diff --git a/README.md b/README.md index c19d4efac..af9ca0b99 100644 --- a/README.md +++ b/README.md @@ -23,6 +23,7 @@ subproject, e.g. running or testing. - [Building ToC](#building-toc) - [Building Admin UI for Production](#building-admin-ui-for-production) - [Building with a Container](#building-with-a-container) + - [Building Desktop UI for Production](#building-desktop-ui-for-production) - [Committing](#committing) - [License Checking](#license-checking) @@ -102,6 +103,25 @@ docker-compose -f docker-compose-embedding.yml run build Assets are saved to `ui/admin/dist/`. +### Building Desktop UI for Production + +See ui/desktop/README.md Building for Production for more information on how to +build the Desktop UI. Be sure to set build-related environment variables as +necessary for your target environment, as described in the Desktop UI readme. + +To quickly produce a production build of Desktop UI, run from this folder: + +```bash +yarn install +yarn build:ui:desktop +``` + +To provide a signing identify for macOS build, use `BOUNDARY_DESKTOP_SIGNING_IDENTITY` +environment variable to set signing certificate name (e.g Developer ID Application: * (*)). + +Assets are saved to `ui/desktop/electron-app/out/make/`. +DMG packaged desktop UI is available at asset location as `Boundary Desktop.dmg`. + ### Committing Instead of the default `git commit`, we prescribe a custom command that ensures diff --git a/addons/api/package.json b/addons/api/package.json index 08dedf528..ed6925b35 100644 --- a/addons/api/package.json +++ b/addons/api/package.json @@ -44,7 +44,7 @@ "ember-copy": "^1.0.0", "ember-disable-prototype-extensions": "^1.1.3", "ember-export-application-global": "^2.0.1", - "ember-get-config": "^0.2.4", + "ember-get-config": "^0.3.0", "ember-load-initializers": "^2.1.1", "ember-maybe-import-regenerator": "^0.1.6", "ember-qunit": "^4.6.0", diff --git a/addons/core/package.json b/addons/core/package.json index 86b955770..d5e613ea4 100644 --- a/addons/core/package.json +++ b/addons/core/package.json @@ -27,13 +27,14 @@ "dependencies": { "api": "*", "auth": "*", - "rose": "*", "ember-cli-babel": "^7.21.0", "ember-cli-htmlbars": "^5.2.0", + "ember-get-config": "^0.3.0", "ember-intl": "^5.5.0", - "ember-page-title": "^6.0.3", "ember-loading": "^0.4.0", - "ember-route-action-helper": "^2.0.8" + "ember-page-title": "^6.0.3", + "ember-route-action-helper": "^2.0.8", + "rose": "*" }, "devDependencies": { "@ember/optional-features": "^1.3.0", @@ -50,7 +51,6 @@ "ember-cli-uglify": "^3.0.0", "ember-disable-prototype-extensions": "^1.1.3", "ember-export-application-global": "^2.0.1", - "ember-get-config": "^0.3.0", "ember-inline-svg": "^1.0.0", "ember-intl": "^5.5.0", "ember-load-initializers": "^2.1.1", diff --git a/ui/desktop/README.md b/ui/desktop/README.md index 45415803a..bd8215112 100644 --- a/ui/desktop/README.md +++ b/ui/desktop/README.md @@ -66,15 +66,17 @@ To run as a desktop app: Before executing a build, be sure to set any environment variables necessary for your target [environment](#environment-variables). To build this UI for -production, run the following commads from this folder: +production, run the following commands from this folder: ```bash yarn install yarn build ``` -The static production assets are saved into the `dist/` folder. +`BOUNDARY_DESKTOP_SIGNING_IDENTITY` environment variable must be provided +to codesign in production. +The static production assets are saved into the `dist/` folder. #### Environment Variables @@ -83,7 +85,7 @@ These environment variables may be used to customized the build. | Variable | Default Value | Description | | -------- | ------------- | ----------- | | `APP_NAME` | Application Name | The user-facing name of the application, appearing in titles, etc. | -| `API_HOST` | | The host of the API, if different than UI (e.g. https://example.net:1234). | +| `BOUNDARY_DESKTOP_SIGNING_IDENTITY` | | The name of the certificate to use when signing (e.g. Developer ID Application: * (*)). | ### Running Tests diff --git a/ui/desktop/config/environment.js b/ui/desktop/config/environment.js index 8326bd07f..0469efdca 100644 --- a/ui/desktop/config/environment.js +++ b/ui/desktop/config/environment.js @@ -1,7 +1,6 @@ 'use strict'; const APP_NAME = process.env.APP_NAME || 'Boundary'; -const ENABLE_MIRAGE = process.env.ENABLE_MIRAGE ? false : true; module.exports = function (environment) { let ENV = { @@ -26,10 +25,12 @@ module.exports = function (environment) { // when it is created }, - isElectron: Boolean(process.env.EMBER_CLI_ELECTRON), + isElectron: process.env.EMBER_CLI_ELECTRON + ? JSON.parse(process.env.EMBER_CLI_ELECTRON) + : false, 'ember-cli-mirage': { - enabled: ENABLE_MIRAGE, + //enabled: ENABLE_MIRAGE, directory: '../../addons/api/mirage' }, @@ -45,6 +46,10 @@ module.exports = function (environment) { sessionPollingTimeoutSeconds: 2.5, }; + if (process.env.ENABLE_MIRAGE) { + ENV['ember-cli-mirage'].enabled = JSON.parse(process.env.ENABLE_MIRAGE); + } + if (environment === 'development') { // ENV.APP.LOG_RESOLVER = true; // ENV.APP.LOG_ACTIVE_GENERATION = true; @@ -71,7 +76,7 @@ module.exports = function (environment) { // Notification timeout should be 0 for fast tests ENV.notifyTimeout = 0; - + ENV.enableConfirmService = false; // Use in-memory storage diff --git a/ui/desktop/electron-app/config/forge.config.js b/ui/desktop/electron-app/config/forge.config.js new file mode 100644 index 000000000..23d9ba10a --- /dev/null +++ b/ui/desktop/electron-app/config/forge.config.js @@ -0,0 +1,38 @@ +const process = require('process'); + +module.exports = { + hooks: { + preMake: (forgeConfig) => { + if (process.env.BOUNDARY_DESKTOP_SIGNING_IDENTITY) { + forgeConfig.osxSign = { + identity: process.env.BOUNDARY_DESKTOP_SIGNING_IDENTITY, + hardenedRuntime: true, + "gatekeeper-assess": false, + entitlements: "config/macos/entitlements.plist", + "entitlements-inherit": "config/macos/entitlements.plist", + "signature-flags": "library" + } + } else { + console.warn('Could not find signing identity. Skipping signing.'); + } + } + }, + packagerConfig: { + ignore: [ + "/ember-test(/|$)", + "/tests(/|$)" + ], + name: "Boundary Desktop", + appBundleId: "com.electron.boundary", + appVersion: "0.0.1", + appCopyright: "Copyright © 2021 HashiCorp, Inc." + }, + makers: [ + { + name: "@electron-forge/maker-dmg", + config: { + name: "Boundary Desktop" + } + } + ] +} diff --git a/ui/desktop/electron-app/config/macos/entitlements.plist b/ui/desktop/electron-app/config/macos/entitlements.plist new file mode 100644 index 000000000..8f574f5fb --- /dev/null +++ b/ui/desktop/electron-app/config/macos/entitlements.plist @@ -0,0 +1,12 @@ + + + + + com.apple.security.cs.allow-jit + + com.apple.security.cs.allow-unsigned-executable-memory + + com.apple.security.cs.debugger + + + diff --git a/ui/desktop/electron-app/package.json b/ui/desktop/electron-app/package.json index 245641281..be09b0414 100644 --- a/ui/desktop/electron-app/package.json +++ b/ui/desktop/electron-app/package.json @@ -16,28 +16,7 @@ }, "keywords": [], "config": { - "forge": { - "packagerConfig": { - "ignore": [ - "/ember-test(/|$)", - "/tests(/|$)" - ] - }, - "makers": [ - { - "name": "@electron-forge/maker-zip", - "platforms": [ - "darwin" - ] - }, - { - "name": "@electron-forge/maker-dmg", - "config": { - "name": "Boundary" - } - } - ] - } + "forge": "config/forge.config.js" }, "dependencies": { "axios": "^0.21.1", @@ -48,11 +27,7 @@ }, "devDependencies": { "@electron-forge/cli": "6.0.0-beta.53", - "@electron-forge/maker-deb": "6.0.0-beta.53", "@electron-forge/maker-dmg": "^6.0.0-beta.54", - "@electron-forge/maker-rpm": "6.0.0-beta.53", - "@electron-forge/maker-squirrel": "6.0.0-beta.53", - "@electron-forge/maker-zip": "6.0.0-beta.53", "devtron": "^1.4.0", "electron": "10.1.5" } diff --git a/ui/desktop/electron-app/src/origin.js b/ui/desktop/electron-app/src/origin.js index 3046c93f1..f4461e8f0 100644 --- a/ui/desktop/electron-app/src/origin.js +++ b/ui/desktop/electron-app/src/origin.js @@ -17,8 +17,10 @@ class RuntimeSettings { */ get origin() { return this.#origin; } set origin(origin) { - this.#origin = origin; - this.triggerOriginChanged(); + if (this.#origin !== origin) { + this.#origin = origin; + this.triggerOriginChanged(); + } } /** diff --git a/ui/desktop/electron-app/yarn.lock b/ui/desktop/electron-app/yarn.lock index 6b9785118..8fc7dfdd3 100644 --- a/ui/desktop/electron-app/yarn.lock +++ b/ui/desktop/electron-app/yarn.lock @@ -164,16 +164,6 @@ fs-extra "^9.0.1" which "^2.0.2" -"@electron-forge/maker-deb@6.0.0-beta.53": - version "6.0.0-beta.53" - resolved "https://registry.yarnpkg.com/@electron-forge/maker-deb/-/maker-deb-6.0.0-beta.53.tgz#264b75e4b1467c6aa8aa11ac4d23dbd27a10b017" - integrity sha512-bKhfLFY0qfUUPTYuGiU8N4dJKIjWpDeJlE3oP6h49O5GSHwx/eEjQRS2ckT+410HQ3WYXpZFzVc4A8bUz5ej0Q== - dependencies: - "@electron-forge/maker-base" "6.0.0-beta.53" - "@electron-forge/shared-types" "6.0.0-beta.53" - optionalDependencies: - electron-installer-debian "^3.0.0" - "@electron-forge/maker-dmg@^6.0.0-beta.54": version "6.0.0-beta.54" resolved "https://registry.yarnpkg.com/@electron-forge/maker-dmg/-/maker-dmg-6.0.0-beta.54.tgz#c3777b28c30c03b3dc18d1ca332d27f8c78c65b1" @@ -185,37 +175,6 @@ optionalDependencies: electron-installer-dmg "^3.0.0" -"@electron-forge/maker-rpm@6.0.0-beta.53": - version "6.0.0-beta.53" - resolved "https://registry.yarnpkg.com/@electron-forge/maker-rpm/-/maker-rpm-6.0.0-beta.53.tgz#a7d888c688508b9f7eaac59e693bf291cf5e1d17" - integrity sha512-tKL1yYVS6uY7XsuJX8JKQGLtdXDjrr1R8S2JnvvaZ3fT+oDQ0vdptcjQ1QqVTzKNN3VDOI46kLG5gyLVNSl4wQ== - dependencies: - "@electron-forge/maker-base" "6.0.0-beta.53" - "@electron-forge/shared-types" "6.0.0-beta.53" - optionalDependencies: - electron-installer-redhat "^3.2.0" - -"@electron-forge/maker-squirrel@6.0.0-beta.53": - version "6.0.0-beta.53" - resolved "https://registry.yarnpkg.com/@electron-forge/maker-squirrel/-/maker-squirrel-6.0.0-beta.53.tgz#c34aa0e39a64d25dbd3e31b86f2927cb02fbfe5a" - integrity sha512-CoaJPFrxWnOHOgWAmit9OtnBD/JqUPy1hGrMugrjmRvR4xQNQU5mHF2oeY2dQlgYg2Ecdiw1Rf4o8qI/KXu/RQ== - dependencies: - "@electron-forge/maker-base" "6.0.0-beta.53" - "@electron-forge/shared-types" "6.0.0-beta.53" - fs-extra "^9.0.1" - optionalDependencies: - electron-winstaller "^4.0.1" - -"@electron-forge/maker-zip@6.0.0-beta.53": - version "6.0.0-beta.53" - resolved "https://registry.yarnpkg.com/@electron-forge/maker-zip/-/maker-zip-6.0.0-beta.53.tgz#cb12e9abe17c502ce74d9151ea8ee3803d9e8d41" - integrity sha512-FwpRSAmYTts0cFVHsWfGG+r3vI8Yyf53cFxAarE7Lll+Efu6I9S43CbusDZR1cB3Ywy2TXs2Kv09rXYJv6OY0A== - dependencies: - "@electron-forge/maker-base" "6.0.0-beta.53" - "@electron-forge/shared-types" "6.0.0-beta.53" - cross-zip "^3.0.0" - fs-extra "^9.0.1" - "@electron-forge/plugin-base@6.0.0-beta.53": version "6.0.0-beta.53" resolved "https://registry.yarnpkg.com/@electron-forge/plugin-base/-/plugin-base-6.0.0-beta.53.tgz#d6430ec3cb51f9bfe7386ea6b4a54a582fade8d9" @@ -307,7 +266,7 @@ global-agent "^2.0.2" global-tunnel-ng "^2.7.1" -"@malept/cross-spawn-promise@^1.0.0", "@malept/cross-spawn-promise@^1.1.0": +"@malept/cross-spawn-promise@^1.1.0": version "1.1.1" resolved "https://registry.yarnpkg.com/@malept/cross-spawn-promise/-/cross-spawn-promise-1.1.1.tgz#504af200af6b98e198bce768bc1730c6936ae01d" integrity sha512-RTBGWL5FWQcg9orDOCcp4LvItNzUPcyEU9bwaeJX0rJ1IQxzucC48Y0/sQLp/g6t99IQgAlGIaesJS+gTn7tVQ== @@ -348,13 +307,6 @@ "@types/node" "*" "@types/responselike" "*" -"@types/fs-extra@^9.0.1": - version "9.0.6" - resolved "https://registry.yarnpkg.com/@types/fs-extra/-/fs-extra-9.0.6.tgz#488e56b77299899a608b8269719c1d133027a6ab" - integrity sha512-ecNRHw4clCkowNOBJH1e77nvbPxHYnWIXMv1IAoG/9+MYGkgoyr3Ppxr7XYFNL41V422EDhyV4/4SSK8L2mlig== - dependencies: - "@types/node" "*" - "@types/glob@^7.1.1": version "7.1.3" resolved "https://registry.yarnpkg.com/@types/glob/-/glob-7.1.3.tgz#e6ba80f36b7daad2c685acd9266382e68985c183" @@ -488,21 +440,6 @@ array-find-index@^1.0.1: resolved "https://registry.yarnpkg.com/array-find-index/-/array-find-index-1.0.2.tgz#df010aa1287e164bbda6f9723b0a96a1ec4187a1" integrity sha1-3wEKoSh+Fku9pvlyOwqWoexBh6E= -asar@^2.0.1: - version "2.1.0" - resolved "https://registry.yarnpkg.com/asar/-/asar-2.1.0.tgz#97c6a570408c4e38a18d4a3fb748a621b5a7844e" - integrity sha512-d2Ovma+bfqNpvBzY/KU8oPY67ZworixTpkjSx0PCXnQi67c2cXmssaTxpFDUM0ttopXoGx/KRxNg/GDThYbXQA== - dependencies: - chromium-pickle-js "^0.2.0" - commander "^2.20.0" - cuint "^0.2.2" - glob "^7.1.3" - minimatch "^3.0.4" - mkdirp "^0.5.1" - tmp-promise "^1.0.5" - optionalDependencies: - "@types/glob" "^7.1.1" - asar@^3.0.0: version "3.0.3" resolved "https://registry.yarnpkg.com/asar/-/asar-3.0.3.tgz#1fef03c2d6d2de0cbad138788e4f7ae03b129c7b" @@ -700,11 +637,6 @@ camelcase@^2.0.0: resolved "https://registry.yarnpkg.com/camelcase/-/camelcase-2.1.1.tgz#7c1d16d679a1bbe59ca02cacecfb011e201f5a1f" integrity sha1-fB0W1nmhu+WcoCys7PsBHiAfWh8= -camelcase@^5.0.0: - version "5.3.1" - resolved "https://registry.yarnpkg.com/camelcase/-/camelcase-5.3.1.tgz#e3c9b31569e106811df242f715725a1f4c494320" - integrity sha512-L28STB170nwWS63UjtlEOE3dldQApaJXZkOI1uMFfzf3rRuPegHaHesyee+YxQ+W6SvRDQV6UrdOdRiR153wJg== - caseless@~0.12.0: version "0.12.0" resolved "https://registry.yarnpkg.com/caseless/-/caseless-0.12.0.tgz#1b681c21ff84033c826543090689420d187151dc" @@ -755,15 +687,6 @@ cli-width@^3.0.0: resolved "https://registry.yarnpkg.com/cli-width/-/cli-width-3.0.0.tgz#a2f48437a2caa9a22436e794bf071ec9e61cedf6" integrity sha512-FxqpkPPwu1HjuN93Omfm4h8uIanXofW0RxVEW3k5RKx+mJJYSthzNhp32Kzxxy3YAEZ/Dc/EWN1vZRY0+kOhbw== -cliui@^6.0.0: - version "6.0.0" - resolved "https://registry.yarnpkg.com/cliui/-/cliui-6.0.0.tgz#511d702c0c4e41ca156d7d0e96021f23e13225b1" - integrity sha512-t6wbgtoCXvAzst7QgXxJYqPt0usEfbgQdftEPbLL/cvv6HPE5VgvqCuAIDR0NgU52ds6rFwqrgakNLrHEjCbrQ== - dependencies: - string-width "^4.2.0" - strip-ansi "^6.0.0" - wrap-ansi "^6.2.0" - cliui@^7.0.2: version "7.0.4" resolved "https://registry.yarnpkg.com/cliui/-/cliui-7.0.4.tgz#a0265ee655476fc807aea9df3df8df7783808b4f" @@ -819,11 +742,6 @@ combined-stream@^1.0.6, combined-stream@~1.0.6: dependencies: delayed-stream "~1.0.0" -commander@^2.20.0: - version "2.20.3" - resolved "https://registry.yarnpkg.com/commander/-/commander-2.20.3.tgz#fd485e84c03eb4881c20722ba48035e8531aeb33" - integrity sha512-GpVkmM8vF2vQUkj2LvZmD35JxeJOLCwJ9cUkugyk2nuhbv3+mJvpLYYt+0+USMxE+oj+ey/lJEnhZw75x/OMcQ== - commander@^4.1.1: version "4.1.1" resolved "https://registry.yarnpkg.com/commander/-/commander-4.1.1.tgz#9fd602bd936294e9e9ef46a3f4d6964044b18068" @@ -897,18 +815,6 @@ cross-spawn@^7.0.1: shebang-command "^2.0.0" which "^2.0.1" -cross-zip@^3.0.0: - version "3.1.0" - resolved "https://registry.yarnpkg.com/cross-zip/-/cross-zip-3.1.0.tgz#2b7d33f2a893bf83e232ccbabf4c6c706f6b313c" - integrity sha512-aX02l0SD3KE27pMl69gkxDdDM5D3u9Ic4Je+2b1B2fP0dWnlWWY6ns2Vk5DEgCXJRhL3GasSpicNQRNbDkq0+w== - dependencies: - rimraf "^3.0.0" - -cuint@^0.2.2: - version "0.2.2" - resolved "https://registry.yarnpkg.com/cuint/-/cuint-0.2.2.tgz#408086d409550c2631155619e9fa7bcadc3b991b" - integrity sha1-QICG1AlVDCYxFVYZ6fp7ytw7mRs= - currently-unhandled@^0.4.1: version "0.4.1" resolved "https://registry.yarnpkg.com/currently-unhandled/-/currently-unhandled-0.4.1.tgz#988df33feab191ef799a61369dd76c17adf957ea" @@ -944,7 +850,7 @@ debug@^4.0.1, debug@^4.1.0, debug@^4.1.1: dependencies: ms "2.1.2" -decamelize@^1.1.2, decamelize@^1.2.0: +decamelize@^1.1.2: version "1.2.0" resolved "https://registry.yarnpkg.com/decamelize/-/decamelize-1.2.0.tgz#f6534d15148269b20352e7bee26f501f9a191290" integrity sha1-9lNNFRSCabIDUue+4m9QH5oZEpA= @@ -1052,37 +958,6 @@ electron-devtools-installer@^3.1.1: semver "^7.2.1" unzip-crx-3 "^0.2.0" -electron-installer-common@^0.10.2: - version "0.10.3" - resolved "https://registry.yarnpkg.com/electron-installer-common/-/electron-installer-common-0.10.3.tgz#40f9db644ca60eb28673d545b67ee0113aef4444" - integrity sha512-mYbP+6i+nHMIm0WZHXgGdmmXMe+KXncl6jZYQNcCF9C1WsNA9C5SZ2VP4TLQMSIoFO+X4ugkMEA5uld1bmyEvA== - dependencies: - "@malept/cross-spawn-promise" "^1.0.0" - asar "^3.0.0" - debug "^4.1.1" - fs-extra "^9.0.0" - glob "^7.1.4" - lodash "^4.17.15" - parse-author "^2.0.0" - semver "^7.1.1" - tmp-promise "^3.0.2" - optionalDependencies: - "@types/fs-extra" "^9.0.1" - -electron-installer-debian@^3.0.0: - version "3.1.0" - resolved "https://registry.yarnpkg.com/electron-installer-debian/-/electron-installer-debian-3.1.0.tgz#2f6107f559f6564c44e3832fb2942dd8de4d40cc" - integrity sha512-k6KChvx0Fw8XTlCqwwbBfh19yGQaKjGdbugokmr1IpzINOm4QFyACKMTHAYFHW5LCBUZQShZD96hwxUZ+8Kx+w== - dependencies: - "@malept/cross-spawn-promise" "^1.0.0" - debug "^4.1.1" - electron-installer-common "^0.10.2" - fs-extra "^9.0.0" - get-folder-size "^2.0.1" - lodash "^4.17.4" - word-wrap "^1.2.3" - yargs "^15.0.1" - electron-installer-dmg@^3.0.0: version "3.0.0" resolved "https://registry.yarnpkg.com/electron-installer-dmg/-/electron-installer-dmg-3.0.0.tgz#08935b602f3120981c8d5fd24d3f6525f8b0198a" @@ -1094,19 +969,6 @@ electron-installer-dmg@^3.0.0: optionalDependencies: appdmg "^0.6.0" -electron-installer-redhat@^3.2.0: - version "3.2.0" - resolved "https://registry.yarnpkg.com/electron-installer-redhat/-/electron-installer-redhat-3.2.0.tgz#2c0f5da6f4a244453e4675ab1eca0877a66788c5" - integrity sha512-XMA+fQj3ULNVMl4eG+hIvrYITEqP1pfpERvx6kRwuPd06vdtB4KucL9241DAHT0NR5E9gnyJHM9Y6N24kk0mcA== - dependencies: - "@malept/cross-spawn-promise" "^1.0.0" - debug "^4.1.1" - electron-installer-common "^0.10.2" - fs-extra "^9.0.0" - lodash "^4.17.15" - word-wrap "^1.2.3" - yargs "^15.1.0" - electron-is-dev@^1.2.0: version "1.2.0" resolved "https://registry.yarnpkg.com/electron-is-dev/-/electron-is-dev-1.2.0.tgz#2e5cea0a1b3ccf1c86f577cee77363ef55deb05e" @@ -1180,17 +1042,6 @@ electron-squirrel-startup@^1.0.0: dependencies: debug "^2.2.0" -electron-winstaller@^4.0.1: - version "4.0.1" - resolved "https://registry.yarnpkg.com/electron-winstaller/-/electron-winstaller-4.0.1.tgz#69da2a439a6986210c3106305f921a522369207d" - integrity sha512-wgdABzcMFpREjFCHZKQ5g5JF5jGqa8YCAsVD5Tb3sJhdj63AtuCu/2o++nVESlZZugKDv6Hxo6Wi8c3knEkbgA== - dependencies: - asar "^2.0.1" - debug "^4.1.1" - fs-extra "^7.0.1" - lodash.template "^4.2.2" - temp "^0.9.0" - electron@10.1.5: version "10.1.5" resolved "https://registry.yarnpkg.com/electron/-/electron-10.1.5.tgz#f2b161310f627063e73fbac44efcb35dece83a90" @@ -1372,7 +1223,7 @@ find-up@^2.0.0: dependencies: locate-path "^2.0.0" -find-up@^4.0.0, find-up@^4.1.0: +find-up@^4.0.0: version "4.1.0" resolved "https://registry.yarnpkg.com/find-up/-/find-up-4.1.0.tgz#97afe7d6cdc0bc5928584b7c8d7b16e8a9aa5d19" integrity sha512-PpOwAdQ/YlXQ2vj8a3h8IipDuYRi3wceVQQGYWxNINccq40Anw7BlsEXCMbt1Zt+OLA6Fq9suIpIWD0OsnISlw== @@ -1431,7 +1282,7 @@ fs-extra@^4.0.0: jsonfile "^4.0.0" universalify "^0.1.0" -fs-extra@^7.0.0, fs-extra@^7.0.1: +fs-extra@^7.0.0: version "7.0.1" resolved "https://registry.yarnpkg.com/fs-extra/-/fs-extra-7.0.1.tgz#4f189c44aa123b895f722804f55ea23eadc348e9" integrity sha512-YJDaCJZEnBmcbw13fvdAM9AwNOJwOzrE4pqMqBq5nFiEqXUqHwlK4B+3pUw6JNvfSPtX05xFHtYy/1ni01eGCw== @@ -1504,11 +1355,6 @@ galactus@^0.2.1: flora-colossus "^1.0.0" fs-extra "^4.0.0" -gar@^1.0.4: - version "1.0.4" - resolved "https://registry.yarnpkg.com/gar/-/gar-1.0.4.tgz#f777bc7db425c0572fdeb52676172ca1ae9888b8" - integrity sha512-w4n9cPWyP7aHxKxYHFQMegj7WIAsL/YX/C4Bs5Rr8s1H9M1rNtRWRsw+ovYMkXDQ5S4ZbYHsHAPmevPjPgw44w== - gauge@~2.7.3: version "2.7.4" resolved "https://registry.yarnpkg.com/gauge/-/gauge-2.7.4.tgz#2c03405c7538c39d7eb37b317022e325fb018bf7" @@ -1537,19 +1383,11 @@ generate-object-property@^1.1.0: dependencies: is-property "^1.0.0" -get-caller-file@^2.0.1, get-caller-file@^2.0.5: +get-caller-file@^2.0.5: version "2.0.5" resolved "https://registry.yarnpkg.com/get-caller-file/-/get-caller-file-2.0.5.tgz#4f94412a82db32f36e3b0b9741f8a97feb031f7e" integrity sha512-DyFP3BM/3YHTQOCUL/w0OZHR0lpKeGrxotcHWcqNEdnltqFwXVfhEBQ94eIo34AfQpo0rGki4cyIiftY06h2Fg== -get-folder-size@^2.0.1: - version "2.0.1" - resolved "https://registry.yarnpkg.com/get-folder-size/-/get-folder-size-2.0.1.tgz#3fe0524dd3bad05257ef1311331417bcd020a497" - integrity sha512-+CEb+GDCM7tkOS2wdMKTn9vU7DgnKUTuDlehkNJKNSovdCOVxs14OfKCk4cvSaR3za4gj+OBdl9opPN9xrJ0zA== - dependencies: - gar "^1.0.4" - tiny-each-async "2.0.3" - get-installed-path@^2.0.3: version "2.1.1" resolved "https://registry.yarnpkg.com/get-installed-path/-/get-installed-path-2.1.1.tgz#a1f33dc6b8af542c9331084e8edbe37fe2634152" @@ -2105,32 +1943,12 @@ locate-path@^6.0.0: dependencies: p-locate "^5.0.0" -lodash._reinterpolate@^3.0.0: - version "3.0.0" - resolved "https://registry.yarnpkg.com/lodash._reinterpolate/-/lodash._reinterpolate-3.0.0.tgz#0ccf2d89166af03b3663c796538b75ac6e114d9d" - integrity sha1-DM8tiRZq8Ds2Y8eWU4t1rG4RTZ0= - lodash.get@^4.0.0: version "4.4.2" resolved "https://registry.yarnpkg.com/lodash.get/-/lodash.get-4.4.2.tgz#2d177f652fa31e939b4438d5341499dfa3825e99" integrity sha1-LRd/ZS+jHpObRDjVNBSZ36OCXpk= -lodash.template@^4.2.2: - version "4.5.0" - resolved "https://registry.yarnpkg.com/lodash.template/-/lodash.template-4.5.0.tgz#f976195cf3f347d0d5f52483569fe8031ccce8ab" - integrity sha512-84vYFxIkmidUiFxidA/KjjH9pAycqW+h980j7Fuz5qxRtO9pgB7MDFTdys1N7A5mcucRiDyEq4fusljItR1T/A== - dependencies: - lodash._reinterpolate "^3.0.0" - lodash.templatesettings "^4.0.0" - -lodash.templatesettings@^4.0.0: - version "4.2.0" - resolved "https://registry.yarnpkg.com/lodash.templatesettings/-/lodash.templatesettings-4.2.0.tgz#e481310f049d3cf6d47e912ad09313b154f0fb33" - integrity sha512-stgLz+i3Aa9mZgnjr/O+v9ruKZsPsndy7qPZOchbqk2cnTU1ZaldKK+v7m54WoKIyxiuMZTKT2H81F8BeAc3ZQ== - dependencies: - lodash._reinterpolate "^3.0.0" - -lodash@^4.17.10, lodash@^4.17.15, lodash@^4.17.19, lodash@^4.17.20, lodash@^4.17.4: +lodash@^4.17.10, lodash@^4.17.19, lodash@^4.17.20: version "4.17.20" resolved "https://registry.yarnpkg.com/lodash/-/lodash-4.17.20.tgz#b44a9b6297bcb698f1c51a3545a2b3b368d59c52" integrity sha512-PlhdFcillOINfeV7Ni6oF1TAEayyZBoZ8bcshTHqOYJYlrqzRK5hagpagky5o4HfCzzd1TRkXPMFq6cKk9rGmA== @@ -3004,11 +2822,6 @@ require-directory@^2.1.1: resolved "https://registry.yarnpkg.com/require-directory/-/require-directory-2.1.1.tgz#8c64ad5fd30dab1c976e2344ffe7f792a6a6df42" integrity sha1-jGStX9MNqxyXbiNE/+f3kqam30I= -require-main-filename@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/require-main-filename/-/require-main-filename-2.0.0.tgz#d0b329ecc7cc0f61649f62215be69af54aa8989b" - integrity sha512-NKN5kMDylKuldxYLSUfrbo5Tuzh4hd+2E8NPPX02mZtn1VuREQToYe/ZdlJy+J3uCpfaiGF05e7B8W0iXbQHmg== - resolve-alpn@^1.0.0: version "1.0.0" resolved "https://registry.yarnpkg.com/resolve-alpn/-/resolve-alpn-1.0.0.tgz#745ad60b3d6aff4b4a48e01b8c0bdc70959e0e8c" @@ -3059,27 +2872,20 @@ restore-cursor@^3.1.0: onetime "^5.1.0" signal-exit "^3.0.2" -rimraf@^2.6.1, rimraf@^2.6.3, rimraf@^2.7.1: +rimraf@^2.6.1, rimraf@^2.7.1: version "2.7.1" resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.7.1.tgz#35797f13a7fdadc566142c29d4f07ccad483e3ec" integrity sha512-uWjbaKIK3T1OSVptzX7Nl6PvQ3qAGtKEtVRjRuazjfL3Bx5eI409VZSqgND+4UNnmzLVdPj9FqFJNPqBZFve4w== dependencies: glob "^7.1.3" -rimraf@^3.0.0, rimraf@^3.0.2: +rimraf@^3.0.2: version "3.0.2" resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-3.0.2.tgz#f1a5402ba6220ad52cc1282bac1ae3aa49fd061a" integrity sha512-JZkJMZkAGFFPP2YqXZXPbMlMBgsxzE8ILs4lMIX/2o0L9UBw9O/Y3o6wFw/i9YLapcUJWwqbi3kdxIPdC62TIA== dependencies: glob "^7.1.3" -rimraf@~2.6.2: - version "2.6.3" - resolved "https://registry.yarnpkg.com/rimraf/-/rimraf-2.6.3.tgz#b2d104fe0d8fb27cf9e0a1cda8262dd3833c6cab" - integrity sha512-mwqeW5XsA2qAejG46gYdENaxXjx9onRNCfn7L0duuP4hCuTIi/QO7PDK07KJfp1d+izWPrzEJDcSqBa0OZQriA== - dependencies: - glob "^7.1.3" - roarr@^2.15.3: version "2.15.4" resolved "https://registry.yarnpkg.com/roarr/-/roarr-2.15.4.tgz#f5fe795b7b838ccfe35dc608e0282b9eba2e7afd" @@ -3141,7 +2947,7 @@ semver-compare@^1.0.0: resolved "https://registry.yarnpkg.com/semver/-/semver-5.7.1.tgz#a954f931aeba508d307bbf069eff0c01c96116f7" integrity sha512-sauaDf/PZdVgrLTNYHRtpXa1iRiKcaebiKQ1BJdpQlWH2lCvexQdX55snPFyK7QzpudqbCI0qXFfOasHdyNDGQ== -semver@^7.1.1, semver@^7.1.3, semver@^7.2.1, semver@^7.3.2: +semver@^7.1.3, semver@^7.2.1, semver@^7.3.2: version "7.3.4" resolved "https://registry.yarnpkg.com/semver/-/semver-7.3.4.tgz#27aaa7d2e4ca76452f98d3add093a72c943edc97" integrity sha512-tCfb2WLjqFAtXn4KEdxIhalnRtoKFN7nAwj0B3ZXCbQloV2tq5eDbcTmT68JJD3nRJq24/XgxtQKFIpQdtvmVw== @@ -3155,7 +2961,7 @@ serialize-error@^7.0.1: dependencies: type-fest "^0.13.1" -set-blocking@^2.0.0, set-blocking@~2.0.0: +set-blocking@~2.0.0: version "2.0.0" resolved "https://registry.yarnpkg.com/set-blocking/-/set-blocking-2.0.0.tgz#045f9782d011ae9a6803ddd382b24392b3d890f7" integrity sha1-BF+XgtARrppoA93TgrJDkrPYkPc= @@ -3416,14 +3222,6 @@ tar@^6.0.2, tar@^6.0.5: mkdirp "^1.0.3" yallist "^4.0.0" -temp@^0.9.0: - version "0.9.4" - resolved "https://registry.yarnpkg.com/temp/-/temp-0.9.4.tgz#cd20a8580cb63635d0e4e9d4bd989d44286e7620" - integrity sha512-yYrrsWnrXMcdsnu/7YMYAofM1ktpL5By7vZhf15CrXijWWrEYZks5AXBudalfSWJLlnen/QUJUB5aoB0kqZUGA== - dependencies: - mkdirp "^0.5.1" - rimraf "~2.6.2" - throttleit@0.0.2: version "0.0.2" resolved "https://registry.yarnpkg.com/throttleit/-/throttleit-0.0.2.tgz#cfedf88e60c00dd9697b61fdd2a8343a9b680eaf" @@ -3442,33 +3240,6 @@ through@^2.3.6: resolved "https://registry.yarnpkg.com/through/-/through-2.3.8.tgz#0dd4c9ffaabc357960b1b724115d7e0e86a2e1f5" integrity sha1-DdTJ/6q8NXlgsbckEV1+Doai4fU= -tiny-each-async@2.0.3: - version "2.0.3" - resolved "https://registry.yarnpkg.com/tiny-each-async/-/tiny-each-async-2.0.3.tgz#8ebbbfd6d6295f1370003fbb37162afe5a0a51d1" - integrity sha1-jru/1tYpXxNwAD+7NxYq/loKUdE= - -tmp-promise@^1.0.5: - version "1.1.0" - resolved "https://registry.yarnpkg.com/tmp-promise/-/tmp-promise-1.1.0.tgz#bb924d239029157b9bc1d506a6aa341f8b13e64c" - integrity sha512-8+Ah9aB1IRXCnIOxXZ0uFozV1nMU5xiu7hhFVUSxZ3bYu+psD4TzagCzVbexUCgNNGJnsmNDQlS4nG3mTyoNkw== - dependencies: - bluebird "^3.5.0" - tmp "0.1.0" - -tmp-promise@^3.0.2: - version "3.0.2" - resolved "https://registry.yarnpkg.com/tmp-promise/-/tmp-promise-3.0.2.tgz#6e933782abff8b00c3119d63589ca1fb9caaa62a" - integrity sha512-OyCLAKU1HzBjL6Ev3gxUeraJNlbNingmi8IrHHEsYH8LTmEuhvYfqvhn2F/je+mjf4N58UmZ96OMEy1JanSCpA== - dependencies: - tmp "^0.2.0" - -tmp@0.1.0: - version "0.1.0" - resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.1.0.tgz#ee434a4e22543082e294ba6201dcc6eafefa2877" - integrity sha512-J7Z2K08jbGcdA1kkQpJSqLF6T0tdQqpR2pnSUXsIchbPdTI9v3e85cLW0d6WDhwuAleOV71j2xWs8qMPfK7nKw== - dependencies: - rimraf "^2.6.3" - tmp@^0.0.33: version "0.0.33" resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.0.33.tgz#6d34335889768d21b2bcda0aa277ced3b1bfadf9" @@ -3476,13 +3247,6 @@ tmp@^0.0.33: dependencies: os-tmpdir "~1.0.2" -tmp@^0.2.0: - version "0.2.1" - resolved "https://registry.yarnpkg.com/tmp/-/tmp-0.2.1.tgz#8457fc3037dcf4719c251367a1af6500ee1ccf14" - integrity sha512-76SUhtfqR2Ijn+xllcI5P1oyannHNHByD80W1q447gU3mp9G9PSpGdWmjUOHRDPiHYacIk66W7ubDTuPF3BEtQ== - dependencies: - rimraf "^3.0.0" - tn1150@^0.1.0: version "0.1.0" resolved "https://registry.yarnpkg.com/tn1150/-/tn1150-0.1.0.tgz#673503d24d56b87de8b8c77fee3fc0853d59a18d" @@ -3649,11 +3413,6 @@ wcwidth@^1.0.1: dependencies: defaults "^1.0.3" -which-module@^2.0.0: - version "2.0.0" - resolved "https://registry.yarnpkg.com/which-module/-/which-module-2.0.0.tgz#d9ef07dce77b9902b8a3a8fa4b31c3e3f7e6e87a" - integrity sha1-2e8H3Od7mQK4o6j6SzHD4/fm6Ho= - which@^1.2.14, which@^1.2.9: version "1.3.1" resolved "https://registry.yarnpkg.com/which/-/which-1.3.1.tgz#a45043d54f5805316da8d62f9f50918d3da70b0a" @@ -3675,20 +3434,6 @@ wide-align@^1.1.0: dependencies: string-width "^1.0.2 || 2" -word-wrap@^1.2.3: - version "1.2.3" - resolved "https://registry.yarnpkg.com/word-wrap/-/word-wrap-1.2.3.tgz#610636f6b1f703891bd34771ccb17fb93b47079c" - integrity sha512-Hz/mrNwitNRh/HUAtM/VT/5VH+ygD6DV7mYKZAtHOrbs8U7lvPS6xf7EJKMF0uW1KJCl0H701g3ZGus+muE5vQ== - -wrap-ansi@^6.2.0: - version "6.2.0" - resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-6.2.0.tgz#e9393ba07102e6c91a3b221478f0257cd2856e53" - integrity sha512-r6lPcBGxZXlIcymEu7InxDMhdW0KDxpLgoFLcguasxCaJ/SOIZwINatK9KY/tf+ZrlywOKU0UDj3ATXUBfxJXA== - dependencies: - ansi-styles "^4.0.0" - string-width "^4.1.0" - strip-ansi "^6.0.0" - wrap-ansi@^7.0.0: version "7.0.0" resolved "https://registry.yarnpkg.com/wrap-ansi/-/wrap-ansi-7.0.0.tgz#67e145cff510a6a6984bdf1152911d69d2eb9e43" @@ -3725,11 +3470,6 @@ xtend@~2.1.1: dependencies: object-keys "~0.4.0" -y18n@^4.0.0: - version "4.0.1" - resolved "https://registry.yarnpkg.com/y18n/-/y18n-4.0.1.tgz#8db2b83c31c5d75099bb890b23f3094891e247d4" - integrity sha512-wNcy4NvjMYL8gogWWYAO7ZFWFfHcbdbE57tZO8e4cbpj8tfUcwrwqSl3ad8HxpYWCdXcJUCeKKZS62Av1affwQ== - y18n@^5.0.5: version "5.0.5" resolved "https://registry.yarnpkg.com/y18n/-/y18n-5.0.5.tgz#8769ec08d03b1ea2df2500acef561743bbb9ab18" @@ -3750,36 +3490,11 @@ yallist@^4.0.0: resolved "https://registry.yarnpkg.com/yallist/-/yallist-4.0.0.tgz#9bb92790d9c0effec63be73519e11a35019a3a72" integrity sha512-3wdGidZyq5PB084XLES5TpOSRA3wjXAlIWMhum2kRcv/41Sn2emQ0dycQW4uZXLejwKvg6EsvbdlVL+FYEct7A== -yargs-parser@^18.1.2: - version "18.1.3" - resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-18.1.3.tgz#be68c4975c6b2abf469236b0c870362fab09a7b0" - integrity sha512-o50j0JeToy/4K6OZcaQmW6lyXXKhq7csREXcDwk2omFPJEwUNOVtJKvmDr9EI1fAJZUyZcRF7kxGBWmRXudrCQ== - dependencies: - camelcase "^5.0.0" - decamelize "^1.2.0" - yargs-parser@^20.0.0, yargs-parser@^20.2.2: version "20.2.4" resolved "https://registry.yarnpkg.com/yargs-parser/-/yargs-parser-20.2.4.tgz#b42890f14566796f85ae8e3a25290d205f154a54" integrity sha512-WOkpgNhPTlE73h4VFAFsOnomJVaovO8VqLDzy5saChRBFQFBoMYirowyW+Q9HB4HFF4Z7VZTiG3iSzJJA29yRA== -yargs@^15.0.1, yargs@^15.1.0: - version "15.4.1" - resolved "https://registry.yarnpkg.com/yargs/-/yargs-15.4.1.tgz#0d87a16de01aee9d8bec2bfbf74f67851730f4f8" - integrity sha512-aePbxDmcYW++PaqBsJ+HYUFwCdv4LVvdnhBy78E57PIor8/OVvhMrADFFEDh8DHDFRv/O9i3lPhsENjO7QX0+A== - dependencies: - cliui "^6.0.0" - decamelize "^1.2.0" - find-up "^4.1.0" - get-caller-file "^2.0.1" - require-directory "^2.1.1" - require-main-filename "^2.0.0" - set-blocking "^2.0.0" - string-width "^4.2.0" - which-module "^2.0.0" - y18n "^4.0.0" - yargs-parser "^18.1.2" - yargs@^16.0.0: version "16.2.0" resolved "https://registry.yarnpkg.com/yargs/-/yargs-16.2.0.tgz#1c82bf0f6b6a66eafce7ef30e376f49a12477f66" diff --git a/ui/desktop/package.json b/ui/desktop/package.json index f65f78264..6056db791 100644 --- a/ui/desktop/package.json +++ b/ui/desktop/package.json @@ -11,8 +11,9 @@ }, "scripts": { "doc:toc": "doctoc README.md", - "build": "ember build --environment=production && yarn build:desktop", + "build": "EMBER_CLI_ELECTRON=true ember build --environment=production && yarn build:desktop", "build:development": "ember build", + "prebuild:desktop": "cp -r dist/ electron-app/ember-dist/", "build:desktop": "cd electron-app && yarn make", "lint": "npm-run-all --aggregate-output --continue-on-error --parallel lint:*", "lint:hbs": "ember-template-lint .", diff --git a/yarn-audit-known-issues b/yarn-audit-known-issues index 50ecd896c..83c0b67f1 100644 --- a/yarn-audit-known-issues +++ b/yarn-audit-known-issues @@ -1,21 +1,21 @@ -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} -{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} +{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}} diff --git a/yarn.lock b/yarn.lock index 6a1ad53e1..ea954d74e 100644 --- a/yarn.lock +++ b/yarn.lock @@ -7540,7 +7540,7 @@ debug@~4.1.0: dependencies: ms "^2.1.1" -debuglog@*, debuglog@^1.0.1: +debuglog@^1.0.1: version "1.0.1" resolved "https://registry.yarnpkg.com/debuglog/-/debuglog-1.0.1.tgz#aa24ffb9ac3df9a2351837cfb2d279360cd78492" integrity sha1-qiT/uaw9+aI1GDfPstJ5NgzXhJI= @@ -8945,7 +8945,7 @@ ember-focus-trap@^0.4.0: ember-modifier-manager-polyfill "^1.2.0" focus-trap "^5.1.0" -ember-get-config@0.2.4, ember-get-config@^0.2.2, ember-get-config@^0.2.4: +ember-get-config@0.2.4, ember-get-config@^0.2.2: version "0.2.4" resolved "https://registry.yarnpkg.com/ember-get-config/-/ember-get-config-0.2.4.tgz#118492a2a03d73e46004ed777928942021fe1ecd" integrity sha1-EYSSoqA9c+RgBO13eSiUICH+Hs0= @@ -12357,7 +12357,7 @@ import-lazy@^4.0.0: resolved "https://registry.yarnpkg.com/import-lazy/-/import-lazy-4.0.0.tgz#e8eb627483a0a43da3c03f3e35548be5cb0cc153" integrity sha512-rKtvo6a868b5Hu3heneU+L4yEQ4jYKLtjpnPeUdK7h0yzXGmyBTypknlkCvHFBqfX9YlorEiMM6Dnq/5atfHkw== -imurmurhash@*, imurmurhash@^0.1.4: +imurmurhash@^0.1.4: version "0.1.4" resolved "https://registry.yarnpkg.com/imurmurhash/-/imurmurhash-0.1.4.tgz#9218b9b2b928a238b13dc4fb6b6d576f231453ea" integrity sha1-khi5srkoojixPcT7a21XbyMUU+o= @@ -14058,11 +14058,6 @@ lodash._baseflatten@^3.0.0: lodash.isarguments "^3.0.0" lodash.isarray "^3.0.0" -lodash._baseindexof@*: - version "3.1.0" - resolved "https://registry.yarnpkg.com/lodash._baseindexof/-/lodash._baseindexof-3.1.0.tgz#fe52b53a1c6761e42618d654e4a25789ed61822c" - integrity sha1-/lK1OhxnYeQmGNZU5KJXie1hgiw= - lodash._baseuniq@~4.6.0: version "4.6.0" resolved "https://registry.yarnpkg.com/lodash._baseuniq/-/lodash._baseuniq-4.6.0.tgz#0ebb44e456814af7905c6212fa2c9b2d51b841e8" @@ -14071,16 +14066,11 @@ lodash._baseuniq@~4.6.0: lodash._createset "~4.0.0" lodash._root "~3.0.0" -lodash._bindcallback@*, lodash._bindcallback@^3.0.0: +lodash._bindcallback@^3.0.0: version "3.0.1" resolved "https://registry.yarnpkg.com/lodash._bindcallback/-/lodash._bindcallback-3.0.1.tgz#e531c27644cf8b57a99e17ed95b35c748789392e" integrity sha1-5THCdkTPi1epnhftlbNcdIeJOS4= -lodash._cacheindexof@*: - version "3.0.2" - resolved "https://registry.yarnpkg.com/lodash._cacheindexof/-/lodash._cacheindexof-3.0.2.tgz#3dc69ac82498d2ee5e3ce56091bafd2adc7bde92" - integrity sha1-PcaayCSY0u5ePOVgkbr9Ktx73pI= - lodash._createassigner@^3.0.0: version "3.1.1" resolved "https://registry.yarnpkg.com/lodash._createassigner/-/lodash._createassigner-3.1.1.tgz#838a5bae2fdaca63ac22dee8e19fa4e6d6970b11" @@ -14090,19 +14080,12 @@ lodash._createassigner@^3.0.0: lodash._isiterateecall "^3.0.0" lodash.restparam "^3.0.0" -lodash._createcache@*: - version "3.1.2" - resolved "https://registry.yarnpkg.com/lodash._createcache/-/lodash._createcache-3.1.2.tgz#56d6a064017625e79ebca6b8018e17440bdcf093" - integrity sha1-VtagZAF2JeeevKa4AY4XRAvc8JM= - dependencies: - lodash._getnative "^3.0.0" - lodash._createset@~4.0.0: version "4.0.3" resolved "https://registry.yarnpkg.com/lodash._createset/-/lodash._createset-4.0.3.tgz#0f4659fbb09d75194fa9e2b88a6644d363c9fe26" integrity sha1-D0ZZ+7CddRlPqeK4imZE02PJ/iY= -lodash._getnative@*, lodash._getnative@^3.0.0: +lodash._getnative@^3.0.0: version "3.9.1" resolved "https://registry.yarnpkg.com/lodash._getnative/-/lodash._getnative-3.9.1.tgz#570bc7dede46d61cdcde687d65d3eecbaa3aaff5" integrity sha1-VwvH3t5G1hzc3mh9ZdPuy6o6r/U= @@ -14315,7 +14298,7 @@ lodash.pick@^4.4.0: resolved "https://registry.yarnpkg.com/lodash.pick/-/lodash.pick-4.4.0.tgz#52f05610fff9ded422611441ed1fc123a03001b3" integrity sha1-UvBWEP/53tQiYRRB7R/BI6AwAbM= -lodash.restparam@*, lodash.restparam@^3.0.0: +lodash.restparam@^3.0.0: version "3.6.1" resolved "https://registry.yarnpkg.com/lodash.restparam/-/lodash.restparam-3.6.1.tgz#936a4e309ef330a7645ed4145986c85ae5b20805" integrity sha1-k2pOMJ7zMKdkXtQUWYbIWuWyCAU=