You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
<?xml version="1.0"?><analysisxmlns="https://jeremylong.github.io/DependencyCheck/dependency-check.2.5.xsd"><scanInfo><engineVersion>6.5.3</engineVersion><dataSource><name>NVD CVE Checked</name><timestamp>2022-01-22T14:36:52</timestamp></dataSource><dataSource><name>NVD CVE Modified</name><timestamp>2022-01-22T14:00:01</timestamp></dataSource><dataSource><name>VersionCheckOn</name><timestamp>2022-01-15T15:27:20</timestamp></dataSource></scanInfo><projectInfo><name></name><reportDate>2022-01-22T13:40:32.740468526Z</reportDate><credits>This report contains data retrieved from the National Vulnerability Database: https://nvd.nist.gov, NPM Public Advisories: https://www.npmjs.com/advisories, and the RetireJS community.</credits></projectInfo><dependencies></dependencies></analysis>
<credits>This report contains data retrieved from the National Vulnerability Database: https://nvd.nist.gov, NPM Public Advisories: https://www.npmjs.com/advisories, and the RetireJS community.</credits>
[{"id":521,"updated_at":"2018-05-08T14:27:01.871Z","created_at":"2017-08-13T04:26:17.960Z","publish_date":"2017-08-13T04:34:53.158Z","overview":"Affected versions of `pg` contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. \n\nThere are two specific scenarios in which it is likely for an application to be vulnerable:\n1. The application executes unsafe, user-supplied sql which contains malicious column names.\n2. The application connects to an untrusted database and executes a query returning results which contain a malicious column name.\n\n## Proof of Concept\n```\nconst { Client } = require('pg')\nconst client = new Client()\nclient.connect()\n\nconst sql = `SELECT 1 AS \"\\\\'/*\", 2 AS \"\\\\'*/\\n + console.log(process.env)] = null;\\n//\"`\n\nclient.query(sql, (err, res) => {\n client.end()\n})\n```","recommendation":"* Version 2.x.x: Update to version 2.11.2 or later.\n* Version 3.x.x: Update to version 3.6.4 or later.\n* Version 4.x.x: Update to version 4.5.7 or later.\n* Version 5.x.x: Update to version 5.2.1 or later.\n* Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. )\n* Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )","cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H","cvss_score":8.3,"module":"pg","version":"5.1.0","vulnerable_versions":"< 2.11.2 || >= 3.0.0 < 3.6.4 || >= 4.0.0 < 4.5.7 || >= 5.0.0 < 5.2.1 || >= 6.0.0 < 6.0.5 || >= 6.1.0 < 6.1.6 || >= 6.2.0 < 6.2.5 || >= 6.3.0 < 6.3.3 || >= 6.4.0 < 6.4.2 || >= 7.0.0 < 7.0.2 || >= 7.1.0 < 7.1.2","patched_versions":">= 2.11.2 < 3.0.0|| >= 3.6.4 < 4.0.0 || >= 4.5.7 < 5.0.0 || >= 5.2.1 < 6.0.0 || >= 6.0.5 < 6.1.0 || >= 6.1.6 < 6.2.0 || >= 6.2.5 < 6.3.0 || >= 6.3.3 < 6.4.0 || >= 6.4.2 < 7.0.0 || >= 7.0.2 < 7.1.0 || >= 7.1.2","title":"Remote Code Execution","path":["vulnerable-node-source@0.0.0","pg-promise@4.8.1","pg@5.1.0"],"advisory":"https://nodesecurity.io/advisories/521"},{"id":535,"updated_at":"2018-05-08T14:27:01.895Z","created_at":"2017-09-25T19:02:28.152Z","publish_date":"2017-09-27T18:25:14.672Z","overview":"Affected versions of `mime` are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.","recommendation":"Update to version 2.0.3 or later.","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5,"module":"mime","version":"1.3.4","vulnerable_versions":"< 1.4.1 || > 2.0.0 < 2.0.3","patched_versions":">= 1.4.1 < 2.0.0 || >= 2.0.3","title":"Regular Expression Denial of Service","path":["vulnerable-node-source@0.0.0","express@4.13.4","send@0.13.1","mime@1.3.4"],"advisory":"https://nodesecurity.io/advisories/535"},{"id":526,"updated_at":"2018-05-08T14:27:01.882Z","created_at":"2017-09-08T20:23:54.164Z","publish_date":"2017-09-26T16:06:50.827Z","overview":"Affected versions of `fresh` are vulnerable to regular expression denial of service when parsing specially crafted user input.","recommendation":"Update to version 0.5.2 or later.","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5,"module":"fresh","version":"0.3.0","vulnerable_versions":"< 0.5.2","patched_versions":">= 0.5.2","title":"Regular Expression Denial of Service","path":["vulnerable-node-source@0.0.0","express@4.13.4","fresh@0.3.0"],"advisory":"https://nodesecurity.io/advisories/526"},{"id":526,"updated_at":"2018-05-08T14:27:01.882Z","created_at":"2017-09-08T20:23:54.164Z","publish_date":"2017-09-26T16:06:50.827Z","overview":"Affected versions of `fresh` are vulnerable to regular expression denial of service when parsing specially crafted user input.","recommendation":"Update to version 0.5.2 or later.","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5,"module":"fresh","version":"0.3.0","vulnerable_versions":"< 0.5.2","patched_versions":">= 0.5.2","title":"Regular Expression Denial of Service","path":["vulnerable-node-source@0.0.0","serve-favicon@2.3.2","fresh@0.3.0"],"advisory":"https://nodesecurity.io/advisories/526"},{"id":106,"updated_at":"2018-05-08T14:27:01.154Z","created_at":"2016-05-04T16:34:12.000Z","publish_date":"2016-06-16T17:36:06.000Z","overview":"Affected versions of `negotiator` are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted `Accept-Language` header value.\n\n","recommendation":"Update to version 0.6.1 or later.","cvss_vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_score":7.5,"module":"negotiator","version":"0.5.3","vulnerable_versions":"<= 0.6.0","patched_versions":">= 0.6.1","title":"Regular Expression Denial of Service","path":["vulnerable-node-source@0.0.0","express@4.13.4","accepts@1.2.13","negotiator@0.5.3"],"advisory":"https://nodesecurity.io/advisories/106"},{"id":534,"updated_at":"2018-05-16T19:37:31.802Z","created_at":"2017-09-25T18:55:55.956Z","publish_date":"2017-09-27T18:24:24.490Z","overview":"Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.","recommendation":"Version 2.x.x: Update to version 2.6.9 or later.\nVersion 3.x.x: Update to version 3.1.0 or later.","cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":3.7,"module":"debug","version":"2.2.0","vulnerable_versions":"<= 2.6.8 || >= 3.0.0 <= 3.0.1","patched_versions":">= 2.6.9 < 3.0.0 || >= 3.1.0","title":"Regular Expression Denial of Service","path":["vulnerable-node-source@0.0.0","body-parser@1.13.3","debug@2.2.0"],"advisory":"https://nodesecurity.io/advisories/534"},{"id":534,"updated_at":"2018-05-16T19:37:31.802Z","created_at":"2017-09-25T18:55:55.956Z","publish_date":"2017-09-27T18:24:24.490Z","overview":"Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.","recommendation":"Version 2.x.x: Update to version 2.6.9 or later.\nVersion 3.x.x: Update to version 3.1.0 or later.","cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":3.7,"module":"debug","version":"2.2.0","vulnerable_versions":"<= 2.6.8 || >= 3.0.0 <= 3.0.1","patched_versions":">= 2.6.9 < 3.0.0 || >= 3.1.0","title":"Regular Expression Denial of Service","path":["vulnerable-node-source@0.0.0","debug@2.2.0"],"advisory":"https://nodesecurity.io/advisories/534"},{"id":534,"updated_at":"2018-05-16T19:37:31.802Z","created_at":"2017-09-25T18:55:55.956Z","publish_date":"2017-09-27T18:24:24.490Z","overview":"Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.","recommendation":"Version 2.x.x: Update to version 2.6.9 or later.\nVersion 3.x.x: Update to version 3.1.0 or later.","cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":3.7,"module":"debug","version":"2.2.0","vulnerable_versions":"<= 2.6.8 || >= 3.0.0 <= 3.0.1","patched_versions":">= 2.6.9 < 3.0.0 || >= 3.1.0","title":"Regular Expression Denial of Service","path":["vulnerable-node-source@0.0.0","express@4.13.4","debug@2.2.0"],"advisory":"https://nodesecurity.io/advisories/534"},{"id":534,"updated_at":"2018-05-16T19:37:31.802Z","created_at":"2017-09-25T18:55:55.956Z","publish_date":"2017-09-27T18:24:24.490Z","overview":"Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.","recommendation":"Version 2.x.x: Update to version 2.6.9 or later.\nVersion 3.x.x: Update to version 3.1.0 or later.","cvss_vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","cvss_score":3.7,"module":"debug","version":"2.2.0","vulnerable_versions":"<= 2.6.8 || >= 3.0.0 <= 3.0.1","patched_versions":">= 2.6.9 < 3.0.0 || >= 3.1.0","title":"Regular Expression Denial of Service","path":["vulnerable-node-source@0.0.0","morgan@1.6.1","debug@2.2.0"],"advisory":"https://nodesecurity.io/advisories/534"}]
1
+
[
2
+
{
3
+
"id": 521,
4
+
"updated_at": "2018-05-08T14:27:01.871Z",
5
+
"created_at": "2017-08-13T04:26:17.960Z",
6
+
"publish_date": "2017-08-13T04:34:53.158Z",
7
+
"overview": "Affected versions of `pg` contain a remote code execution vulnerability that occurs when the remote database or query specifies a crafted column name. \n\nThere are two specific scenarios in which it is likely for an application to be vulnerable:\n1. The application executes unsafe, user-supplied sql which contains malicious column names.\n2. The application connects to an untrusted database and executes a query returning results which contain a malicious column name.\n\n## Proof of Concept\n```\nconst { Client } = require('pg')\nconst client = new Client()\nclient.connect()\n\nconst sql = `SELECT 1 AS \"\\\\'/*\", 2 AS \"\\\\'*/\\n + console.log(process.env)] = null;\\n//\"`\n\nclient.query(sql, (err, res) => {\n client.end()\n})\n```",
8
+
"recommendation": "* Version 2.x.x: Update to version 2.11.2 or later.\n* Version 3.x.x: Update to version 3.6.4 or later.\n* Version 4.x.x: Update to version 4.5.7 or later.\n* Version 5.x.x: Update to version 5.2.1 or later.\n* Version 6.x.x: Update to version 6.4.2 or later. ( Note that versions 6.1.6, 6.2.5, and 6.3.3 are also patched. )\n* Version 7.x.x: Update to version 7.1.2 or later. ( Note that version 7.0.2 is also patched. )",
"overview": "Affected versions of `mime` are vulnerable to regular expression denial of service when a mime lookup is performed on untrusted user input.",
29
+
"recommendation": "Update to version 2.0.3 or later.",
"overview": "Affected versions of `negotiator` are vulnerable to regular expression denial of service attacks, which trigger upon parsing a specially crafted `Accept-Language` header value.\n\n",
93
+
"recommendation": "Update to version 0.6.1 or later.",
"overview": "Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.",
115
+
"recommendation": "Version 2.x.x: Update to version 2.6.9 or later.\nVersion 3.x.x: Update to version 3.1.0 or later.",
"overview": "Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.",
136
+
"recommendation": "Version 2.x.x: Update to version 2.6.9 or later.\nVersion 3.x.x: Update to version 3.1.0 or later.",
"overview": "Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.",
156
+
"recommendation": "Version 2.x.x: Update to version 2.6.9 or later.\nVersion 3.x.x: Update to version 3.1.0 or later.",
"overview": "Affected versions of `debug` are vulnerable to regular expression denial of service when untrusted user input is passed into the `o` formatter. \n\nAs it takes 50,000 characters to block the event loop for 2 seconds, this issue is a low severity issue.",
177
+
"recommendation": "Version 2.x.x: Update to version 2.6.9 or later.\nVersion 3.x.x: Update to version 3.1.0 or later.",
0 commit comments