refactor: 💡 pull up ember-intl to core
This commit is contained in:
4 files changed
+11
-9
No files matched your search
@@ -29,7 +29,8 @@
|
||||
"auth": "*",
|
||||
"rose": "*",
|
||||
"ember-cli-babel": "^7.21.0",
|
||||
"ember-cli-htmlbars": "^5.2.0"
|
||||
"ember-cli-htmlbars": "^5.2.0",
|
||||
"ember-intl": "^5.5.0"
|
||||
},
|
||||
"devDependencies": {
|
||||
"@ember/optional-features": "^1.3.0",
|
||||
|
||||
@@ -61,7 +61,6 @@
|
||||
"ember-export-application-global": "^2.0.1",
|
||||
"ember-focus-trap": "^0.4.0",
|
||||
"ember-inline-svg": "^1.0.0",
|
||||
"ember-intl": "^5.5.0",
|
||||
"ember-load-initializers": "^2.1.1",
|
||||
"ember-loading": "^0.4.0",
|
||||
"ember-maybe-import-regenerator": "^0.1.6",
|
||||
|
||||
@@ -55,7 +55,6 @@
|
||||
"ember-exam": "^6.0.1",
|
||||
"ember-export-application-global": "^2.0.1",
|
||||
"ember-inline-svg": "^1.0.0",
|
||||
"ember-intl": "^5.5.0",
|
||||
"ember-load-initializers": "^2.1.1",
|
||||
"ember-loading": "^0.4.0",
|
||||
"ember-maybe-import-regenerator": "^0.1.6",
|
||||
|
||||
@@ -1,6 +1,9 @@
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
||||
Reference in new issue
Block a user