CyberCoveLLC/threshold-ui
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge pull request #392 from hashicorp/refactor-addon-dependencies

Browse Source 
Refactor addon dependencies
This commit is contained in:
Susmitha Girumala authored and GitHub committed 2020-11-20 16:38:57 -05:00
2 parents c1e809908d 485a6b9521
commit fd3a84c2ad
9 files changed
+70 -226
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

addons/api/package.json
+5 -4
View File
@@ -21,7 +21,11 @@
},
"dependencies": {
"ember-cli-babel": "^7.21.0",
"ember-cli-htmlbars": "^5.2.0"
"ember-cli-htmlbars": "^5.2.0",
"ember-data": "^3.20.0",
"ember-data-model-fragments": "5.0.0-beta.0",
"ember-fetch": "^8.0.1",
"ember-cli-mirage": "^1.1.8"
},
"devDependencies": {
"@ember/optional-features": "^1.3.0",
@@ -34,13 +38,10 @@
"ember-cli": "~3.20.2",
"ember-cli-dependency-checker": "^3.2.0",
"ember-cli-inject-live-reload": "^2.0.2",
"ember-cli-mirage": "^1.1.7",
"ember-cli-sri": "^2.1.1",
"ember-cli-uglify": "^3.0.0",
"ember-cli-update": "^0.54.6",
"ember-copy": "^1.0.0",
"ember-data": "^3.16.0",
"ember-data-model-fragments": "5.0.0-beta.0",
"ember-disable-prototype-extensions": "^1.1.3",
"ember-export-application-global": "^2.0.1",
"ember-get-config": "^0.2.4",
addons/auth/package.json
+3 -5
View File
@@ -19,9 +19,11 @@
},
"dependencies": {
"ember-cli-babel": "^7.21.0",
"ember-cli-htmlbars": "^5.2.0"
"ember-cli-htmlbars": "^5.2.0",
"ember-simple-auth": "^3.0.1"
},
"devDependencies": {
"core": "*",
"@ember/optional-features": "^1.3.0",
"@glimmer/component": "^1.0.1",
"@glimmer/tracking": "^1.0.0",
@@ -32,20 +34,16 @@
"ember-cli": "~3.20.2",
"ember-cli-dependency-checker": "^3.2.0",
"ember-cli-inject-live-reload": "^2.0.2",
"ember-cli-mirage": "^1.1.7",
"ember-cli-sri": "^2.1.1",
"ember-cli-uglify": "^3.0.0",
"ember-cli-update": "^0.54.6",
"ember-cookies": "^0.5.2",
"ember-data": "^3.16.0",
"ember-disable-prototype-extensions": "^1.1.3",
"ember-export-application-global": "^2.0.1",
"ember-fetch": "^8.0.1",
"ember-load-initializers": "^2.1.1",
"ember-maybe-import-regenerator": "^0.1.6",
"ember-qunit": "^4.6.0",
"ember-resolver": "^8.0.0",
"ember-simple-auth": "^3.0.0",
"ember-source": "~3.20.2",
"ember-source-channel-url": "^2.0.1",
"ember-template-lint": "^2.9.1",
addons/core/README.md
+12 -6
View File
@@ -28,17 +28,13 @@ Add this addon to an Ember application's `devDependencies` as:
See monorepo README for installation instructions.
To use internationalization features, install `ember-intl` into your project:
`ember install ember-intl`.
## I18n
To access translations within a template, see `ember-intl` docs.
## Notifications
To use in-app notifications, first install `ember-notify` in your app. Then use
the notificaiton decorators to notify the user when a function or action
Use notificaiton decorators to notify the user when a function or action
succeeds or fails. For example:
```js
@@ -100,7 +96,17 @@ Ember config (see admin). Then reference doc links by keys:
## Loading Helper
To make use of the `is-loading` helper, install `ember-loading` first.
See admin and desktop routes and templates for examples of how to
use the loading subsystem. For example, to annotate that an async action should
present a loading indicator to a user:
```js
@action
@loading
async myAction() {
// ...do potentially time-consuming task
}
```
## Yarn Commands
addons/core/package.json
+10 -10
View File
@@ -25,15 +25,21 @@
"doc:toc": "doctoc README.md"
},
"dependencies": {
"api": "*",
"auth": "*",
"rose": "*",
"ember-cli-babel": "^7.21.0",
"ember-cli-htmlbars": "^5.2.0"
"ember-cli-htmlbars": "^5.2.0",
"ember-intl": "^5.5.0",
"ember-notify": "^6.0.0",
"ember-page-title": "^6.0.3",
"ember-loading": "^0.4.0",
"ember-route-action-helper": "^2.0.8"
},
"devDependencies": {
"@ember/optional-features": "^1.3.0",
"@glimmer/component": "^1.0.1",
"@glimmer/tracking": "^1.0.0",
"api": "*",
"auth": "*",
"babel-eslint": "^10.1.0",
"broccoli-asset-rev": "^3.0.0",
"doctoc": "^1.4.0",
@@ -41,14 +47,10 @@
"ember-cli": "~3.20.2",
"ember-cli-dependency-checker": "^3.2.0",
"ember-cli-inject-live-reload": "^2.0.2",
"ember-cli-mirage": "^1.1.8",
"ember-cli-sri": "^2.1.1",
"ember-cli-uglify": "^3.0.0",
"ember-data": "^3.22.1",
"ember-data-model-fragments": "5.0.0-beta.0",
"ember-disable-prototype-extensions": "^1.1.3",
"ember-export-application-global": "^2.0.1",
"ember-fetch": "^8.0.2",
"ember-get-config": "^0.3.0",
"ember-inline-svg": "^1.0.0",
"ember-intl": "^5.5.0",
@@ -56,7 +58,6 @@
"ember-maybe-import-regenerator": "^0.1.6",
"ember-qunit": "^4.6.0",
"ember-resolver": "^8.0.0",
"ember-simple-auth": "^3.0.1",
"ember-source": "~3.20.2",
"ember-source-channel-url": "^2.0.1",
"ember-template-lint": "^2.9.1",
@@ -68,8 +69,7 @@
"loader.js": "^4.7.0",
"npm-run-all": "^4.1.5",
"prettier": "^2.1.2",
"qunit-dom": "^1.2.0",
"rose": "*"
"qunit-dom": "^1.2.0"
},
"engines": {
"node": "10.* || >= 12"
addons/rose/package.json
+5 -5
View File
@@ -28,7 +28,11 @@
"dependencies": {
"babel-loader": "^8.1.0",
"ember-cli-babel": "^7.21.0",
"ember-cli-htmlbars": "^5.2.0"
"ember-cli-htmlbars": "^5.2.0",
"ember-radio-button": "^2.0.1",
"ember-uuid": "^2.1.0",
"emberx-select": "github:adopted-ember-addons/emberx-select#bc5f774",
"ember-focus-trap": "^0.4.0"
},
"devDependencies": {
"@ember/optional-features": "^1.3.0",
@@ -53,20 +57,16 @@
"ember-cli-update": "^0.54.6",
"ember-disable-prototype-extensions": "^1.1.3",
"ember-export-application-global": "^2.0.1",
"ember-focus-trap": "^0.4.0",
"ember-inline-svg": "^1.0.0",
"ember-load-initializers": "^2.1.1",
"ember-maybe-import-regenerator": "^0.1.6",
"ember-modifier": "^1.0.3",
"ember-qunit": "^4.6.0",
"ember-radio-button": "^2.0.1",
"ember-resolver": "^8.0.0",
"ember-source": "~3.20.2",
"ember-source-channel-url": "^2.0.1",
"ember-template-lint": "^2.9.1",
"ember-try": "^1.4.0",
"ember-uuid": "^2.1.0",
"emberx-select": "github:adopted-ember-addons/emberx-select#bc5f774",
"eslint": "^7.5.0",
"eslint-plugin-ember": "^8.9.1",
"eslint-plugin-node": "^11.1.0",
ui/admin/package.json
+1 -17
View File
@@ -33,13 +33,12 @@
"@ember/render-modifiers": "^1.0.2",
"@glimmer/component": "^1.0.1",
"@glimmer/tracking": "^1.0.0",
"api": "*",
"auth": "*",
"babel-eslint": "^10.1.0",
"babel-loader": "^8.1.0",
"broccoli-asset-rev": "^3.0.0",
"clipboard": "^2.0.6",
"core": "*",
"rose": "*",
"doctoc": "^1.4.0",
"ember-a11y-testing": "^3.0.0",
"ember-auto-import": "^1.6.0",
@@ -52,36 +51,22 @@
"ember-cli-dependency-checker": "^3.2.0",
"ember-cli-htmlbars": "^5.2.0",
"ember-cli-inject-live-reload": "^2.0.2",
"ember-cli-mirage": "^1.1.8",
"ember-cli-sass": "^10.0.1",
"ember-cli-sri": "^2.1.1",
"ember-cli-template-lint": "^2.0.2",
"ember-cli-uglify": "^3.0.0",
"ember-cli-update": "^0.54.6",
"ember-concurrency": "^1.3.0",
"ember-data": "~3.20.0",
"ember-data-model-fragments": "5.0.0-beta.0",
"ember-exam": "^6.0.1",
"ember-export-application-global": "^2.0.1",
"ember-fetch": "^8.0.2",
"ember-focus-trap": "^0.4.0",
"ember-inline-svg": "^1.0.0",
"ember-intl": "^5.5.0",
"ember-load-initializers": "^2.1.1",
"ember-loading": "^0.4.0",
"ember-maybe-import-regenerator": "^0.1.6",
"ember-modifier": "^2.1.1",
"ember-notify": "^6.0.0",
"ember-page-title": "^6.0.3",
"ember-qunit": "^4.6.0",
"ember-radio-button": "^2.0.1",
"ember-resolver": "^8.0.0",
"ember-route-action-helper": "^2.0.8",
"ember-simple-auth": "^3.0.1",
"ember-source": "~3.20.2",
"ember-template-lint": "^2.14.0",
"ember-uuid": "^2.1.0",
"emberx-select": "github:adopted-ember-addons/emberx-select#bc5f774",
"eslint": "^7.5.0",
"eslint-plugin-ember": "^8.9.1",
"eslint-plugin-node": "^11.1.0",
@@ -90,7 +75,6 @@
"npm-run-all": "^4.1.5",
"prettier": "^2.1.2",
"qunit-dom": "^1.2.0",
"rose": "*",
"sass": "^1.29.0",
"sass-lint": "^1.13.1",
"sinon": "^9.2.1"
ui/desktop/package.json
+1 -14
View File
@@ -33,9 +33,8 @@
"@ember/optional-features": "^1.3.0",
"@glimmer/component": "^1.0.1",
"@glimmer/tracking": "^1.0.0",
"api": "*",
"core": "*",
"auth": "*",
"rose": "*",
"babel-eslint": "^10.1.0",
"babel-loader": "^8.1.0",
"broccoli-asset-rev": "^3.0.0",
@@ -48,32 +47,21 @@
"ember-cli-dependency-checker": "^3.2.0",
"ember-cli-htmlbars": "^5.2.0",
"ember-cli-inject-live-reload": "^2.0.2",
"ember-cli-mirage": "^1.1.8",
"ember-cli-sass": "^10.0.1",
"ember-cli-sri": "^2.1.1",
"ember-cli-template-lint": "^2.0.2",
"ember-cli-uglify": "^3.0.0",
"ember-data": "~3.20.0",
"ember-data-model-fragments": "5.0.0-beta.0",
"ember-electron": "https://github.com/adopted-ember-addons/ember-electron#v3.0.0-beta.4",
"ember-exam": "^6.0.1",
"ember-export-application-global": "^2.0.1",
"ember-fetch": "^8.0.2",
"ember-inline-svg": "^1.0.0",
"ember-intl": "^5.5.0",
"ember-load-initializers": "^2.1.1",
"ember-loading": "^0.4.0",
"ember-maybe-import-regenerator": "^0.1.6",
"ember-modifier": "^2.1.1",
"ember-notify": "^6.0.0",
"ember-page-title": "^6.0.3",
"ember-qunit": "^4.6.0",
"ember-resolver": "^8.0.0",
"ember-route-action-helper": "^2.0.8",
"ember-simple-auth": "^3.0.1",
"ember-source": "~3.20.2",
"ember-template-lint": "^2.14.0",
"ember-uuid": "^2.1.0",
"eslint": "^7.5.0",
"eslint-plugin-ember": "^8.9.1",
"eslint-plugin-node": "^11.1.0",
@@ -82,7 +70,6 @@
"npm-run-all": "^4.1.5",
"prettier": "^2.1.2",
"qunit-dom": "^1.2.0",
"rose": "*",
"sass": "^1.29.0",
"sass-lint": "^1.13.1",
"sinon": "^9.2.1"
yarn-audit-known-issues
+21
View File
@@ -0,0 +1,21 @@
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
yarn.lock
+12 -165
View File
@@ -1336,18 +1336,6 @@
global-agent "^2.0.2"
global-tunnel-ng "^2.7.1"
"@ember-data/adapter@3.20.5":
version "3.20.5"
resolved "https://registry.yarnpkg.com/@ember-data/adapter/-/adapter-3.20.5.tgz#2348cc0a6a46d5b25f6e356802f05ce0db5c75a0"
integrity sha512-J/tyinlUW+lQCcHomJkPpiu4PHEqDiVzsrQ8AgKPk6UgPTz4h1oTo8bxJvfC8xfCRGGBSZ/sTT8mrOtyIn0GWg==
dependencies:
"@ember-data/private-build-infra" "3.20.5"
"@ember-data/store" "3.20.5"
"@ember/edition-utils" "^1.2.0"
ember-cli-babel "^7.18.0"
ember-cli-test-info "^1.0.0"
ember-cli-typescript "^3.1.3"
"@ember-data/adapter@3.22.1":
version "3.22.1"
resolved "https://registry.yarnpkg.com/@ember-data/adapter/-/adapter-3.22.1.tgz#dd286db0b7ef8114552957e71eaf6c1452bd16cf"
@@ -1360,14 +1348,6 @@
ember-cli-test-info "^1.0.0"
ember-cli-typescript "^3.1.3"
"@ember-data/canary-features@3.20.5":
version "3.20.5"
resolved "https://registry.yarnpkg.com/@ember-data/canary-features/-/canary-features-3.20.5.tgz#7856b84498498b3fed32ddbe7ac5e59a7ce4c70d"
integrity sha512-UGAojn6uAr1yVHiTQ3Zy9W3pfrib+c8BXx7pZ2j1y71ztIMAJ6kNB8h6Gl+Ms1OxEMElnjBEJrfaoV8U1MLY2A==
dependencies:
ember-cli-babel "^7.18.0"
ember-cli-typescript "^3.1.3"
"@ember-data/canary-features@3.22.1":
version "3.22.1"
resolved "https://registry.yarnpkg.com/@ember-data/canary-features/-/canary-features-3.22.1.tgz#304ff7d54793caf396e6179b59602407d6fb3df5"
@@ -1376,17 +1356,6 @@
ember-cli-babel "^7.18.0"
ember-cli-typescript "^3.1.3"
"@ember-data/debug@3.20.5":
version "3.20.5"
resolved "https://registry.yarnpkg.com/@ember-data/debug/-/debug-3.20.5.tgz#a3af700f82ba01a40290db706ce607e51ecf5141"
integrity sha512-psG8y6CgWTehelWXp14XOc4dOEJmrnbF+E7Myy/eHXTv7Hyri0iLw0R2WrlO0QjTC8RehgRO4LhRpa0i3VxIlw==
dependencies:
"@ember-data/private-build-infra" "3.20.5"
"@ember/edition-utils" "^1.2.0"
ember-cli-babel "^7.18.0"
ember-cli-test-info "^1.0.0"
ember-cli-typescript "^3.1.3"
"@ember-data/debug@3.22.1":
version "3.22.1"
resolved "https://registry.yarnpkg.com/@ember-data/debug/-/debug-3.22.1.tgz#7ccf0989939fd7fbfe36b033455a581c774ac488"
@@ -1398,22 +1367,6 @@
ember-cli-test-info "^1.0.0"
ember-cli-typescript "^3.1.3"
"@ember-data/model@3.20.5":
version "3.20.5"
resolved "https://registry.yarnpkg.com/@ember-data/model/-/model-3.20.5.tgz#522008a6b3c6334792cb3674cd19c8972d5bbbf9"
integrity sha512-d5FToKjtjkSKnoOAqFS/IWtyGxag2RDsOk/j+VNQPFQITlrcDV/j2LeF82laXpF04SfCWyenvXxjqCIEsbeZVQ==
dependencies:
"@ember-data/canary-features" "3.20.5"
"@ember-data/private-build-infra" "3.20.5"
"@ember-data/store" "3.20.5"
"@ember/edition-utils" "^1.2.0"
ember-cli-babel "^7.18.0"
ember-cli-string-utils "^1.1.0"
ember-cli-test-info "^1.0.0"
ember-cli-typescript "^3.1.3"
ember-compatibility-helpers "^1.2.0"
inflection "1.12.0"
"@ember-data/model@3.22.1":
version "3.22.1"
resolved "https://registry.yarnpkg.com/@ember-data/model/-/model-3.22.1.tgz#16ee9da04ecd398a319fd0ab76fa1759fdd562b7"
@@ -1430,38 +1383,6 @@
ember-compatibility-helpers "^1.2.0"
inflection "1.12.0"
"@ember-data/private-build-infra@3.20.5":
version "3.20.5"
resolved "https://registry.yarnpkg.com/@ember-data/private-build-infra/-/private-build-infra-3.20.5.tgz#92d52dfcc35c25a3c0fad7d27a4f8d2a9cf04451"
integrity sha512-9qS8VC2ZQwN/aD6RGO9FNWzdVHFUvjNgXfk1PYPo6QDmLwU/3m+WqXO0ZkhQx6hjHjGWi5HOu+vjUwdO8nghfg==
dependencies:
"@babel/plugin-transform-block-scoping" "^7.8.3"
"@ember-data/canary-features" "3.20.5"
"@ember/edition-utils" "^1.2.0"
babel-plugin-debug-macros "^0.3.3"
babel-plugin-filter-imports "^4.0.0"
babel6-plugin-strip-class-callcheck "^6.0.0"
broccoli-debug "^0.6.5"
broccoli-file-creator "^2.1.1"
broccoli-funnel "^2.0.2"
broccoli-merge-trees "^4.2.0"
broccoli-rollup "^4.1.1"
calculate-cache-key-for-tree "^2.0.0"
chalk "^4.0.0"
ember-cli-babel "^7.18.0"
ember-cli-path-utils "^1.0.0"
ember-cli-string-utils "^1.1.0"
ember-cli-typescript "^3.1.3"
ember-cli-version-checker "^5.1.1"
esm "^3.2.25"
git-repo-info "^2.1.1"
glob "^7.1.6"
npm-git-info "^1.0.3"
rimraf "^3.0.2"
rsvp "^4.8.5"
semver "^7.1.3"
silent-error "^1.1.1"
"@ember-data/private-build-infra@3.22.1":
version "3.22.1"
resolved "https://registry.yarnpkg.com/@ember-data/private-build-infra/-/private-build-infra-3.22.1.tgz#db7c61c9c2e84de3abd6a0ad56a5497be126248b"
@@ -1494,20 +1415,6 @@
semver "^7.1.3"
silent-error "^1.1.1"
"@ember-data/record-data@3.20.5":
version "3.20.5"
resolved "https://registry.yarnpkg.com/@ember-data/record-data/-/record-data-3.20.5.tgz#c4a27226449d7be01bdf5752518cd5c01dd7a0a9"
integrity sha512-lYkfptsbMc/FAvMKH3M6mMq6DLXUTNFIOBejC76EKNa9+Alxl84QiNxO4kpZdAsZGzT9gJLsWQ/0TXQlk44gyQ==
dependencies:
"@ember-data/canary-features" "3.20.5"
"@ember-data/private-build-infra" "3.20.5"
"@ember-data/store" "3.20.5"
"@ember/edition-utils" "^1.2.0"
"@ember/ordered-set" "^2.0.3"
ember-cli-babel "^7.18.0"
ember-cli-test-info "^1.0.0"
ember-cli-typescript "^3.1.3"
"@ember-data/record-data@3.22.1":
version "3.22.1"
resolved "https://registry.yarnpkg.com/@ember-data/record-data/-/record-data-3.22.1.tgz#71ee2200b9c6913e7643d224e8962affc8d554f8"
@@ -1527,17 +1434,6 @@
resolved "https://registry.yarnpkg.com/@ember-data/rfc395-data/-/rfc395-data-0.0.4.tgz#ecb86efdf5d7733a76ff14ea651a1b0ed1f8a843"
integrity sha512-tGRdvgC9/QMQSuSuJV45xoyhI0Pzjm7A9o/MVVA3HakXIImJbbzx/k/6dO9CUEQXIyS2y0fW6C1XaYOG7rY0FQ==
"@ember-data/serializer@3.20.5":
version "3.20.5"
resolved "https://registry.yarnpkg.com/@ember-data/serializer/-/serializer-3.20.5.tgz#7977ee5178a377f30743460f29d973aa17656ff4"
integrity sha512-eNxw9vPSFfiA97I4yURteUM5WgtRjrDVNRPhVDEU7OOHDAa6Q9P/7ASJCTp7SNxI+pqAWgobRWyDH7tE7LMRRg==
dependencies:
"@ember-data/private-build-infra" "3.20.5"
"@ember-data/store" "3.20.5"
ember-cli-babel "^7.18.0"
ember-cli-test-info "^1.0.0"
ember-cli-typescript "^3.1.3"
"@ember-data/serializer@3.22.1":
version "3.22.1"
resolved "https://registry.yarnpkg.com/@ember-data/serializer/-/serializer-3.22.1.tgz#26083c93e5cc283da43d379779e6eec89f61189a"
@@ -1549,18 +1445,6 @@
ember-cli-test-info "^1.0.0"
ember-cli-typescript "^3.1.3"
"@ember-data/store@3.20.5":
version "3.20.5"
resolved "https://registry.yarnpkg.com/@ember-data/store/-/store-3.20.5.tgz#9855ac3ac24c780a05941b2ecf47c0be4f52ebdc"
integrity sha512-Ti5npYeORvis5TzsIIhSlXi5tbFaRixVad3BpI6PRZn4hXskrIBAVlLIAd0vbpj+kIprFrwe5NsMJTR11jU/Pw==
dependencies:
"@ember-data/canary-features" "3.20.5"
"@ember-data/private-build-infra" "3.20.5"
ember-cli-babel "^7.18.0"
ember-cli-path-utils "^1.0.0"
ember-cli-typescript "^3.1.3"
heimdalljs "^0.3.0"
"@ember-data/store@3.22.1":
version "3.22.1"
resolved "https://registry.yarnpkg.com/@ember-data/store/-/store-3.22.1.tgz#373b13d25fbdbb8fc940575aa66141b07f184c96"
@@ -7517,7 +7401,7 @@ debug@~4.1.0:
dependencies:
ms "^2.1.1"
debuglog@*, debuglog@^1.0.1:
debuglog@^1.0.1:
version "1.0.1"
resolved "https://registry.yarnpkg.com/debuglog/-/debuglog-1.0.1.tgz#aa24ffb9ac3df9a2351837cfb2d279360cd78492"
integrity sha1-qiT/uaw9+aI1GDfPstJ5NgzXhJI=
@@ -8387,7 +8271,7 @@ ember-cli-lodash-subset@^2.0.1:
resolved "https://registry.yarnpkg.com/ember-cli-lodash-subset/-/ember-cli-lodash-subset-2.0.1.tgz#20cb68a790fe0fde2488ddfd8efbb7df6fe766f2"
integrity sha1-IMtop5D+D94kiN39jvu332/nZvI=
ember-cli-mirage@^1.1.7, ember-cli-mirage@^1.1.8:
ember-cli-mirage@^1.1.8:
version "1.1.8"
resolved "https://registry.yarnpkg.com/ember-cli-mirage/-/ember-cli-mirage-1.1.8.tgz#b3874a0f2eb83d8f341416d3a691ff82735c629c"
integrity sha512-i0/CNwdyza+o+0RW92i/dEhAqTcyoAJ9jGKKiOLK74RwDG0Bgt5w/CdqKfIFBf/lIGPXHPveneWsyckeSiVr4A==
@@ -8766,7 +8650,7 @@ ember-data-model-fragments@5.0.0-beta.0:
git-repo-info "^2.0.0"
npm-git-info "^1.0.3"
ember-data@^3.16.0, ember-data@^3.22.1:
ember-data@^3.20.0:
version "3.22.1"
resolved "https://registry.yarnpkg.com/ember-data/-/ember-data-3.22.1.tgz#5b075fc8a2c3f18dac2305037d34b88666631b1a"
integrity sha512-5QXJkkwSXKgdVa9qg6lYrTdG7+5PvtfwLwj0weCOFixXLxZWyhXzPcnDyn4lNDCyMZbsy/10VNH5miPkRBf8lQ==
@@ -8786,26 +8670,6 @@ ember-data@^3.16.0, ember-data@^3.22.1:
ember-cli-typescript "^3.1.3"
ember-inflector "^3.0.1"
ember-data@~3.20.0:
version "3.20.5"
resolved "https://registry.yarnpkg.com/ember-data/-/ember-data-3.20.5.tgz#1d0968983e1b6e71ba1539b623c1cd112c14ea20"
integrity sha512-rYcW7NkLT8bXec2Z1ODbrO9y/pdpk5ICn63aRA1UDL3nZ6hijowa9vNr+SnkzdLIDrfF40rP+f1N/oTkuqgwjw==
dependencies:
"@ember-data/adapter" "3.20.5"
"@ember-data/debug" "3.20.5"
"@ember-data/model" "3.20.5"
"@ember-data/private-build-infra" "3.20.5"
"@ember-data/record-data" "3.20.5"
"@ember-data/serializer" "3.20.5"
"@ember-data/store" "3.20.5"
"@ember/edition-utils" "^1.2.0"
"@ember/ordered-set" "^2.0.3"
"@glimmer/env" "^0.1.7"
broccoli-merge-trees "^4.2.0"
ember-cli-babel "^7.18.0"
ember-cli-typescript "^3.1.3"
ember-inflector "^3.0.1"
ember-decorators-polyfill@^1.1.5:
version "1.1.5"
resolved "https://registry.yarnpkg.com/ember-decorators-polyfill/-/ember-decorators-polyfill-1.1.5.tgz#49203c302ea4486618ba4866923ec657cf2c9f3d"
@@ -8875,7 +8739,7 @@ ember-factory-for-polyfill@^1.3.1:
dependencies:
ember-cli-version-checker "^2.1.0"
ember-fetch@^8.0.1, ember-fetch@^8.0.2:
ember-fetch@^8.0.1:
version "8.0.2"
resolved "https://registry.yarnpkg.com/ember-fetch/-/ember-fetch-8.0.2.tgz#9838b9f01e33fcd23550ccf38ae4f1f90cc47113"
integrity sha512-BMwm8jLP5LCeT8Jbgz0jA04RsRyt06ZGMaC3Tx2DbHgoWOPlLMfkEKlCFE0dZVW8ZhuICKuyRZTzt4e8GrnnNA==
@@ -9114,7 +8978,7 @@ ember-router-generator@^2.0.0:
"@babel/traverse" "^7.4.5"
recast "^0.18.1"
ember-simple-auth@^3.0.0, ember-simple-auth@^3.0.1:
ember-simple-auth@^3.0.1:
version "3.0.1"
resolved "https://registry.yarnpkg.com/ember-simple-auth/-/ember-simple-auth-3.0.1.tgz#78bcd8e3d04da43154cf105931c0d3620a9f0694"
integrity sha512-7D5s23nA5Nsonf37CyeQtksadV6Rgiz2rgCgRDnUObp3xnV71ljPtaUcZuq6kqqaZANYJi3uM8i4zVzmAHlKFQ==
@@ -11801,9 +11665,9 @@ hoek@2.x.x:
integrity sha1-ILt0A9POo5jpHcRxCo/xuCdKJe0=
hoek@4.x.x:
version "4.2.1"
resolved "https://registry.yarnpkg.com/hoek/-/hoek-4.2.1.tgz#9634502aa12c445dd5a7c5734b572bb8738aacbb"
integrity sha512-QLg82fGkfnJ/4iy1xZ81/9SIJiq1NGFUMGs6ParyjBZr6jW2Ufj/snDqTHixNlHdPNwN2RLVD0Pi3igeK9+JfA==
version "4.2.0"
resolved "https://registry.yarnpkg.com/hoek/-/hoek-4.2.0.tgz#72d9d0754f7fe25ca2d01ad8f8f9a9449a89526d"
integrity sha512-v0XCLxICi9nPfYrS9RL8HbYnXi9obYAeLbSP00BmnZwCK9+Ih9WOjoZ8YoHCoav2csqn4FOz4Orldsy2dmDwmQ==
hoek@6.x.x:
version "6.1.3"
@@ -12164,7 +12028,7 @@ import-lazy@^2.1.0:
resolved "https://registry.yarnpkg.com/import-lazy/-/import-lazy-2.1.0.tgz#05698e3d45c88e8d7e9d92cb0584e77f096f3e43"
integrity sha1-BWmOPUXIjo1+nZLLBYTnfwlvPkM=
imurmurhash@*, imurmurhash@^0.1.4:
imurmurhash@^0.1.4:
version "0.1.4"
resolved "https://registry.yarnpkg.com/imurmurhash/-/imurmurhash-0.1.4.tgz#9218b9b2b928a238b13dc4fb6b6d576f231453ea"
integrity sha1-khi5srkoojixPcT7a21XbyMUU+o=
@@ -13861,11 +13725,6 @@ lodash._baseflatten@^3.0.0:
lodash.isarguments "^3.0.0"
lodash.isarray "^3.0.0"
lodash._baseindexof@*:
version "3.1.0"
resolved "https://registry.yarnpkg.com/lodash._baseindexof/-/lodash._baseindexof-3.1.0.tgz#fe52b53a1c6761e42618d654e4a25789ed61822c"
integrity sha1-/lK1OhxnYeQmGNZU5KJXie1hgiw=
lodash._baseuniq@~4.6.0:
version "4.6.0"
resolved "https://registry.yarnpkg.com/lodash._baseuniq/-/lodash._baseuniq-4.6.0.tgz#0ebb44e456814af7905c6212fa2c9b2d51b841e8"
@@ -13874,16 +13733,11 @@ lodash._baseuniq@~4.6.0:
lodash._createset "~4.0.0"
lodash._root "~3.0.0"
lodash._bindcallback@*, lodash._bindcallback@^3.0.0:
lodash._bindcallback@^3.0.0:
version "3.0.1"
resolved "https://registry.yarnpkg.com/lodash._bindcallback/-/lodash._bindcallback-3.0.1.tgz#e531c27644cf8b57a99e17ed95b35c748789392e"
integrity sha1-5THCdkTPi1epnhftlbNcdIeJOS4=
lodash._cacheindexof@*:
version "3.0.2"
resolved "https://registry.yarnpkg.com/lodash._cacheindexof/-/lodash._cacheindexof-3.0.2.tgz#3dc69ac82498d2ee5e3ce56091bafd2adc7bde92"
integrity sha1-PcaayCSY0u5ePOVgkbr9Ktx73pI=
lodash._createassigner@^3.0.0:
version "3.1.1"
resolved "https://registry.yarnpkg.com/lodash._createassigner/-/lodash._createassigner-3.1.1.tgz#838a5bae2fdaca63ac22dee8e19fa4e6d6970b11"
@@ -13893,19 +13747,12 @@ lodash._createassigner@^3.0.0:
lodash._isiterateecall "^3.0.0"
lodash.restparam "^3.0.0"
lodash._createcache@*:
version "3.1.2"
resolved "https://registry.yarnpkg.com/lodash._createcache/-/lodash._createcache-3.1.2.tgz#56d6a064017625e79ebca6b8018e17440bdcf093"
integrity sha1-VtagZAF2JeeevKa4AY4XRAvc8JM=
dependencies:
lodash._getnative "^3.0.0"
lodash._createset@~4.0.0:
version "4.0.3"
resolved "https://registry.yarnpkg.com/lodash._createset/-/lodash._createset-4.0.3.tgz#0f4659fbb09d75194fa9e2b88a6644d363c9fe26"
integrity sha1-D0ZZ+7CddRlPqeK4imZE02PJ/iY=
lodash._getnative@*, lodash._getnative@^3.0.0:
lodash._getnative@^3.0.0:
version "3.9.1"
resolved "https://registry.yarnpkg.com/lodash._getnative/-/lodash._getnative-3.9.1.tgz#570bc7dede46d61cdcde687d65d3eecbaa3aaff5"
integrity sha1-VwvH3t5G1hzc3mh9ZdPuy6o6r/U=
@@ -14118,7 +13965,7 @@ lodash.pick@^4.4.0:
resolved "https://registry.yarnpkg.com/lodash.pick/-/lodash.pick-4.4.0.tgz#52f05610fff9ded422611441ed1fc123a03001b3"
integrity sha1-UvBWEP/53tQiYRRB7R/BI6AwAbM=
lodash.restparam@*, lodash.restparam@^3.0.0:
lodash.restparam@^3.0.0:
version "3.6.1"
resolved "https://registry.yarnpkg.com/lodash.restparam/-/lodash.restparam-3.6.1.tgz#936a4e309ef330a7645ed4145986c85ae5b20805"
integrity sha1-k2pOMJ7zMKdkXtQUWYbIWuWyCAU=