.5.1
Referenced In Project/Scope: ewizard-cli:1.3.1

#### Identifiers

- pkg:npm/jsonwebtoken@8.5.1 (Confidence:Highest)
- cpe:2.3:a:auth0:jsonwebtoken:8.5.1:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-23539

    Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you���ll need to set the `allowInvalidAsymmetricKeyTypes` option  to `true` in the `sign()` and/or `verify()` functions.

CWE-327 Use of a Broken or Risky Cryptographic Algorithm
CVSSv3:

- Base Score: HIGH (8.1)
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N/E:2.8/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-23539] CWE-327: Use of a Broken or Risky Cryptographic Algorithm
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23539
- OSSIndex - https://github.com/auth0/node-jsonwebtoken/blob/e1fa9dcc12054a8681db4e6373da1b30cf7016e3/CHANGELOG.md#900---2022-12-21
- OSSIndex - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
- security-advisories@github.com - PATCH,THIRD_PARTY_ADVISORY
- security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* versions up to (including) 8.5.1

CVE-2022-23540

    In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don���t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.

CWE-347 Improper Verification of Cryptographic Signature, CWE-287 Improper Authentication
CVSSv3:

- Base Score: HIGH (7.6)
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L/E:2.8/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-23540] CWE-287: Improper Authentication
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23540
- OSSIndex - https://github.com/auth0/node-jsonwebtoken/blob/e1fa9dcc12054a8681db4e6373da1b30cf7016e3/CHANGELOG.md#900---2022-12-21
- OSSIndex - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
- security-advisories@github.com - PATCH
- security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* versions up to (including) 8.5.1

GHSA-qwph-4952-7xr6 (NPM)

    # Overview

    In versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification.

    # Am I affected?
    You will be affected if all the following are true in the `jwt.verify()` function:
    - a token with no signature is received
    - no algorithms are specified
    - a falsy (e.g. null, false, undefined) secret or key is passed

    # How do I fix it?

    Update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method.

    # Will the fix impact my users?

    There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.

CWE-347 Improper Verification of Cryptographic Signature, CWE-327 Use of a Broken or Risky Cryptographic Algorithm, CWE-287 Improper Authentication
CVSSv3:

- Base Score: MEDIUM (6.400000095367432)
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Unscored:

- Severity: moderate

References:

- NPM Advisory reference: - https://github.com/advisories/GHSA-qwph-4952-7xr6
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
- NPM Advisory reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-23540

Vulnerable Software & Versions (NPM):

- cpe:2.3:a:*:jsonwebtoken:\<9.0.0:*:*:*:*:*:*:*

CVE-2022-23541

    jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of  forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.

NVD-CWE-Other, CWE-1259 Improper Restriction of Security Token Assignment, CWE-287 Improper Authentication
CVSSv3:

- Base Score: MEDIUM (6.3)
- Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L/E:2.8/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-23541] CWE-1259 CWE-287 CWE-Other
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-23541
- OSSIndex - https://github.com/advisories/GHSA-hjrf-2m68-5959
- OSSIndex - https://github.com/auth0/node-jsonwebtoken/blob/e1fa9dcc12054a8681db4e6373da1b30cf7016e3/CHANGELOG.md#900---2022-12-21
- security-advisories@github.com - PATCH
- security-advisories@github.com - RELEASE_NOTES
- security-advisories@github.com - THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:auth0:jsonwebtoken:*:*:*:*:*:node.js:*:* versions up to (including) 8.5.1

GHSA-hjrf-2m68-5959 (NPM)

    # Overview

    Versions `<=8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function (referring to the `secretOrPublicKey` argument from the [readme link](https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback)) will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification  than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens.

    # Am I affected?

    You will be affected if your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function.

    # How do I fix it?

    Update to version 9.0.0.

    # Will the fix impact my users?

    There is no impact for end users

CWE-287 Improper Authentication
CVSSv3:

- Base Score: MEDIUM (5.0)
- Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L

Unscored:

- Severity: moderate

References:

- NPM Advisory reference: - https://github.com/advisories/GHSA-hjrf-2m68-5959
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
- NPM Advisory reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-23541

Vulnerable Software & Versions (NPM):

- cpe:2.3:a:*:jsonwebtoken:\<\=8.5.1:*:*:*:*:*:*:*

GHSA-8cf7-32gw-wr33 (NPM)

    # Overview

    Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm.

    # Am I affected?

    You are affected if you are using an algorithm and a key type other than the combinations mentioned below

    | Key type |  algorithm                                    |
    |----------|------------------------------------------|
    | ec           | ES256, ES384, ES512                      |
    | rsa          | RS256, RS384, RS512, PS256, PS384, PS512 |
    | rsa-pss  | PS256, PS384, PS512                      |

    And for Elliptic Curve algorithms:

    | `alg` | Curve      |
    |-------|------------|
    | ES256 | prime256v1 |
    | ES384 | secp384r1  |
    | ES512 | secp521r1  |

    # How do I fix it?

    Update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, If you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option  to `true` in the `sign()` and/or `verify()` functions.

    # Will the fix impact my users?

    There will be no impact, if you update to version 9.0.0 and you already use a valid secure combination of key type and algorithm. Otherwise,  use the  `allowInvalidAsymmetricKeyTypes` option  to `true` in the `sign()` and `verify()` functions to continue usage of invalid key type/algorithm combination in 9.0.0 for legacy compatibility.

CWE-327 Use of a Broken or Risky Cryptographic Algorithm
Unscored:

- Severity: moderate

References:

- NPM Advisory reference: - https://github.com/advisories/GHSA-8cf7-32gw-wr33
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
- NPM Advisory reference: - https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
- NPM Advisory reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-23539

Vulnerable Software & Versions (NPM):

- cpe:2.3:a:*:jsonwebtoken:\<\=8.5.1:*:*:*:*:*:*:*

### keycloak-connect:6.0.1

Description:

    Keycloak Connect Middleware

License:

    Apache-2.0

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/keycloak-connect:6.0.1
Referenced In Project/Scope: ewizard-cli:1.3.1

#### Identifiers

- pkg:npm/keycloak-connect@6.0.1 (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-2237 (OSSINDEX)

    A flaw was found in the Keycloak Node.js Adapter. This flaw allows an attacker to benefit from an Open Redirect vulnerability in the checkSso function.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2022-2237 for details

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CVSSv3:

- Base Score: MEDIUM (6.099999904632568)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

- OSSINDEX - [CVE-2022-2237] CWE-601: URL Redirection to Untrusted Site ('Open Redirect')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-2237
- OSSIndex - https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2022-2237
- OSSIndex - https://github.com/keycloak/keycloak-nodejs-connect/security/advisories/GHSA-59fq-727j-hm3f

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:keycloak-connect:6.0.1:*:*:*:*:*:*:*

GHSA-59fq-727j-hm3f (NPM)

    There is an Open Redirect vulnerability in the Node.js adapter when forwarding requests to Keycloak using `checkSSO` with query param `prompt=none`.

CWE-601 URL Redirection to Untrusted Site ('Open Redirect')
CVSSv3:

- Base Score: MEDIUM (6.099999904632568)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Unscored:

- Severity: moderate

References:

- NPM Advisory reference: - https://bugzilla.redhat.com/show_bug.cgi?id=2097007
- NPM Advisory reference: - https://github.com/advisories/GHSA-59fq-727j-hm3f
- NPM Advisory reference: - https://github.com/keycloak/keycloak-nodejs-connect/commit/190a9470e234bbd9ac5d5de43f5a19aead9a2c21
- NPM Advisory reference: - https://github.com/keycloak/keycloak-nodejs-connect/security/advisories/GHSA-59fq-727j-hm3f
- NPM Advisory reference: - https://nvd.nist.gov/vuln/detail/CVE-2022-2237

Vulnerable Software & Versions (NPM):

- cpe:2.3:a:*:keycloak-connect:\<21.0.1:*:*:*:*:*:*:*

CVE-2020-1694 (OSSINDEX)

    A flaw was found in all versions of Keycloak before 10.0.0, where the NodeJS adapter did not support the verify-token-audience. This flaw results in some users having access to sensitive information outside of their permissions.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2020-1694 for details

CWE-732 Incorrect Permission Assignment for Critical Resource
CVSSv3:

- Base Score: MEDIUM (4.900000095367432)
- Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

References:

- OSSINDEX - [CVE-2020-1694] CWE-732: Incorrect Permission Assignment for Critical Resource
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2020-1694
- OSSIndex - https://access.redhat.com/security/cve/cve-2020-1694
- OSSIndex - https://bugzilla.redhat.com/show_bug.cgi?id=1790759
- OSSIndex - https://github.com/keycloak/keycloak-nodejs-connect/pull/244

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:keycloak-connect:6.0.1:*:*:*:*:*:*:*

### nth-check:1.0.2

Description:

    performant nth-check parser & compiler

License:

    BSD-2-Clause

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:2.1.0/nth-check:^1.0.2
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/css-select:2.1.0
- ewizard-cli:1.3.1/css-select:4.3.0
- ewizard-cli:1.3.1/css-select:1.2.0
- ewizard-cli:1.3.1

#### Related Dependencies

- nth-check:1.0.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/nth-check:1.0.2
  - pkg:npm/nth-check@1.0.2
- nth-check:1.0.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:1.2.0/nth-check:~1.0.1
  - pkg:npm/nth-check@1.0.2
- nth-check:1.0.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-select:4.3.0/nth-check:^2.0.1
  - pkg:npm/nth-check@1.0.2

#### Identifiers

- pkg:npm/nth-check@1.0.2 (Confidence:Highest)
- cpe:2.3:a:nth-check_project:nth-check:1.0.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2021-3803

    nth-check is vulnerable to Inefficient Regular Expression Complexity

CWE-1333 Inefficient Regular Expression Complexity
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2021-3803] CWE-1333
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2021-3803
- OSSIndex - https://github.com/advisories/GHSA-rp65-9cf3-cjxr
- OSSIndex - https://huntr.dev/bounties/8cf8cc06-d2cf-4b4e-b42c-99fafb0b04d0/
- security@huntr.dev - EXPLOIT,ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY
- security@huntr.dev - MAILING_LIST,THIRD_PARTY_ADVISORY
- security@huntr.dev - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:nth-check_project:nth-check:*:*:*:*:*:*:*:* versions up to (excluding) 2.0.1

### opener:1.5.2

Description:

    Opens stuff, like webpages and files and executables, cross-platform

License:

    (WTFPL OR MIT)

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?webpack-bundle-analyzer:4.10.1/opener:^1.5.2
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/webpack-bundle-analyzer:4.10.1
- ewizard-cli:1.3.1/npm-legacy:6.14.18
- ewizard-cli:1.3.1

#### Related Dependencies

- opener:1.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/opener:1.5.2
  - pkg:npm/opener@1.5.2
- opener:1.5.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?npm-legacy:6.14.18/opener:^1.5.2
  - pkg:npm/opener@1.5.2

#### Identifiers

- pkg:npm/opener@1.5.2 (Confidence:Highest)
- cpe:2.3:a:opener_project:opener:1.5.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-43604

    An out-of-bounds write vulnerability exists in the GetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out-of-bounds write, potentially causing the server to crash or allow for remote code execution. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.

CWE-787 Out-of-bounds Write
CVSSv3:

- Base Score: CRITICAL (9.8)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

- talos-cna@cisco.com - EXPLOIT,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (excluding) 2022-10-18

CVE-2022-43605

    An out-of-bounds write vulnerability exists in the SetAttributeList attribute_count_request functionality of EIP Stack Group OpENer development commit 58ee13c. A specially crafted EtherNet/IP request can lead to an out of bounds write, potentially causing the server to crash or allow for remote code execution. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.

CWE-787 Out-of-bounds Write
CVSSv3:

- Base Score: CRITICAL (9.8)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

- talos-cna@cisco.com - EXPLOIT,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (excluding) 2022-10-18

CVE-2021-27478

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may cause a denial-of-service condition.

CWE-681 Incorrect Conversion between Numeric Types
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY
- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (including) 2.3

CVE-2021-27482

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may allow the attacker to read arbitrary data.

CWE-125 Out-of-bounds Read
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:P/I:N/A:N

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:3.9/RC:R/MAV:A

References:

- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY
- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (including) 2.3

CVE-2021-27498

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.

CWE-617 Reachable Assertion
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY
- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (including) 2.3

CVE-2021-27500

    A specifically crafted packet sent by an attacker to EIPStackGroup OpENer EtherNet/IP commits and versions prior to Feb 10, 2021 may result in a denial-of-service condition.

CWE-617 Reachable Assertion
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY
- ics-cert@hq.dhs.gov - THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (including) 2.3

CVE-2022-43606

    A use-of-uninitialized-pointer vulnerability exists in the Forward Open connection_management_entry functionality of EIP Stack Group OpENer development commit 58ee13c. A specially-crafted EtherNet/IP request can lead to use of a null pointer, causing the server to crash. An attacker can send a series of EtherNet/IP requests to trigger this vulnerability.

CWE-824 Access of Uninitialized Pointer
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- talos-cna@cisco.com - EXPLOIT,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:opener_project:opener:*:*:*:*:*:*:*:* versions up to (excluding) 2022-10-18

### parse-url:7.0.2

Description:

    An advanced url parser supporting git urls too.

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/parse-url:7.0.2
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/git-up:6.0.0
- ewizard-cli:1.3.1

#### Related Dependencies

- parse-url:7.0.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?git-up:6.0.0/parse-url:^7.0.2
  - pkg:npm/parse-url@7.0.2

#### Identifiers

- pkg:npm/parse-url@7.0.2 (Confidence:Highest)
- cpe:2.3:a:parse-url_project:parse-url:7.0.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-2900

    Server-Side Request Forgery (SSRF) in GitHub repository ionicabizau/parse-url prior to 8.1.0.

CWE-918 Server-Side Request Forgery (SSRF)
CVSSv3:

- Base Score: CRITICAL (9.1)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N/E:3.9/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-2900] CWE-918: Server-Side Request Forgery (SSRF)
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2022-2900
- OSSIndex - https://github.com/IonicaBizau/parse-url/pull/55
- OSSIndex - https://www.huntr.dev/bounties/1b4c972a-abc8-41eb-a2e1-696db746b5fd/
- security@huntr.dev - EXPLOIT,PATCH,THIRD_PARTY_ADVISORY
- security@huntr.dev - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:parse-url_project:parse-url:*:*:*:*:*:*:*:* versions up to (excluding) 8.1.0

CVE-2022-3224

    Misinterpretation of Input in GitHub repository ionicabizau/parse-url prior to 8.1.0.

CWE-115 Misinterpretation of Input
CVSSv3:

- Base Score: MEDIUM (6.1)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:2.8/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2022-3224] CWE-115: Misinterpretation of Input
- OSSIndex - https://github.com/IonicaBizau/parse-url/pull/58
- OSSIndex - https://github.com/IonicaBizau/parse-url/pull/65
- OSSIndex - https://www.huntr.dev/bounties/3587a567-7fcd-4702-b7c9-d9ca565e3c62/
- security@huntr.dev - EXPLOIT,ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY
- security@huntr.dev - PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:parse-url_project:parse-url:*:*:*:*:*:*:*:* versions up to (excluding) 8.1.0

### postcss:7.0.39

Description:

    Tool for transforming styles with JS plugins

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/postcss:7.0.39
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/postcss-normalize-string:4.0.2
- ewizard-cli:1.3.1/postcss-normalize-url:4.0.1
- ewizard-cli:1.3.1/postcss-normalize-unicode:4.0.1
- ewizard-cli:1.3.1/postcss-modules-scope:2.2.0
- ewizard-cli:1.3.1/postcss-modules-local-by-default:3.0.3
- ewizard-cli:1.3.1/postcss-normalize-timing-functions:4.0.2
- ewizard-cli:1.3.1/postcss-normalize-repeat-style:4.0.2
- ewizard-cli:1.3.1/css-declaration-sorter:4.0.1
- ewizard-cli:1.3.1
- ewizard-cli:1.3.1/postcss-normalize-charset:4.0.1
- ewizard-cli:1.3.1/icss-utils:4.1.1
- ewizard-cli:1.3.1/postcss-minify-params:4.0.2
- ewizard-cli:1.3.1/postcss-minify-selectors:4.0.2
- ewizard-cli:1.3.1/postcss-normalize-whitespace:4.0.2
- ewizard-cli:1.3.1/postcss-unique-selectors:4.0.1
- ewizard-cli:1.3.1/postcss-merge-longhand:4.0.11
- ewizard-cli:1.3.1/postcss-minify-gradients:4.0.2
- ewizard-cli:1.3.1/cssnano-util-raw-cache:4.0.1
- ewizard-cli:1.3.1/@vue/component-compiler-utils:3.3.0
- ewizard-cli:1.3.1/postcss-svgo:4.0.3
- ewizard-cli:1.3.1/postcss-modules-extract-imports:2.0.0
- ewizard-cli:1.3.1/postcss-reduce-initial:4.0.3
- ewizard-cli:1.3.1/postcss-discard-comments:4.0.2
- ewizard-cli:1.3.1/postcss-merge-rules:4.0.3
- ewizard-cli:1.3.1/autoprefixer:9.8.8
- ewizard-cli:1.3.1/postcss-discard-duplicates:4.0.2
- ewizard-cli:1.3.1/postcss-loader:3.0.0
- ewizard-cli:1.3.1/postcss-normalize-display-values:4.0.2
- ewizard-cli:1.3.1/postcss-minify-font-values:4.0.2
- ewizard-cli:1.3.1/postcss-discard-empty:4.0.1
- ewizard-cli:1.3.1/postcss-modules-values:3.0.0
- ewizard-cli:1.3.1/postcss-colormin:4.0.3
- ewizard-cli:1.3.1/cssnano:4.1.11
- ewizard-cli:1.3.1/postcss-ordered-values:4.1.2
- ewizard-cli:1.3.1/stylehacks:4.0.3
- ewizard-cli:1.3.1/postcss-discard-overridden:4.0.1
- ewizard-cli:1.3.1/postcss-convert-values:4.0.1
- ewizard-cli:1.3.1/postcss-normalize-positions:4.0.2
- ewizard-cli:1.3.1/postcss-calc:7.0.5
- ewizard-cli:1.3.1/cssnano-preset-default:4.0.8
- ewizard-cli:1.3.1/postcss-reduce-transforms:4.0.2
- ewizard-cli:1.3.1/css-loader:3.6.0

#### Related Dependencies

- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@vue/component-compiler-utils:3.3.0/postcss:^7.0.36
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?autoprefixer:9.8.8/postcss:^7.0.32
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-declaration-sorter:4.0.1/postcss:^7.0.1
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?css-loader:3.6.0/postcss:^7.0.32
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?cssnano-preset-default:4.0.8/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?cssnano-util-raw-cache:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?cssnano:4.1.11/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?icss-utils:4.1.1/postcss:^7.0.14
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-calc:7.0.5/postcss:^7.0.27
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-colormin:4.0.3/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-convert-values:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-discard-comments:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-discard-duplicates:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-discard-empty:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-discard-overridden:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-loader:3.0.0/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-merge-longhand:4.0.11/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-merge-rules:4.0.3/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-minify-font-values:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-minify-gradients:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-minify-params:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-minify-selectors:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-modules-extract-imports:2.0.0/postcss:^7.0.5
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-modules-local-by-default:3.0.3/postcss:^7.0.32
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-modules-scope:2.2.0/postcss:^7.0.6
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-modules-values:3.0.0/postcss:^7.0.6
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-charset:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-display-values:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-positions:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-repeat-style:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-string:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-timing-functions:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-unicode:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-url:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-normalize-whitespace:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-ordered-values:4.1.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-reduce-initial:4.0.3/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-reduce-transforms:4.0.2/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-svgo:4.0.3/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?postcss-unique-selectors:4.0.1/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39
- postcss:7.0.39
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?stylehacks:4.0.3/postcss:^7.0.0
  - pkg:npm/postcss@7.0.39

#### Identifiers

- pkg:npm/postcss@7.0.39 (Confidence:Highest)
- cpe:2.3:a:postcss:postcss:7.0.39:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2023-44270

    An issue was discovered in PostCSS before 8.4.31. The vulnerability affects linters using PostCSS to parse external untrusted CSS. An attacker can prepare CSS in such a way that it will contains parts parsed by PostCSS as a CSS comment. After processing by PostCSS, it will be included in the PostCSS output in CSS nodes (rules, properties) despite being included in a comment.

CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
CVSSv3:

- Base Score: MEDIUM (5.3)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:3.9/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2023-44270] CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-44270
- OSSIndex - https://github.com/postcss/postcss/releases/tag/8.4.31
- cve@mitre.org - ISSUE_TRACKING
- cve@mitre.org - ISSUE_TRACKING
- cve@mitre.org - PATCH
- cve@mitre.org - PATCH,RELEASE_NOTES

Vulnerable Software & Versions:

- cpe:2.3:a:postcss:postcss:*:*:*:*:*:node.js:*:* versions up to (excluding) 8.4.31

### ramda:0.26.1

Description:

    A practical functional library for JavaScript programmers.

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/ramda:0.26.1
Referenced In Project/Scope: ewizard-cli:1.3.1

#### Identifiers

- pkg:npm/ramda@0.26.1 (Confidence:Highest)
- cpe:2.3:a:ramdajs:ramda:0.26.1:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2021-42581

    Prototype poisoning in function mapObjIndexed in Ramda 0.27.0 and earlier allows attackers to compromise integrity or availability of application via supplying a crafted object (that contains an own property "__proto__") as an argument to the function. NOTE: the vendor disputes this because the observed behavior only means that a user can create objects that the user didn't know would contain custom prototypes

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSSv2:

- Base Score: MEDIUM (6.4)
- Vector: /AV:N/AC:L/Au:N/C:N/I:P/A:P

CVSSv3:

- Base Score: CRITICAL (9.1)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H/E:3.9/RC:R/MAV:A

References:

- cve@mitre.org - EXPLOIT,THIRD_PARTY_ADVISORY
- cve@mitre.org - ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:ramdajs:ramda:*:*:*:*:*:*:*:* versions up to (including) 0.27.0

### request:2.88.2

Description:

    Simplified HTTP request client.

License:

    Apache-2.0

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/request:2.88.2
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/npm-legacy:6.14.18
- ewizard-cli:1.3.1
- ewizard-cli:1.3.1/node-gyp:5.1.1

#### Related Dependencies

- request:2.88.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?node-gyp:5.1.1/request:^2.88.0
  - pkg:npm/request@2.88.2
- request:2.88.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?npm-legacy:6.14.18/request:^2.88.2
  - pkg:npm/request@2.88.2

#### Identifiers

- pkg:npm/request@2.88.2 (Confidence:Highest)
- cpe:2.3:a:request_project:request:2.88.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2023-28155 (OSSINDEX)

    The Request package through 2.88.1 for Node.js allows a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP). NOTE: This vulnerability only affects products that are no longer supported by the maintainer.

CWE-918 Server-Side Request Forgery (SSRF)
CVSSv3:

- Base Score: MEDIUM (6.099999904632568)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

References:

- OSSINDEX - [CVE-2023-28155] CWE-918: Server-Side Request Forgery (SSRF)
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28155
- OSSIndex - https://github.com/advisories/GHSA-p8p7-x288-28g6
- OSSIndex - https://github.com/request/request/issues/3442
- OSSIndex - https://github.com/request/request/pull/3444

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:request:2.88.2:*:*:*:*:*:*:*

GHSA-p8p7-x288-28g6 (NPM)

    The `request` package through 2.88.2 for Node.js and the `@cypress/request` package prior to 3.0.0 allow a bypass of SSRF mitigations via an attacker-controller server that does a cross-protocol redirect (HTTP to HTTPS, or HTTPS to HTTP).

    NOTE: The `request` package is no longer supported by the maintainer.

CWE-918 Server-Side Request Forgery (SSRF)
CVSSv3:

- Base Score: MEDIUM (6.099999904632568)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Unscored:

- Severity: moderate

References:

- NPM Advisory reference: - https://doyensec.com/resources/Doyensec_Advisory_RequestSSRF_Q12023.pdf
- NPM Advisory reference: - https://github.com/advisories/GHSA-p8p7-x288-28g6
- NPM Advisory reference: - https://github.com/cypress-io/request/blob/master/lib/redirect.js#L116
- NPM Advisory reference: - https://github.com/cypress-io/request/commit/c5bcf21d40fb61feaff21a0e5a2b3934a440024f
- NPM Advisory reference: - https://github.com/cypress-io/request/pull/28
- NPM Advisory reference: - https://github.com/cypress-io/request/releases/tag/v3.0.0
- NPM Advisory reference: - https://github.com/github/advisory-database/pull/2500
- NPM Advisory reference: - https://github.com/request/request/blob/master/lib/redirect.js#L111
- NPM Advisory reference: - https://github.com/request/request/issues/3442
- NPM Advisory reference: - https://github.com/request/request/pull/3444
- NPM Advisory reference: - https://nvd.nist.gov/vuln/detail/CVE-2023-28155
- NPM Advisory reference: - https://security.netapp.com/advisory/ntap-20230413-0007

Vulnerable Software & Versions (NPM):

- cpe:2.3:a:*:request:\<\=2.88.2:*:*:*:*:*:*:*

### scss-tokenizer:0.4.3

Description:

    A tokenzier for Sass' SCSS syntax

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/scss-tokenizer:0.4.3
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/sass-graph:4.0.1
- ewizard-cli:1.3.1

#### Related Dependencies

- scss-tokenizer:0.4.3
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?sass-graph:4.0.1/scss-tokenizer:^0.4.3
  - pkg:npm/scss-tokenizer@0.4.3

#### Identifiers

- pkg:npm/scss-tokenizer@0.4.3 (Confidence:Highest)
- cpe:2.3:a:scss-tokenizer_project:scss-tokenizer:0.4.3:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2022-25758

    All versions of package scss-tokenizer are vulnerable to Regular Expression Denial of Service (ReDoS) via the loadAnnotation() function, due to the usage of insecure regex.

CWE-1333 Inefficient Regular Expression Complexity
CVSSv2:

- Base Score: MEDIUM (5.0)
- Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

- report@snyk.io - EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY
- report@snyk.io - EXPLOIT,THIRD_PARTY_ADVISORY
- report@snyk.io - EXPLOIT,THIRD_PARTY_ADVISORY

Vulnerable Software & Versions:

- cpe:2.3:a:scss-tokenizer_project:scss-tokenizer:*:*:*:*:*:node.js:*:*

### static-server:2.2.1

Description:

    A simple http server to serve static resource files from a local directory.

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/static-server:2.2.1
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/@ewizardjs/blocks-renderer:1.1.1
- ewizard-cli:1.3.1

#### Related Dependencies

- static-server:2.2.1
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@ewizardjs/blocks-renderer:1.1.1/static-server:^2.2.1
  - pkg:npm/static-server@2.2.1

#### Identifiers

- pkg:npm/static-server@2.2.1 (Confidence:Highest)

#### Published Vulnerabilities

CVE-2023-26152 (OSSINDEX)

    All versions of the package static-server are vulnerable to Directory Traversal due to improper input sanitization passed via the validPath function of server.js.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2023-26152 for details

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv3:

- Base Score: HIGH (7.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

References:

- OSSINDEX - [CVE-2023-26152] CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-26152
- OSSIndex - https://gist.github.com/lirantal/1f7021703a2065ecaf9ec9e06a3a346d

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:static-server:2.2.1:*:*:*:*:*:*:*

### tar:4.4.19

Description:

    tar for node

License:

    ISC

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/tar:4.4.19
Referenced In Project/Scope: ewizard-cli:1.3.1

#### Identifiers

- pkg:npm/tar@4.4.19 (Confidence:Highest)
- cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2024-28863 (OSSINDEX)

    node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.

CWE-400 Uncontrolled Resource Consumption
CVSSv3:

- Base Score: MEDIUM (6.5)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H

References:

- OSSINDEX - [CVE-2024-28863] CWE-400: Uncontrolled Resource Consumption ('Resource Exhaustion')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-28863
- OSSIndex - https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:tar:4.4.19:*:*:*:*:*:*:*

### tough-cookie:2.5.0

Description:

    RFC6265 Cookies and Cookie Jar for node.js

License:

    BSD-3-Clause

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/tough-cookie:2.5.0
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/request-promise-native:1.0.9
- ewizard-cli:1.3.1/request:2.88.2
- ewizard-cli:1.3.1

#### Related Dependencies

- tough-cookie:2.5.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?request-promise-native:1.0.9/tough-cookie:^2.3.3
  - pkg:npm/tough-cookie@2.5.0
- tough-cookie:2.5.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?request:2.88.2/tough-cookie:~2.5.0
  - pkg:npm/tough-cookie@2.5.0

#### Identifiers

- pkg:npm/tough-cookie@2.5.0 (Confidence:Highest)
- cpe:2.3:a:salesforce:tough-cookie:2.5.0:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2023-26136

    Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
CVSSv3:

- Base Score: CRITICAL (9.8)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A

References:

- OSSINDEX - [CVE-2023-26136] CWE-1321
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-26136
- OSSIndex - https://github.com/salesforce/tough-cookie/issues/282
- OSSIndex - https://github.com/salesforce/tough-cookie/releases/tag/v4.1.3
- report@snyk.io - EXPLOIT,ISSUE_TRACKING,VENDOR_ADVISORY
- report@snyk.io - EXPLOIT,TECHNICAL_DESCRIPTION,THIRD_PARTY_ADVISORY
- report@snyk.io - PATCH
- report@snyk.io - RELEASE_NOTES

Vulnerable Software & Versions:

- cpe:2.3:a:salesforce:tough-cookie:*:*:*:*:*:node.js:*:* versions up to (excluding) 4.1.3

### webpack-dev-server:4.15.2

Description:

    Serves a webpack app. Updates the browser on changes.

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/webpack-dev-server:4.15.2
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1
- ewizard-cli:1.3.1/@ewizardjs/dev-builder:4.16.2

#### Related Dependencies

- webpack-dev-server:4.15.2
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@ewizardjs/dev-builder:4.16.2/webpack-dev-server:^4.15.1
  - pkg:npm/webpack-dev-server@4.15.2

#### Identifiers

- pkg:npm/webpack-dev-server@4.15.2 (Confidence:Highest)
- cpe:2.3:a:webpack.js:webpack-dev-server:4.15.2:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2024-29180 (OSSINDEX)

    Prior to versions 7.1.0, 6.1.2, and 5.3.4, the webpack-dev-middleware development middleware for devpack does not validate the supplied URL address sufficiently before returning the local file. It is possible to access any file on the developer's machine. The middleware can either work with the physical filesystem when reading the files or it can use a virtualized in-memory `memfs` filesystem. If `writeToDisk` configuration option is set to `true`, the physical filesystem is used. The `getFilenameFromUrl` method is used to parse URL and build the local file path. The public path prefix is stripped from the URL, and the `unsecaped` path suffix is appended to the `outputPath`. As the URL is not unescaped and normalized automatically before calling the midlleware, it is possible to use `%2e` and `%2f` sequences to perform path traversal attack.

    Developers using `webpack-dev-server` or `webpack-dev-middleware` are affected by the issue. When the project is started, an attacker might access any file on the developer's machine and exfiltrate the content. If the development server is listening on a public IP address (or `0.0.0.0`), an attacker on the local network can access the local files without any interaction from the victim (direct connection to the port). If the server allows access from third-party domains, an attacker can send a malicious link to the victim. When visited, the client side script can connect to the local server and exfiltrate the local files. Starting with fixed versions 7.1.0, 6.1.2, and 5.3.4, the URL is unescaped and normalized before any further processing.

CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CVSSv3:

- Base Score: HIGH (7.400000095367432)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

References:

- OSSINDEX - [CVE-2024-29180] CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-29180
- OSSIndex - https://github.com/advisories/GHSA-wr3j-pwj9-hqq6

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:webpack-dev-server:4.15.2:*:*:*:*:*:*:*

### webpack:4.47.0

Description:

    Packs CommonJs/AMD modules for the browser. Allows to split your codebase into multiple bundles, which can be loaded on demand. Support loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

License:

    MIT

File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?/webpack:4.47.0
Referenced In Projects/Scopes:

- ewizard-cli:1.3.1/@ewizardjs/component-builder:2.3.1
- ewizard-cli:1.3.1
- ewizard-cli:1.3.1/@ewizardjs/dev-builder:4.16.2
- ewizard-cli:1.3.1/@ewizardjs/builder-utils:5.20.1

#### Related Dependencies

- webpack:4.47.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@ewizardjs/builder-utils:5.20.1/webpack:^4.47.0
  - pkg:npm/webpack@4.47.0
- webpack:4.47.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@ewizardjs/component-builder:2.3.1/webpack:^4.46.0
  - pkg:npm/webpack@4.47.0
- webpack:4.47.0
  - File Path: /builds/ewizardjs/ewizard-cli/npm-shrinkwrap.json?@ewizardjs/dev-builder:4.16.2/webpack:^4.43.0
  - pkg:npm/webpack@4.47.0

#### Identifiers

- pkg:npm/webpack@4.47.0 (Confidence:Highest)
- cpe:2.3:a:webpack.js:webpack:4.47.0:*:*:*:*:*:*:* (Confidence:Highest)

#### Published Vulnerabilities

CVE-2023-28154 (OSSINDEX)

    Webpack 5 before 5.76.0 does not avoid cross-realm object access. ImportParserPlugin.js mishandles the magic comment feature. An attacker who controls a property of an untrusted object can obtain access to the real global object.

    Sonatype's research suggests that this CVE's details differ from those defined at NVD. See https://ossindex.sonatype.org/vulnerability/CVE-2023-28154 for details

CWE-noinfo
CVSSv3:

- Base Score: CRITICAL (9.800000190734863)
- Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

References:

- OSSINDEX - [CVE-2023-28154] CWE-noinfo
- OSSIndex - http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2023-28154
- OSSIndex - https://github.com/webpack/webpack/pull/16500

Vulnerable Software & Versions (OSSINDEX):

- cpe:2.3:a:*:webpack:4.47.0:*:*:*:*:*:*:*

This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.