meanstackjs icon indicating copy to clipboard operation
meanstackjs copied to clipboard

Published 20 hours ago • verified publisher icon greenpioneersolutions

[Snyk] Fix for 21 vulnerabilities

Open GreenPioneer opened this issue 8 months ago • 0 comments

This PR was automatically created by Snyk using the credentials of a real user.


![snyk-top-banner](https://github.com/andygongea/OWASP-Benchmark/assets/818805/c518c423-16fe-447e-b67f-ad5a49b5d123)

Snyk has created this PR to fix 21 vulnerabilities in the yarn dependencies of this project.

Snyk changed the following file(s):

  • package.json
  • yarn.lock

Note for zero-installs users

If you are using the Yarn feature zero-installs that was introduced in Yarn V2, note that this PR does not update the .yarn/cache/ directory meaning this code cannot be pulled and immediately developed on as one would expect for a zero-install project - you will need to run yarn to update the contents of the ./yarn/cache directory. If you are not using zero-install you can ignore this as your flow should likely be unchanged.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
critical severity Authentication Bypass
SNYK-JS-HAWK-6969142		   858  
high severity Prototype Pollution
SNYK-JS-LODASH-567746		   731  
high severity Cryptographic Issues
SNYK-JS-ELLIPTIC-571484		   706  
high severity Prototype Pollution
SNYK-JS-LODASH-6139239		   696  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MOMENT-2944238		   696  
high severity Prototype Poisoning
SNYK-JS-QS-3153490		   696  
high severity Prototype Pollution
SNYK-JS-LODASH-450202		   686  
high severity Prototype Pollution
SNYK-JS-LODASH-608086		   686  
high severity Prototype Pollution
SNYK-JS-LODASH-73638		   686  
high severity Command Injection
SNYK-JS-LODASH-1040724		   681  
high severity Prototype Pollution
SNYK-JS-JSONSCHEMA-1920922		   644  
high severity Prototype Pollution
SNYK-JS-AJV-584908		   619  
medium severity Prototype Pollution
SNYK-JS-MINIMIST-559764		   601  
high severity Directory Traversal
SNYK-JS-MOMENT-2440688		   589  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-1018905		   586  
medium severity Cryptographic Issues
SNYK-JS-ELLIPTIC-1064899		   554  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-LODASH-73639		   541  
medium severity Remote Code Execution (RCE)
SNYK-JS-BUNYAN-573166		   524  
medium severity Timing Attack
SNYK-JS-ELLIPTIC-511941		   509  
low severity Prototype Pollution
SNYK-JS-MINIMIST-2429795		   506  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-JS-MINIMATCH-3050818		   479  

[!IMPORTANT]

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information: 🧐 View latest project report 📜 Customise PR templates 🛠 Adjust project settings 📚 Read about Snyk's upgrade logic

Learn how to fix vulnerabilities with free interactive lessons:

🦉 Prototype Pollution 🦉 Remote Code Execution (RCE) 🦉 Cryptographic Issues 🦉 More lessons are available in Snyk Learn

[//]: # 'snyk:metadata:{"customTemplate":{"variablesUsed":[],"fieldsUsed":[]},"dependencies":[{"name":"glob","from":"7.1.1","to":"9.0.0"},{"name":"less","from":"3.0.1","to":"3.0.2"},{"name":"node-sass","from":"4.8.1","to":"4.9.4"},{"name":"passport-azure-ad","from":"4.0.0","to":"4.3.5"},{"name":"request","from":"2.85.0","to":"2.88.2"}],"env":"prod","issuesToFix":[{"exploit_maturity":"No Known Exploit","id":"SNYK-JS-AJV-584908","priority_score":619,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.1","score":405},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JS-BUNYAN-573166","priority_score":524,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.2","score":310},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Remote Code Execution (RCE)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JS-ELLIPTIC-1064899","priority_score":554,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"6.8","score":340},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Cryptographic Issues"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JS-ELLIPTIC-511941","priority_score":509,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.9","score":295},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Timing Attack"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-ELLIPTIC-571484","priority_score":706,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.7","score":385},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Cryptographic Issues"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-HAWK-6969142","priority_score":858,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"freshness","label":true,"score":71},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"9.3","score":465},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Authentication Bypass"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-HAWK-6969142","priority_score":858,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"freshness","label":true,"score":71},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"9.3","score":465},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Authentication Bypass"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-HAWK-6969142","priority_score":858,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"freshness","label":true,"score":71},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"9.3","score":465},{"type":"scoreVersion","label":"v1","score":1}],"severity":"critical","title":"Authentication Bypass"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JS-JSONSCHEMA-1920922","priority_score":644,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.6","score":430},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-LODASH-1018905","priority_score":586,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-LODASH-1040724","priority_score":681,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.2","score":360},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Command Injection"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-LODASH-450202","priority_score":686,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.3","score":365},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-LODASH-567746","priority_score":731,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"8.2","score":410},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-LODASH-608086","priority_score":686,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.3","score":365},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-LODASH-6139239","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-LODASH-73638","priority_score":686,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.3","score":365},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Pollution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-LODASH-73639","priority_score":541,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"4.4","score":220},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JS-MINIMATCH-3050818","priority_score":479,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.3","score":265},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-MINIMIST-2429795","priority_score":506,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"3.7","score":185},{"type":"scoreVersion","label":"v1","score":1}],"severity":"low","title":"Prototype Pollution"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-MINIMIST-559764","priority_score":601,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"5.6","score":280},{"type":"scoreVersion","label":"v1","score":1}],"severity":"medium","title":"Prototype Pollution"},{"exploit_maturity":"No Known Exploit","id":"SNYK-JS-MOMENT-2440688","priority_score":589,"priority_score_factors":[{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Directory Traversal"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-MOMENT-2944238","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Regular Expression Denial of Service (ReDoS)"},{"exploit_maturity":"Proof of Concept","id":"SNYK-JS-QS-3153490","priority_score":696,"priority_score_factors":[{"type":"exploit","label":"Proof of Concept","score":107},{"type":"fixability","label":true,"score":214},{"type":"cvssScore","label":"7.5","score":375},{"type":"scoreVersion","label":"v1","score":1}],"severity":"high","title":"Prototype Poisoning"}],"prId":"a212d9f8-a08c-434e-9b5d-6569da08fe5c","prPublicId":"a212d9f8-a08c-434e-9b5d-6569da08fe5c","packageManager":"yarn","priorityScoreList":[619,524,554,509,706,858,644,586,681,686,731,686,696,686,541,479,506,601,589,696,696],"projectPublicId":"6b509087-c2c3-41f7-a1cd-1b71d4fbd518","projectUrl":"https://app.snyk.io/org/greenpioneer/project/6b509087-c2c3-41f7-a1cd-1b71d4fbd518?utm_source=github&utm_medium=referral&page=fix-pr","prType":"fix","templateFieldSources":{"branchName":"default","commitMessage":"default","description":"default","title":"default"},"templateVariants":["priorityScore"],"type":"auto","upgrade":["SNYK-JS-AJV-584908","SNYK-JS-BUNYAN-573166","SNYK-JS-ELLIPTIC-1064899","SNYK-JS-ELLIPTIC-511941","SNYK-JS-ELLIPTIC-571484","SNYK-JS-HAWK-6969142","SNYK-JS-JSONSCHEMA-1920922","SNYK-JS-LODASH-1018905","SNYK-JS-LODASH-1040724","SNYK-JS-LODASH-450202","SNYK-JS-LODASH-567746","SNYK-JS-LODASH-608086","SNYK-JS-LODASH-6139239","SNYK-JS-LODASH-73638","SNYK-JS-LODASH-73639","SNYK-JS-MINIMATCH-3050818","SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-559764","SNYK-JS-MOMENT-2440688","SNYK-JS-MOMENT-2944238","SNYK-JS-QS-3153490"],"vulns":["SNYK-JS-AJV-584908","SNYK-JS-BUNYAN-573166","SNYK-JS-ELLIPTIC-1064899","SNYK-JS-ELLIPTIC-511941","SNYK-JS-ELLIPTIC-571484","SNYK-JS-HAWK-6969142","SNYK-JS-JSONSCHEMA-1920922","SNYK-JS-LODASH-1018905","SNYK-JS-LODASH-1040724","SNYK-JS-LODASH-450202","SNYK-JS-LODASH-567746","SNYK-JS-LODASH-608086","SNYK-JS-LODASH-6139239","SNYK-JS-LODASH-73638","SNYK-JS-LODASH-73639","SNYK-JS-MINIMATCH-3050818","SNYK-JS-MINIMIST-2429795","SNYK-JS-MINIMIST-559764","SNYK-JS-MOMENT-2440688","SNYK-JS-MOMENT-2944238","SNYK-JS-QS-3153490"],"patch":[],"isBreakingChange":true,"remediationStrategy":"vuln"}'

GreenPioneer avatar May 29 '24 19:05 GreenPioneer