22 lines
71 KiB
Plaintext
22 lines
71 KiB
Plaintext
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|
|
{"type":"auditAdvisory","data":{"resolution":{"id":566,"path":"rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"2.16.3","paths":["api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>boom>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>hoek","api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>api>ember-cli-mirage>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>ember-intl>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>emberx-select>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","core>rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek","rose>ember-focus-trap>ember-auto-import>@embroider/core>jsdom>request>hawk>sntp>hoek"]}],"id":566,"created":"2018-04-20T21:25:58.421Z","updated":"2019-06-19T20:16:59.758Z","deleted":null,"title":"Prototype Pollution","found_by":{"name":"HoLyVieR"},"reported_by":{"name":"HoLyVieR"},"module_name":"hoek","cves":["CVE-2018-3728"],"vulnerable_versions":"<= 4.2.0 || >= 5.0.0 < 5.0.3","patched_versions":"> 4.2.0 < 5.0.0 || >= 5.0.3","overview":"Versions of `hoek` prior to 4.2.1 and 5.0.3 are vulnerable to prototype pollution.\n\nThe `merge` function, and the `applyToDefaults` and `applyToDefaultsWithShallow` functions which leverage `merge` behind the scenes, are vulnerable to a prototype pollution attack when provided an _unvalidated_ payload created from a JSON string containing the `__proto__` property.\n\nThis can be demonstrated like so:\n\n```javascript\nvar Hoek = require('hoek');\nvar malicious_payload = '{\"__proto__\":{\"oops\":\"It works !\"}}';\n\nvar a = {};\nconsole.log(\"Before : \" + a.oops);\nHoek.merge({}, JSON.parse(malicious_payload));\nconsole.log(\"After : \" + a.oops);\n```\n\nThis type of attack can be used to overwrite existing properties causing a potential denial of service.","recommendation":"Update to version 4.2.1, 5.0.3 or later.","references":"- [HackerOne Report](https://hackerone.com/reports/310439)","access":"public","severity":"moderate","cwe":"CWE-471","metadata":{"module_type":"","exploitability":5,"affected_components":""},"url":"https://npmjs.com/advisories/566"}}}
|