-
Notifications
You must be signed in to change notification settings - Fork 2
Description
Vulnerable Library - commitizen-2.10.1.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/lodash/package.json
Vulnerabilities
CVE | Severity | Dependency | Type | Fixed in (commitizen version) | Remediation Available | |
---|---|---|---|---|---|---|
CVE-2020-28499 | 9.8 | merge-1.2.1.tgz | Transitive | 4.2.4 | ✅ | |
CVE-2021-44906 | 9.8 | minimist-1.2.0.tgz | Transitive | 4.2.5 | ✅ | |
CVE-2019-10744 | 9.1 | lodash-4.17.5.tgz | Transitive | 3.1.2 | ✅ | |
CVE-2021-3807 | 7.5 | ansi-regex-3.0.0.tgz | Transitive | 3.0.0 | ✅ | |
CVE-2019-20149 | 7.5 | kind-of-6.0.2.tgz | Transitive | 3.0.0 | ✅ | |
CVE-2020-28469 | 7.5 | glob-parent-2.0.0.tgz | Transitive | 3.0.6 | ✅ | |
CVE-2020-8203 | 7.4 | lodash-4.17.5.tgz | Transitive | 3.0.0 | ✅ | |
CVE-2021-23337 | 7.2 | lodash-4.17.5.tgz | Transitive | 4.1.3 | ✅ | |
CVE-2022-0144 | 7.1 | shelljs-0.7.6.tgz | Transitive | 4.1.0 | ✅ | |
CVE-2019-1010266 | 6.5 | lodash-4.17.5.tgz | Transitive | 3.0.0 | ✅ | |
CVE-2022-0235 | 6.1 | node-fetch-1.6.3.tgz | Transitive | 3.0.0 | ✅ | |
CVE-2020-7598 | 5.6 | minimist-1.2.0.tgz | Transitive | 4.0.4 | ✅ | |
CVE-2018-16487 | 5.6 | lodash-4.17.5.tgz | Transitive | 3.0.0 | ✅ | |
CVE-2020-28500 | 5.3 | lodash-4.17.5.tgz | Transitive | 4.1.3 | ✅ | |
CVE-2020-15168 | 5.3 | node-fetch-1.6.3.tgz | Transitive | 3.0.0 | ✅ |
Details
CVE-2020-28499
Vulnerable Library - merge-1.2.1.tgz
Merge multiple objects into one, optionally creating a new cloned object. Similar to the jQuery.extend but more flexible. Works in Node.js and the browser.
Library home page: https://registry.npmjs.org/merge/-/merge-1.2.1.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/merge/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- find-node-modules-1.0.4.tgz
- ❌ merge-1.2.1.tgz (Vulnerable Library)
- find-node-modules-1.0.4.tgz
Vulnerability Details
All versions of package merge are vulnerable to Prototype Pollution via _recursiveMerge .
Publish Date: 2021-02-18
URL: CVE-2020-28499
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-02-18
Fix Resolution (merge): 2.1.0
Direct dependency fix Resolution (commitizen): 4.2.4
⛑️ Automatic Remediation is available for this issue
CVE-2021-44906
Vulnerable Library - minimist-1.2.0.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/mochify/node_modules/module-deps/node_modules/minimist/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- ❌ minimist-1.2.0.tgz (Vulnerable Library)
Vulnerability Details
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).
Publish Date: 2022-03-17
URL: CVE-2021-44906
CVSS 3 Score Details (9.8)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2022-03-17
Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (commitizen): 4.2.5
⛑️ Automatic Remediation is available for this issue
CVE-2019-10744
Vulnerable Library - lodash-4.17.5.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- ❌ lodash-4.17.5.tgz (Vulnerable Library)
Vulnerability Details
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
Publish Date: 2019-07-26
URL: CVE-2019-10744
CVSS 3 Score Details (9.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: GHSA-jf85-cpcp-j695
Release Date: 2019-07-26
Fix Resolution (lodash): 4.17.12
Direct dependency fix Resolution (commitizen): 3.1.2
⛑️ Automatic Remediation is available for this issue
CVE-2021-3807
Vulnerable Library - ansi-regex-3.0.0.tgz
Regular expression for matching ANSI escape codes
Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/opencollective/node_modules/ansi-regex/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- opencollective-1.0.3.tgz
- inquirer-3.0.6.tgz
- string-width-2.1.1.tgz
- strip-ansi-4.0.0.tgz
- ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)
- strip-ansi-4.0.0.tgz
- string-width-2.1.1.tgz
- inquirer-3.0.6.tgz
- opencollective-1.0.3.tgz
Vulnerability Details
ansi-regex is vulnerable to Inefficient Regular Expression Complexity
Publish Date: 2021-09-17
URL: CVE-2021-3807
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/
Release Date: 2021-09-17
Fix Resolution (ansi-regex): 3.0.1
Direct dependency fix Resolution (commitizen): 3.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2019-20149
Vulnerable Library - kind-of-6.0.2.tgz
Get the native type of a value.
Library home page: https://registry.npmjs.org/kind-of/-/kind-of-6.0.2.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/randomatic/node_modules/kind-of/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- find-node-modules-1.0.4.tgz
- findup-sync-0.4.2.tgz
- micromatch-2.3.11.tgz
- braces-1.8.5.tgz
- expand-range-1.8.2.tgz
- fill-range-2.2.4.tgz
- randomatic-3.1.1.tgz
- ❌ kind-of-6.0.2.tgz (Vulnerable Library)
- randomatic-3.1.1.tgz
- fill-range-2.2.4.tgz
- expand-range-1.8.2.tgz
- braces-1.8.5.tgz
- micromatch-2.3.11.tgz
- findup-sync-0.4.2.tgz
- find-node-modules-1.0.4.tgz
Vulnerability Details
ctorName in index.js in kind-of v6.0.2 allows external user input to overwrite certain internal attributes via a conflicting name, as demonstrated by 'constructor': {'name':'Symbol'}. Hence, a crafted payload can overwrite this builtin attribute to manipulate the type detection result.
Publish Date: 2019-12-30
URL: CVE-2019-20149
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-20149
Release Date: 2019-12-30
Fix Resolution (kind-of): 6.0.3
Direct dependency fix Resolution (commitizen): 3.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2020-28469
Vulnerable Library - glob-parent-2.0.0.tgz
Strips glob magic from a string to provide the parent path
Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-2.0.0.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/glob-parent/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- find-node-modules-1.0.4.tgz
- findup-sync-0.4.2.tgz
- micromatch-2.3.11.tgz
- parse-glob-3.0.4.tgz
- glob-base-0.3.0.tgz
- ❌ glob-parent-2.0.0.tgz (Vulnerable Library)
- glob-base-0.3.0.tgz
- parse-glob-3.0.4.tgz
- micromatch-2.3.11.tgz
- findup-sync-0.4.2.tgz
- find-node-modules-1.0.4.tgz
Vulnerability Details
This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.
Publish Date: 2021-06-03
URL: CVE-2020-28469
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469
Release Date: 2021-06-03
Fix Resolution (glob-parent): 5.1.2
Direct dependency fix Resolution (commitizen): 3.0.6
⛑️ Automatic Remediation is available for this issue
CVE-2020-8203
Vulnerable Library - lodash-4.17.5.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- ❌ lodash-4.17.5.tgz (Vulnerable Library)
Vulnerability Details
Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
Publish Date: 2020-07-15
URL: CVE-2020-8203
CVSS 3 Score Details (7.4)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1523
Release Date: 2020-07-15
Fix Resolution (lodash): 4.17.9
Direct dependency fix Resolution (commitizen): 3.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2021-23337
Vulnerable Library - lodash-4.17.5.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- ❌ lodash-4.17.5.tgz (Vulnerable Library)
Vulnerability Details
Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
Publish Date: 2021-02-15
URL: CVE-2021-23337
CVSS 3 Score Details (7.2)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: High
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: High
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (commitizen): 4.1.3
⛑️ Automatic Remediation is available for this issue
CVE-2022-0144
Vulnerable Library - shelljs-0.7.6.tgz
Portable Unix shell commands for Node.js
Library home page: https://registry.npmjs.org/shelljs/-/shelljs-0.7.6.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/shelljs/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- ❌ shelljs-0.7.6.tgz (Vulnerable Library)
Vulnerability Details
shelljs is vulnerable to Improper Privilege Management
Publish Date: 2022-01-11
URL: CVE-2022-0144
CVSS 3 Score Details (7.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Local
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2022-01-11
Fix Resolution (shelljs): 0.8.5
Direct dependency fix Resolution (commitizen): 4.1.0
⛑️ Automatic Remediation is available for this issue
CVE-2019-1010266
Vulnerable Library - lodash-4.17.5.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- ❌ lodash-4.17.5.tgz (Vulnerable Library)
Vulnerability Details
lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
Publish Date: 2019-07-17
URL: CVE-2019-1010266
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: Low
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: High
Suggested Fix
Type: Upgrade version
Release Date: 2019-07-17
Fix Resolution (lodash): 4.17.11
Direct dependency fix Resolution (commitizen): 3.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2022-0235
Vulnerable Library - node-fetch-1.6.3.tgz
A light-weight module that brings window.fetch to node.js and io.js
Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-1.6.3.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/node-fetch/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- opencollective-1.0.3.tgz
- ❌ node-fetch-1.6.3.tgz (Vulnerable Library)
- opencollective-1.0.3.tgz
Vulnerability Details
node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor
Publish Date: 2022-01-16
URL: CVE-2022-0235
CVSS 3 Score Details (6.1)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Changed
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: GHSA-r683-j2x4-v87g
Release Date: 2022-01-16
Fix Resolution (node-fetch): 2.6.7
Direct dependency fix Resolution (commitizen): 3.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2020-7598
Vulnerable Library - minimist-1.2.0.tgz
parse argument options
Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/mochify/node_modules/module-deps/node_modules/minimist/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- ❌ minimist-1.2.0.tgz (Vulnerable Library)
Vulnerability Details
minimist before 1.2.2 could be tricked into adding or modifying properties of Object.prototype using a "constructor" or "proto" payload.
Publish Date: 2020-03-11
URL: CVE-2020-7598
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Release Date: 2020-03-11
Fix Resolution (minimist): 1.2.3
Direct dependency fix Resolution (commitizen): 4.0.4
⛑️ Automatic Remediation is available for this issue
CVE-2018-16487
Vulnerable Library - lodash-4.17.5.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- ❌ lodash-4.17.5.tgz (Vulnerable Library)
Vulnerability Details
A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
Publish Date: 2019-02-01
URL: CVE-2018-16487
CVSS 3 Score Details (5.6)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: High
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: Low
- Integrity Impact: Low
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://hackerone.com/reports/380873
Release Date: 2019-02-01
Fix Resolution (lodash): 4.17.11
Direct dependency fix Resolution (commitizen): 3.0.0
⛑️ Automatic Remediation is available for this issue
CVE-2020-28500
Vulnerable Library - lodash-4.17.5.tgz
Lodash modular utilities.
Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.5.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/lodash/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- ❌ lodash-4.17.5.tgz (Vulnerable Library)
Vulnerability Details
Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
Mend Note: After conducting further research, Mend has determined that CVE-2020-28500 only affects environments with versions 4.0.0 to 4.17.20 of Lodash.
Publish Date: 2021-02-15
URL: CVE-2020-28500
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28500
Release Date: 2021-02-15
Fix Resolution (lodash): 4.17.21
Direct dependency fix Resolution (commitizen): 4.1.3
⛑️ Automatic Remediation is available for this issue
CVE-2020-15168
Vulnerable Library - node-fetch-1.6.3.tgz
A light-weight module that brings window.fetch to node.js and io.js
Library home page: https://registry.npmjs.org/node-fetch/-/node-fetch-1.6.3.tgz
Path to dependency file: /justapis-javascript-sdk/package.json
Path to vulnerable library: /node_modules/node-fetch/package.json
Dependency Hierarchy:
- commitizen-2.10.1.tgz (Root Library)
- opencollective-1.0.3.tgz
- ❌ node-fetch-1.6.3.tgz (Vulnerable Library)
- opencollective-1.0.3.tgz
Vulnerability Details
node-fetch before versions 2.6.1 and 3.0.0-beta.9 did not honor the size option after following a redirect, which means that when a content size was over the limit, a FetchError would never get thrown and the process would end without failure. For most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after fetch() has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.
Publish Date: 2020-09-10
URL: CVE-2020-15168
CVSS 3 Score Details (5.3)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: None
- Availability Impact: Low
Suggested Fix
Type: Upgrade version
Origin: GHSA-w7rc-rwvf-8q5r
Release Date: 2020-09-17
Fix Resolution (node-fetch): 2.6.1
Direct dependency fix Resolution (commitizen): 3.0.0
⛑️ Automatic Remediation is available for this issue
⛑️ Automatic Remediation is available for this issue.