Update optimize wave3 (need update wave 4 to wave 8)
This commit is contained in:
thanhnv
@@ -0,0 +1,569 @@
|
||||
{
|
||||
"auditReportVersion": 2,
|
||||
"vulnerabilities": {
|
||||
"@mapbox/node-pre-gyp": {
|
||||
"name": "@mapbox/node-pre-gyp",
|
||||
"severity": "high",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
"tar"
|
||||
],
|
||||
"effects": [],
|
||||
"range": "<=1.0.11",
|
||||
"nodes": [
|
||||
"node_modules/@mapbox/node-pre-gyp"
|
||||
],
|
||||
"fixAvailable": true
|
||||
},
|
||||
"@nestjs/common": {
|
||||
"name": "@nestjs/common",
|
||||
"severity": "moderate",
|
||||
"isDirect": true,
|
||||
"via": [
|
||||
"file-type"
|
||||
],
|
||||
"effects": [],
|
||||
"range": "10.4.16 - 10.4.22 || 11.0.16 - 11.1.16 || 12.0.0-alpha.0 - 12.0.0-alpha.2",
|
||||
"nodes": [
|
||||
"node_modules/@nestjs/common"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/common",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"@nestjs/core": {
|
||||
"name": "@nestjs/core",
|
||||
"severity": "moderate",
|
||||
"isDirect": true,
|
||||
"via": [
|
||||
{
|
||||
"source": 1117063,
|
||||
"name": "@nestjs/core",
|
||||
"dependency": "@nestjs/core",
|
||||
"title": "@nestjs/core Improperly Neutralizes Special Elements in Output Used by a Downstream Component ('Injection')",
|
||||
"url": "https://github.com/advisories/GHSA-36xv-jgw5-4q75",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-74"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 6.1,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:L"
|
||||
},
|
||||
"range": "<=11.1.17"
|
||||
}
|
||||
],
|
||||
"effects": [],
|
||||
"range": "<=11.1.17",
|
||||
"nodes": [
|
||||
"node_modules/@nestjs/core"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/core",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"@nestjs/platform-express": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"severity": "high",
|
||||
"isDirect": true,
|
||||
"via": [
|
||||
"body-parser",
|
||||
"express",
|
||||
"multer"
|
||||
],
|
||||
"effects": [],
|
||||
"range": "<=11.1.14 || 12.0.0-alpha.0 - 12.0.0-alpha.2",
|
||||
"nodes": [
|
||||
"node_modules/@nestjs/platform-express"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"body-parser": {
|
||||
"name": "body-parser",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
"qs"
|
||||
],
|
||||
"effects": [
|
||||
"@nestjs/platform-express"
|
||||
],
|
||||
"range": "1.20.3 - 1.20.4 || 2.0.0-beta.1 - 2.0.2",
|
||||
"nodes": [
|
||||
"node_modules/body-parser"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"esbuild": {
|
||||
"name": "esbuild",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1102341,
|
||||
"name": "esbuild",
|
||||
"dependency": "esbuild",
|
||||
"title": "esbuild enables any website to send any requests to the development server and read the response",
|
||||
"url": "https://github.com/advisories/GHSA-67mh-4wv8-2f99",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-346"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N"
|
||||
},
|
||||
"range": "<=0.24.2"
|
||||
}
|
||||
],
|
||||
"effects": [
|
||||
"vite"
|
||||
],
|
||||
"range": "<=0.24.2",
|
||||
"nodes": [
|
||||
"node_modules/vite/node_modules/esbuild"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "vite",
|
||||
"version": "8.1.1",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"express": {
|
||||
"name": "express",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
"qs"
|
||||
],
|
||||
"effects": [
|
||||
"@nestjs/platform-express"
|
||||
],
|
||||
"range": "4.21.0 - 4.22.1 || 5.0.0-alpha.1 - 5.0.1",
|
||||
"nodes": [
|
||||
"node_modules/express"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"file-type": {
|
||||
"name": "file-type",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1114301,
|
||||
"name": "file-type",
|
||||
"dependency": "file-type",
|
||||
"title": "file-type affected by infinite loop in ASF parser on malformed input with zero-size sub-header",
|
||||
"url": "https://github.com/advisories/GHSA-5v7r-6r5c-r473",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-835"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
},
|
||||
"range": ">=13.0.0 <21.3.1"
|
||||
},
|
||||
{
|
||||
"source": 1114726,
|
||||
"name": "file-type",
|
||||
"dependency": "file-type",
|
||||
"title": "file-type: ZIP Decompression Bomb DoS via [Content_Types].xml entry",
|
||||
"url": "https://github.com/advisories/GHSA-j47w-4g3g-c36v",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-400",
|
||||
"CWE-409"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
},
|
||||
"range": ">=20.0.0 <=21.3.1"
|
||||
}
|
||||
],
|
||||
"effects": [
|
||||
"@nestjs/common"
|
||||
],
|
||||
"range": "13.0.0 - 21.3.1",
|
||||
"nodes": [
|
||||
"node_modules/file-type"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/common",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"multer": {
|
||||
"name": "multer",
|
||||
"severity": "high",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1113635,
|
||||
"name": "multer",
|
||||
"dependency": "multer",
|
||||
"title": "Multer vulnerable to Denial of Service via incomplete cleanup",
|
||||
"url": "https://github.com/advisories/GHSA-xf7r-hgr6-v32p",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-459"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<2.1.0"
|
||||
},
|
||||
{
|
||||
"source": 1113636,
|
||||
"name": "multer",
|
||||
"dependency": "multer",
|
||||
"title": "Multer vulnerable to Denial of Service via resource exhaustion",
|
||||
"url": "https://github.com/advisories/GHSA-v52c-386h-88mc",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-772"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<2.1.0"
|
||||
},
|
||||
{
|
||||
"source": 1113996,
|
||||
"name": "multer",
|
||||
"dependency": "multer",
|
||||
"title": "Multer Vulnerable to Denial of Service via Uncontrolled Recursion",
|
||||
"url": "https://github.com/advisories/GHSA-5528-5vmv-3xc2",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-674"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<2.1.1"
|
||||
},
|
||||
{
|
||||
"source": 1121089,
|
||||
"name": "multer",
|
||||
"dependency": "multer",
|
||||
"title": "Multer vulnerable to Denial of Service via deeply nested field names",
|
||||
"url": "https://github.com/advisories/GHSA-72gw-mp4g-v24j",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-400"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 7.5,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"
|
||||
},
|
||||
"range": ">=1.0.0 <2.2.0"
|
||||
},
|
||||
{
|
||||
"source": 1121091,
|
||||
"name": "multer",
|
||||
"dependency": "multer",
|
||||
"title": "Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads",
|
||||
"url": "https://github.com/advisories/GHSA-3p4h-7m6x-2hcm",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-459"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
},
|
||||
"range": ">=2.0.0-alpha.1 <2.2.0"
|
||||
}
|
||||
],
|
||||
"effects": [
|
||||
"@nestjs/platform-express"
|
||||
],
|
||||
"range": "<=2.1.1",
|
||||
"nodes": [
|
||||
"node_modules/multer"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"qs": {
|
||||
"name": "qs",
|
||||
"severity": "moderate",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1119502,
|
||||
"name": "qs",
|
||||
"dependency": "qs",
|
||||
"title": "qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
|
||||
"url": "https://github.com/advisories/GHSA-q8mj-m7cp-5q26",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-476"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 5.3,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
|
||||
},
|
||||
"range": ">=6.11.1 <=6.15.1"
|
||||
}
|
||||
],
|
||||
"effects": [
|
||||
"body-parser",
|
||||
"express"
|
||||
],
|
||||
"range": "6.11.1 - 6.15.1",
|
||||
"nodes": [
|
||||
"node_modules/qs"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "@nestjs/platform-express",
|
||||
"version": "11.1.27",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
},
|
||||
"tar": {
|
||||
"name": "tar",
|
||||
"severity": "high",
|
||||
"isDirect": false,
|
||||
"via": [
|
||||
{
|
||||
"source": 1112659,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal",
|
||||
"url": "https://github.com/advisories/GHSA-34x7-hfp2-rc4v",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22",
|
||||
"CWE-59"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 8.2,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N"
|
||||
},
|
||||
"range": "<7.5.7"
|
||||
},
|
||||
{
|
||||
"source": 1113300,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization",
|
||||
"url": "https://github.com/advisories/GHSA-8qq5-rm4j-mr97",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=7.5.2"
|
||||
},
|
||||
{
|
||||
"source": 1113375,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction",
|
||||
"url": "https://github.com/advisories/GHSA-83g3-92jg-28cx",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 7.1,
|
||||
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N"
|
||||
},
|
||||
"range": "<7.5.8"
|
||||
},
|
||||
{
|
||||
"source": 1114200,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "tar has Hardlink Path Traversal via Drive-Relative Linkpath",
|
||||
"url": "https://github.com/advisories/GHSA-qffp-2rhf-9h96",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22",
|
||||
"CWE-59"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=7.5.9"
|
||||
},
|
||||
{
|
||||
"source": 1114302,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "node-tar Symlink Path Traversal via Drive-Relative Linkpath",
|
||||
"url": "https://github.com/advisories/GHSA-9ppj-qmqm-q256",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=7.5.10"
|
||||
},
|
||||
{
|
||||
"source": 1114680,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS",
|
||||
"url": "https://github.com/advisories/GHSA-r6q2-hw4h-h46w",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-176",
|
||||
"CWE-367"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 8.8,
|
||||
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L"
|
||||
},
|
||||
"range": "<=7.5.3"
|
||||
},
|
||||
{
|
||||
"source": 1120782,
|
||||
"name": "tar",
|
||||
"dependency": "tar",
|
||||
"title": "node-tar applies PAX size override to intermediary GNU long-name/long-link headers, causing tar parser interpretation differential (file smuggling)",
|
||||
"url": "https://github.com/advisories/GHSA-vmf3-w455-68vh",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-436"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=7.5.15"
|
||||
}
|
||||
],
|
||||
"effects": [
|
||||
"@mapbox/node-pre-gyp"
|
||||
],
|
||||
"range": "<=7.5.15",
|
||||
"nodes": [
|
||||
"node_modules/tar"
|
||||
],
|
||||
"fixAvailable": true
|
||||
},
|
||||
"vite": {
|
||||
"name": "vite",
|
||||
"severity": "high",
|
||||
"isDirect": true,
|
||||
"via": [
|
||||
{
|
||||
"source": 1116229,
|
||||
"name": "vite",
|
||||
"dependency": "vite",
|
||||
"title": "Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
|
||||
"url": "https://github.com/advisories/GHSA-4w7w-66w2-5vf9",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-22",
|
||||
"CWE-200"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=6.4.1"
|
||||
},
|
||||
{
|
||||
"source": 1120784,
|
||||
"name": "vite",
|
||||
"dependency": "vite",
|
||||
"title": "launch-editor: NTLMv2 hash disclosure via UNC path handling on Windows",
|
||||
"url": "https://github.com/advisories/GHSA-v6wh-96g9-6wx3",
|
||||
"severity": "moderate",
|
||||
"cwe": [
|
||||
"CWE-73",
|
||||
"CWE-522"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=6.4.2"
|
||||
},
|
||||
{
|
||||
"source": 1120789,
|
||||
"name": "vite",
|
||||
"dependency": "vite",
|
||||
"title": "vite: `server.fs.deny` bypass on Windows alternate paths",
|
||||
"url": "https://github.com/advisories/GHSA-fx2h-pf6j-xcff",
|
||||
"severity": "high",
|
||||
"cwe": [
|
||||
"CWE-22",
|
||||
"CWE-200"
|
||||
],
|
||||
"cvss": {
|
||||
"score": 0,
|
||||
"vectorString": null
|
||||
},
|
||||
"range": "<=6.4.2"
|
||||
},
|
||||
"esbuild"
|
||||
],
|
||||
"effects": [],
|
||||
"range": "<=6.4.2",
|
||||
"nodes": [
|
||||
"node_modules/vite"
|
||||
],
|
||||
"fixAvailable": {
|
||||
"name": "vite",
|
||||
"version": "8.1.1",
|
||||
"isSemVerMajor": true
|
||||
}
|
||||
}
|
||||
},
|
||||
"metadata": {
|
||||
"vulnerabilities": {
|
||||
"info": 0,
|
||||
"low": 0,
|
||||
"moderate": 7,
|
||||
"high": 5,
|
||||
"critical": 0,
|
||||
"total": 12
|
||||
},
|
||||
"dependencies": {
|
||||
"prod": 220,
|
||||
"dev": 259,
|
||||
"optional": 75,
|
||||
"peer": 0,
|
||||
"peerOptional": 0,
|
||||
"total": 478
|
||||
}
|
||||
}
|
||||
}
|
||||
Reference in New Issue
Block a user