laravel-mix-4.1.4.tgz: 22 vulnerabilities (highest severity is: 9.8)

[mend-bolt-for-github]

Vulnerable Library - laravel-mix-4.1.4.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/serialize-javascript/package.json

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2022-0691	High	9.8	url-parse-1.4.7.tgz	Transitive	5.0.0	❌
CVE-2022-0686	High	9.1	url-parse-1.4.7.tgz	Transitive	5.0.0	❌
CVE-2020-7660	High	8.1	serialize-javascript-1.9.1.tgz	Transitive	5.0.0	❌
CVE-2020-28469	High	7.5	glob-parent-3.1.0.tgz	Transitive	6.0.0-beta.15	❌
WS-2020-0042	High	7.5	acorn-6.3.0.tgz	Transitive	5.0.0	❌
WS-2020-0091	High	7.5	http-proxy-1.18.0.tgz	Transitive	5.0.0	❌
CVE-2022-24772	High	7.5	node-forge-0.9.0.tgz	Transitive	N/A	❌
CVE-2022-24771	High	7.5	node-forge-0.9.0.tgz	Transitive	N/A	❌
CVE-2020-7720	High	7.3	node-forge-0.9.0.tgz	Transitive	5.0.0	❌
CVE-2020-8116	High	7.3	dot-prop-4.2.0.tgz	Transitive	5.0.0	❌
WS-2022-0008	Medium	6.6	node-forge-0.9.0.tgz	Transitive	6.0.40	❌
CVE-2022-0122	Medium	6.1	node-forge-0.9.0.tgz	Transitive	6.0.40	❌
CVE-2020-7789	Medium	5.6	node-notifier-5.4.3.tgz	Transitive	5.0.0	❌
CVE-2019-16769	Medium	5.4	serialize-javascript-1.9.1.tgz	Transitive	5.0.0	❌
CVE-2020-7693	Medium	5.3	sockjs-0.3.19.tgz	Transitive	5.0.0	❌
CVE-2022-0512	Medium	5.3	url-parse-1.4.7.tgz	Transitive	5.0.0	❌
CVE-2020-7608	Medium	5.3	yargs-parser-11.1.1.tgz	Transitive	5.0.0	❌
CVE-2021-3664	Medium	5.3	url-parse-1.4.7.tgz	Transitive	5.0.0	❌
CVE-2022-0639	Medium	5.3	url-parse-1.4.7.tgz	Transitive	5.0.0	❌
CVE-2022-24773	Medium	5.3	node-forge-0.9.0.tgz	Transitive	N/A	❌
CVE-2021-23364	Medium	5.3	browserslist-4.7.0.tgz	Transitive	5.0.0	❌
CVE-2021-27515	Medium	5.3	url-parse-1.4.7.tgz	Transitive	5.0.0	❌

Details

Partial details (17 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the WhiteSource Application.

CVE-2022-0691

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/url-parse/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-dev-server-3.8.2.tgz
    • sockjs-client-1.4.0.tgz
      • ❌ url-parse-1.4.7.tgz (Vulnerable Library)

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here

CVE-2022-0686

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/url-parse/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-dev-server-3.8.2.tgz
    • sockjs-client-1.4.0.tgz
      • ❌ url-parse-1.4.7.tgz (Vulnerable Library)

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Publish Date: 2022-02-20

URL: CVE-2022-0686

CVSS 3 Score Details (9.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686

Release Date: 2022-02-20

Fix Resolution (url-parse): 1.5.8

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7660

Vulnerable Library - serialize-javascript-1.9.1.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.9.1.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/serialize-javascript/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • terser-webpack-plugin-1.4.1.tgz
    • ❌ serialize-javascript-1.9.1.tgz (Vulnerable Library)

Vulnerability Details

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

Publish Date: 2020-06-01

URL: CVE-2020-7660

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660

Release Date: 2020-06-08

Fix Resolution (serialize-javascript): 3.1.0

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here

CVE-2020-28469

Vulnerable Library - glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/glob-parent/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • chokidar-2.1.8.tgz
    • ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (laravel-mix): 6.0.0-beta.15

Step up your Open Source Security Game with WhiteSource here

WS-2020-0042

Vulnerable Library - acorn-6.3.0.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-6.3.0.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/acorn/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-4.41.0.tgz
    • ❌ acorn-6.3.0.tgz (Vulnerable Library)

Vulnerability Details

acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.

Publish Date: 2020-03-01

URL: WS-2020-0042

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1488

Release Date: 2020-03-01

Fix Resolution (acorn): 6.4.1

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here

WS-2020-0091

Vulnerable Library - http-proxy-1.18.0.tgz

HTTP proxying for the masses

Library home page: https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.0.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/http-proxy/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-dev-server-3.8.2.tgz
    • http-proxy-middleware-0.19.1.tgz
      • ❌ http-proxy-1.18.0.tgz (Vulnerable Library)

Vulnerability Details

Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.

Publish Date: 2020-05-14

URL: WS-2020-0091

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1486

Release Date: 2020-05-14

Fix Resolution (http-proxy): 1.18.1

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here

CVE-2022-24772

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/node-forge/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-dev-server-3.8.2.tgz
    • selfsigned-1.10.7.tgz
      • ❌ node-forge-0.9.0.tgz (Vulnerable Library)

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution: node-forge - 1.3.0

Step up your Open Source Security Game with WhiteSource here

CVE-2022-24771

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/node-forge/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-dev-server-3.8.2.tgz
    • selfsigned-1.10.7.tgz
      • ❌ node-forge-0.9.0.tgz (Vulnerable Library)

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24771

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771

Release Date: 2022-03-18

Fix Resolution: node-forge - 1.3.0

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7720

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/node-forge/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-dev-server-3.8.2.tgz
    • selfsigned-1.10.7.tgz
      • ❌ node-forge-0.9.0.tgz (Vulnerable Library)

Vulnerability Details

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

Publish Date: 2020-09-01

URL: CVE-2020-7720

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/digitalbazaar/forge/blob/master/CHANGELOG.md

Release Date: 2020-09-01

Fix Resolution (node-forge): 0.10.0

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here

CVE-2020-8116

Vulnerable Library - dot-prop-4.2.0.tgz

Get, set, or delete a property from a nested object using a dot path

Library home page: https://registry.npmjs.org/dot-prop/-/dot-prop-4.2.0.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/dot-prop/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • optimize-css-assets-webpack-plugin-5.0.3.tgz
    • cssnano-4.1.10.tgz
      • cssnano-preset-default-4.0.7.tgz
        • postcss-merge-rules-4.0.3.tgz
          • postcss-selector-parser-3.1.1.tgz
            • ❌ dot-prop-4.2.0.tgz (Vulnerable Library)

Vulnerability Details

Prototype pollution vulnerability in dot-prop npm package versions before 4.2.1 and versions 5.x before 5.1.1 allows an attacker to add arbitrary properties to JavaScript language constructs such as objects.

Publish Date: 2020-02-04

URL: CVE-2020-8116

CVSS 3 Score Details (7.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8116

Release Date: 2020-02-04

Fix Resolution (dot-prop): 4.2.1

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here

WS-2022-0008

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/node-forge/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-dev-server-3.8.2.tgz
    • selfsigned-1.10.7.tgz
      • ❌ node-forge-0.9.0.tgz (Vulnerable Library)

Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

CVSS 3 Score Details (6.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: High
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (laravel-mix): 6.0.40

Step up your Open Source Security Game with WhiteSource here

CVE-2022-0122

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/node-forge/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-dev-server-3.8.2.tgz
    • selfsigned-1.10.7.tgz
      • ❌ node-forge-0.9.0.tgz (Vulnerable Library)

Vulnerability Details

forge is vulnerable to URL Redirection to Untrusted Site

Publish Date: 2022-01-06

URL: CVE-2022-0122

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-gf8q-jrpm-jvxq

Release Date: 2022-01-06

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (laravel-mix): 6.0.40

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7789

Vulnerable Library - node-notifier-5.4.3.tgz

A Node.js module for sending notifications on native Mac, Windows (post and pre 8) and Linux (or Growl as fallback)

Library home page: https://registry.npmjs.org/node-notifier/-/node-notifier-5.4.3.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/node-notifier/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-notifier-1.8.0.tgz
    • ❌ node-notifier-5.4.3.tgz (Vulnerable Library)

Vulnerability Details

This affects the package node-notifier before 9.0.0. It allows an attacker to run arbitrary commands on Linux machines due to the options params not being sanitised when being passed an array.

Publish Date: 2020-12-11

URL: CVE-2020-7789

CVSS 3 Score Details (5.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7789

Release Date: 2020-12-11

Fix Resolution (node-notifier): 5.4.4

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here

CVE-2019-16769

Vulnerable Library - serialize-javascript-1.9.1.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-1.9.1.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/serialize-javascript/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • terser-webpack-plugin-1.4.1.tgz
    • ❌ serialize-javascript-1.9.1.tgz (Vulnerable Library)

Vulnerability Details

The serialize-javascript npm package before version 2.1.1 is vulnerable to Cross-site Scripting (XSS). It does not properly mitigate against unsafe characters in serialized regular expressions. This vulnerability is not affected on Node.js environment since Node.js's implementation of RegExp.prototype.toString() backslash-escapes all forward slashes in regular expressions. If serialized data of regular expression objects are used in an environment other than Node.js, it is affected by this vulnerability.

Publish Date: 2019-12-05

URL: CVE-2019-16769

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-16769

Release Date: 2020-01-17

Fix Resolution (serialize-javascript): 2.1.1

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7693

Vulnerable Library - sockjs-0.3.19.tgz

SockJS-node is a server counterpart of SockJS-client a JavaScript library that provides a WebSocket-like object in the browser. SockJS gives you a coherent, cross-browser, Javascript API which creates a low latency, full duplex, cross-domain communication

Library home page: https://registry.npmjs.org/sockjs/-/sockjs-0.3.19.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/sockjs/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-dev-server-3.8.2.tgz
    • ❌ sockjs-0.3.19.tgz (Vulnerable Library)

Vulnerability Details

Incorrect handling of Upgrade header with the value websocket leads in crashing of containers hosting sockjs apps. This affects the package sockjs before 0.3.20.

Publish Date: 2020-07-09

URL: CVE-2020-7693

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: sockjs/sockjs-node#265

Release Date: 2020-07-14

Fix Resolution (sockjs): 0.3.20

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here

CVE-2022-0512

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/url-parse/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • webpack-dev-server-3.8.2.tgz
    • sockjs-client-1.4.0.tgz
      • ❌ url-parse-1.4.7.tgz (Vulnerable Library)

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.

Publish Date: 2022-02-14

URL: CVE-2022-0512

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0512

Release Date: 2022-02-14

Fix Resolution (url-parse): 1.5.6

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here

CVE-2020-7608

Vulnerable Library - yargs-parser-11.1.1.tgz

the mighty option parser used by yargs

Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-11.1.1.tgz

Path to dependency file: /galaxyofdrones/package.json

Path to vulnerable library: /galaxyofdrones/node_modules/yargs/node_modules/yargs-parser/package.json

Dependency Hierarchy:

• laravel-mix-4.1.4.tgz (Root Library)
  • yargs-12.0.5.tgz
    • ❌ yargs-parser-11.1.1.tgz (Vulnerable Library)

Vulnerability Details

yargs-parser could be tricked into adding or modifying properties of Object.prototype using a "proto" payload.

Publish Date: 2020-03-16

URL: CVE-2020-7608

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: yargs/yargs-parser@63810ca

Release Date: 2020-03-16

Fix Resolution (yargs-parser): 13.1.2

Direct dependency fix Resolution (laravel-mix): 5.0.0

Step up your Open Source Security Game with WhiteSource here