-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathaudit-report.json
25 lines (25 loc) · 51.7 KB
/
audit-report.json
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
{"type":"auditAdvisory","data":{"resolution":{"id":1088594,"path":"recharts>d3-interpolate>d3-color","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"2.0.0","paths":["recharts>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-brush>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-brush>d3-transition>d3-interpolate>d3-color"]}],"metadata":null,"vulnerable_versions":"<3.1.0","module_name":"d3-color","severity":"high","github_advisory_id":"GHSA-36jr-mh4h-2g58","cves":[],"access":"public","patched_versions":">=3.1.0","cvss":{"score":0,"vectorString":null},"updated":"2023-01-13T05:04:43.000Z","recommendation":"Upgrade to version 3.1.0 or later","cwe":["CWE-400"],"found_by":null,"deleted":null,"id":1088594,"references":"- https://github.com/d3/d3-color/pull/100\n- https://github.com/d3/d3-color/releases/tag/v3.1.0\n- https://security.snyk.io/vuln/SNYK-JS-D3COLOR-1076592\n- https://github.com/advisories/GHSA-36jr-mh4h-2g58","created":"2022-09-29T14:12:55.000Z","reported_by":null,"title":"d3-color vulnerable to ReDoS","npm_advisory_id":null,"overview":"The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.","url":"https://github.com/advisories/GHSA-36jr-mh4h-2g58"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1089434,"path":"jsonwebtoken","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"8.5.1","paths":["jsonwebtoken"]}],"metadata":null,"vulnerable_versions":"<=8.5.1","module_name":"jsonwebtoken","severity":"moderate","github_advisory_id":"GHSA-8cf7-32gw-wr33","cves":["CVE-2022-23539"],"access":"public","patched_versions":">=9.0.0","cvss":{"score":0,"vectorString":null},"updated":"2023-01-31T05:01:09.000Z","recommendation":"Upgrade to version 9.0.0 or later","cwe":["CWE-327"],"found_by":null,"deleted":null,"id":1089434,"references":"- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33\n- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3\n- https://nvd.nist.gov/vuln/detail/CVE-2022-23539\n- https://github.com/advisories/GHSA-8cf7-32gw-wr33","created":"2022-12-22T03:32:22.000Z","reported_by":null,"title":"jsonwebtoken unrestricted key type could lead to legacy keys usage ","npm_advisory_id":null,"overview":"# Overview\n\nVersions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. \n\n# Am I affected?\n\nYou are affected if you are using an algorithm and a key type other than the combinations mentioned below\n\n| Key type | algorithm |\n|----------|------------------------------------------|\n| ec | ES256, ES384, ES512 |\n| rsa | RS256, RS384, RS512, PS256, PS384, PS512 |\n| rsa-pss | PS256, PS384, PS512 |\n\nAnd for Elliptic Curve algorithms:\n\n| `alg` | Curve |\n|-------|------------|\n| ES256 | prime256v1 |\n| ES384 | secp384r1 |\n| ES512 | secp521r1 |\n\n# How do I fix it?\n\nUpdate to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, If you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.\n\n# Will the fix impact my users?\n\nThere will be no impact, if you update to version 9.0.0 and you already use a valid secure combination of key type and algorithm. Otherwise, use the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and `verify()` functions to continue usage of invalid key type/algorithm combination in 9.0.0 for legacy compatibility. \n\n","url":"https://github.com/advisories/GHSA-8cf7-32gw-wr33"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1091087,"path":"jsonwebtoken","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"8.5.1","paths":["jsonwebtoken"]}],"metadata":null,"vulnerable_versions":"<=8.5.1","module_name":"jsonwebtoken","severity":"moderate","github_advisory_id":"GHSA-hjrf-2m68-5959","cves":["CVE-2022-23541"],"access":"public","patched_versions":">=9.0.0","cvss":{"score":5,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L"},"updated":"2023-01-29T05:06:34.000Z","recommendation":"Upgrade to version 9.0.0 or later","cwe":["CWE-287"],"found_by":null,"deleted":null,"id":1091087,"references":"- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959\n- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3\n- https://nvd.nist.gov/vuln/detail/CVE-2022-23541\n- https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0\n- https://github.com/advisories/GHSA-hjrf-2m68-5959","created":"2022-12-22T03:33:19.000Z","reported_by":null,"title":"jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC","npm_advisory_id":null,"overview":"# Overview\n\nVersions `<=8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function (referring to the `secretOrPublicKey` argument from the [readme link](https://github.com/auth0/node-jsonwebtoken#jwtverifytoken-secretorpublickey-options-callback)) will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. \n\n# Am I affected?\n\nYou will be affected if your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. \n\n# How do I fix it?\n \nUpdate to version 9.0.0.\n\n# Will the fix impact my users?\n\nThere is no impact for end users","url":"https://github.com/advisories/GHSA-hjrf-2m68-5959"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1091170,"path":"jsonwebtoken","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"8.5.1","paths":["jsonwebtoken"]}],"metadata":null,"vulnerable_versions":"<9.0.0","module_name":"jsonwebtoken","severity":"moderate","github_advisory_id":"GHSA-qwph-4952-7xr6","cves":["CVE-2022-23540"],"access":"public","patched_versions":">=9.0.0","cvss":{"score":6.4,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L"},"updated":"2023-02-27T23:46:57.000Z","recommendation":"Upgrade to version 9.0.0 or later","cwe":["CWE-287","CWE-327"],"found_by":null,"deleted":null,"id":1091170,"references":"- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6\n- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3\n- https://nvd.nist.gov/vuln/detail/CVE-2022-23540\n- https://github.com/advisories/GHSA-qwph-4952-7xr6","created":"2022-12-22T03:32:59.000Z","reported_by":null,"title":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","npm_advisory_id":null,"overview":"# Overview\n\nIn versions <=8.5.1 of jsonwebtoken library, lack of algorithm definition and a falsy secret or key in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification.\n\n# Am I affected?\nYou will be affected if all the following are true in the `jwt.verify()` function:\n- a token with no signature is received\n- no algorithms are specified \n- a falsy (e.g. null, false, undefined) secret or key is passed \n\n# How do I fix it?\n \nUpdate to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. \n\n# Will the fix impact my users?\n\nThere will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.\n","url":"https://github.com/advisories/GHSA-qwph-4952-7xr6"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"jsonwebtoken>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092158,"path":"@iconify/utils>@antfu/utils","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"0.7.2","paths":["@iconify/tools>@iconify/utils>@antfu/utils"]},{"version":"0.5.2","paths":["@iconify/utils>@antfu/utils"]}],"metadata":null,"vulnerable_versions":"<0.7.3","module_name":"@antfu/utils","severity":"moderate","github_advisory_id":"GHSA-p2fh-2h23-6grg","cves":["CVE-2023-2972"],"access":"public","patched_versions":">=0.7.3","cvss":{"score":5.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"},"updated":"2023-06-02T17:11:19.000Z","recommendation":"Upgrade to version 0.7.3 or later","cwe":["CWE-1321"],"found_by":null,"deleted":null,"id":1092158,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2023-2972\n- https://github.com/antfu/utils/commit/7f8b16c6181c988bdb96613fbb2533b345f68682\n- https://huntr.dev/bounties/009f1cd9-401c-49a7-bd08-be35cff6faef\n- https://github.com/advisories/GHSA-p2fh-2h23-6grg","created":"2023-05-30T12:30:17.000Z","reported_by":null,"title":"antfu/utils vulnerable to prototype pollution","npm_advisory_id":null,"overview":"Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.","url":"https://github.com/advisories/GHSA-p2fh-2h23-6grg"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"@babel/preset-env>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092158,"path":"@iconify/tools>@iconify/utils>@antfu/utils","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"0.7.2","paths":["@iconify/tools>@iconify/utils>@antfu/utils"]},{"version":"0.5.2","paths":["@iconify/utils>@antfu/utils"]}],"metadata":null,"vulnerable_versions":"<0.7.3","module_name":"@antfu/utils","severity":"moderate","github_advisory_id":"GHSA-p2fh-2h23-6grg","cves":["CVE-2023-2972"],"access":"public","patched_versions":">=0.7.3","cvss":{"score":5.4,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:L"},"updated":"2023-06-02T17:11:19.000Z","recommendation":"Upgrade to version 0.7.3 or later","cwe":["CWE-1321"],"found_by":null,"deleted":null,"id":1092158,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2023-2972\n- https://github.com/antfu/utils/commit/7f8b16c6181c988bdb96613fbb2533b345f68682\n- https://huntr.dev/bounties/009f1cd9-401c-49a7-bd08-be35cff6faef\n- https://github.com/advisories/GHSA-p2fh-2h23-6grg","created":"2023-05-30T12:30:17.000Z","reported_by":null,"title":"antfu/utils vulnerable to prototype pollution","npm_advisory_id":null,"overview":"Prototype Pollution in GitHub repository antfu/utils prior to 0.7.3.","url":"https://github.com/advisories/GHSA-p2fh-2h23-6grg"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"@babel/preset-env>@babel/helper-compilation-targets>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"node-sass>make-fetch-happen>cacache>@npmcli/fs>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"node-sass>meow>normalize-package-data>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"node-sass>node-gyp>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1088594,"path":"react-d3-speedometer>d3>d3-interpolate>d3-color","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"2.0.0","paths":["recharts>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-brush>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-brush>d3-transition>d3-interpolate>d3-color"]}],"metadata":null,"vulnerable_versions":"<3.1.0","module_name":"d3-color","severity":"high","github_advisory_id":"GHSA-36jr-mh4h-2g58","cves":[],"access":"public","patched_versions":">=3.1.0","cvss":{"score":0,"vectorString":null},"updated":"2023-01-13T05:04:43.000Z","recommendation":"Upgrade to version 3.1.0 or later","cwe":["CWE-400"],"found_by":null,"deleted":null,"id":1088594,"references":"- https://github.com/d3/d3-color/pull/100\n- https://github.com/d3/d3-color/releases/tag/v3.1.0\n- https://security.snyk.io/vuln/SNYK-JS-D3COLOR-1076592\n- https://github.com/advisories/GHSA-36jr-mh4h-2g58","created":"2022-09-29T14:12:55.000Z","reported_by":null,"title":"d3-color vulnerable to ReDoS","npm_advisory_id":null,"overview":"The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.","url":"https://github.com/advisories/GHSA-36jr-mh4h-2g58"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1088594,"path":"react-d3-speedometer>d3>d3-brush>d3-interpolate>d3-color","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"2.0.0","paths":["recharts>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-brush>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-brush>d3-transition>d3-interpolate>d3-color"]}],"metadata":null,"vulnerable_versions":"<3.1.0","module_name":"d3-color","severity":"high","github_advisory_id":"GHSA-36jr-mh4h-2g58","cves":[],"access":"public","patched_versions":">=3.1.0","cvss":{"score":0,"vectorString":null},"updated":"2023-01-13T05:04:43.000Z","recommendation":"Upgrade to version 3.1.0 or later","cwe":["CWE-400"],"found_by":null,"deleted":null,"id":1088594,"references":"- https://github.com/d3/d3-color/pull/100\n- https://github.com/d3/d3-color/releases/tag/v3.1.0\n- https://security.snyk.io/vuln/SNYK-JS-D3COLOR-1076592\n- https://github.com/advisories/GHSA-36jr-mh4h-2g58","created":"2022-09-29T14:12:55.000Z","reported_by":null,"title":"d3-color vulnerable to ReDoS","npm_advisory_id":null,"overview":"The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.","url":"https://github.com/advisories/GHSA-36jr-mh4h-2g58"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1088594,"path":"react-d3-speedometer>d3>d3-brush>d3-transition>d3-interpolate>d3-color","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"2.0.0","paths":["recharts>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-brush>d3-interpolate>d3-color","react-d3-speedometer>d3>d3-brush>d3-transition>d3-interpolate>d3-color"]}],"metadata":null,"vulnerable_versions":"<3.1.0","module_name":"d3-color","severity":"high","github_advisory_id":"GHSA-36jr-mh4h-2g58","cves":[],"access":"public","patched_versions":">=3.1.0","cvss":{"score":0,"vectorString":null},"updated":"2023-01-13T05:04:43.000Z","recommendation":"Upgrade to version 3.1.0 or later","cwe":["CWE-400"],"found_by":null,"deleted":null,"id":1088594,"references":"- https://github.com/d3/d3-color/pull/100\n- https://github.com/d3/d3-color/releases/tag/v3.1.0\n- https://security.snyk.io/vuln/SNYK-JS-D3COLOR-1076592\n- https://github.com/advisories/GHSA-36jr-mh4h-2g58","created":"2022-09-29T14:12:55.000Z","reported_by":null,"title":"d3-color vulnerable to ReDoS","npm_advisory_id":null,"overview":"The d3-color module provides representations for various color spaces in the browser. Versions prior to 3.1.0 are vulnerable to a Regular expression Denial of Service. This issue has been patched in version 3.1.0. There are no known workarounds.","url":"https://github.com/advisories/GHSA-36jr-mh4h-2g58"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1091239,"path":"react-google-maps>recompose>fbjs>isomorphic-fetch>node-fetch","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"1.7.3","paths":["react-google-maps>recompose>fbjs>isomorphic-fetch>node-fetch"]}],"metadata":null,"vulnerable_versions":"<2.6.7","module_name":"node-fetch","severity":"high","github_advisory_id":"GHSA-r683-j2x4-v87g","cves":["CVE-2022-0235"],"access":"public","patched_versions":">=2.6.7","cvss":{"score":8.8,"vectorString":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"},"updated":"2023-03-02T21:34:14.000Z","recommendation":"Upgrade to version 2.6.7 or later","cwe":["CWE-173","CWE-200","CWE-601"],"found_by":null,"deleted":null,"id":1091239,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-0235\n- https://github.com/node-fetch/node-fetch/commit/36e47e8a6406185921e4985dcbeff140d73eaa10\n- https://huntr.dev/bounties/d26ab655-38d6-48b3-be15-f9ad6b6ae6f7\n- https://github.com/node-fetch/node-fetch/pull/1453\n- https://github.com/node-fetch/node-fetch/commit/5c32f002fdd65b1c6a8f1e3620210813d45c7e60\n- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf\n- https://lists.debian.org/debian-lts-announce/2022/12/msg00007.html\n- https://github.com/node-fetch/node-fetch/pull/1449/commits/5c32f002fdd65b1c6a8f1e3620210813d45c7e60\n- https://github.com/node-fetch/node-fetch/commit/1ef4b560a17e644a02a3bfdea7631ffeee578b35\n- https://github.com/advisories/GHSA-r683-j2x4-v87g","created":"2022-01-21T23:55:52.000Z","reported_by":null,"title":"node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","npm_advisory_id":null,"overview":"node-fetch is vulnerable to Exposure of Sensitive Information to an Unauthorized Actor","url":"https://github.com/advisories/GHSA-r683-j2x4-v87g"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1091791,"path":"react-google-maps>recompose>fbjs>isomorphic-fetch>node-fetch","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"1.7.3","paths":["react-google-maps>recompose>fbjs>isomorphic-fetch>node-fetch"]}],"metadata":null,"vulnerable_versions":"<2.6.1","module_name":"node-fetch","severity":"low","github_advisory_id":"GHSA-w7rc-rwvf-8q5r","cves":["CVE-2020-15168"],"access":"public","patched_versions":">=2.6.1","cvss":{"score":2.6,"vectorString":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:N/I:N/A:L"},"updated":"2023-04-21T19:34:09.000Z","recommendation":"Upgrade to version 2.6.1 or later","cwe":["CWE-20","CWE-770"],"found_by":null,"deleted":null,"id":1091791,"references":"- https://github.com/node-fetch/node-fetch/security/advisories/GHSA-w7rc-rwvf-8q5r\n- https://nvd.nist.gov/vuln/detail/CVE-2020-15168\n- https://github.com/node-fetch/node-fetch/commit/2358a6c2563d1730a0cdaccc197c611949f6a334\n- https://github.com/node-fetch/node-fetch/commit/eaff0094c4dfdd5b78711a8c4f1b61e33d282072\n- https://github.com/advisories/GHSA-w7rc-rwvf-8q5r","created":"2020-09-10T17:46:21.000Z","reported_by":null,"title":"The `size` option isn't honored after following a redirect in node-fetch","npm_advisory_id":null,"overview":"### Impact\nNode Fetch did not honor the `size` option after following a redirect, which means that when a content size was over the limit, a `FetchError` would never get thrown and the process would end without failure.\n\nFor most people, this fix will have a little or no impact. However, if you are relying on node-fetch to gate files above a size, the impact could be significant, for example: If you don't double-check the size of the data after `fetch()` has completed, your JS thread could get tied up doing work on a large file (DoS) and/or cost you money in computing.\n\n### Patches\nWe released patched versions for both stable and beta channels:\n\n- For `v2`: 2.6.1\n- For `v3`: 3.0.0-beta.9\n\n### Workarounds\nNone, it is strongly recommended to update as soon as possible.\n\n### For more information\nIf you have any questions or comments about this advisory:\n* Open an issue in [node-fetch](https://github.com/node-fetch/node-fetch/issues/new?assignees=&labels=question&template=support-or-usage.md&title=Question%3A+)\n* Contact one of the core maintainers.","url":"https://github.com/advisories/GHSA-w7rc-rwvf-8q5r"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092310,"path":"node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver","dev":false,"optional":false,"bundled":false},"advisory":{"findings":[{"version":"6.3.0","paths":["@babel/preset-env>semver","@babel/preset-env>@babel/helper-compilation-targets>semver","@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>@babel/plugin-proposal-object-rest-spread>@babel/helper-compilation-targets>semver","@svgr/webpack>@babel/preset-env>babel-plugin-polyfill-corejs2>@babel/helper-define-polyfill-provider>@babel/helper-compilation-targets>semver"]},{"version":"7.5.0","paths":["eslint-config-next>@typescript-eslint/parser>@typescript-eslint/typescript-estree>semver"]},{"version":"5.7.1","paths":["jsonwebtoken>semver"]},{"version":"7.5.0","paths":["node-sass>make-fetch-happen>cacache>@npmcli/fs>semver"]},{"version":"7.5.0","paths":["node-sass>meow>normalize-package-data>semver"]},{"version":"5.7.1","paths":["node-sass>meow>read-pkg-up>read-pkg>normalize-package-data>semver"]},{"version":"7.5.0","paths":["node-sass>node-gyp>semver","node-sass>node-gyp>make-fetch-happen>cacache>@npmcli/fs>semver"]}],"metadata":null,"vulnerable_versions":"<7.5.2","module_name":"semver","severity":"moderate","github_advisory_id":"GHSA-c2qf-rxjj-qqgw","cves":["CVE-2022-25883"],"access":"public","patched_versions":">=7.5.2","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-22T16:52:56.000Z","recommendation":"Upgrade to version 7.5.2 or later","cwe":["CWE-1333"],"found_by":null,"deleted":null,"id":1092310,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2022-25883\n- https://github.com/npm/node-semver/pull/564\n- https://github.com/npm/node-semver/commit/717534ee353682f3bcf33e60a8af4292626d4441\n- https://security.snyk.io/vuln/SNYK-JS-SEMVER-3247795\n- https://github.com/npm/node-semver/blob/main/classes/range.js#L97-L104\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L138\n- https://github.com/npm/node-semver/blob/main/internal/re.js#L160\n- https://github.com/advisories/GHSA-c2qf-rxjj-qqgw","created":"2023-06-21T06:30:28.000Z","reported_by":null,"title":"semver vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\n\n\n","url":"https://github.com/advisories/GHSA-c2qf-rxjj-qqgw"}}}
{"type":"auditAdvisory","data":{"resolution":{"id":1092330,"path":"eslint>optionator>word-wrap","dev":false,"bundled":false,"optional":false},"advisory":{"findings":[{"version":"1.2.3","paths":["eslint>optionator>word-wrap"]}],"metadata":null,"vulnerable_versions":"<=1.2.3","module_name":"word-wrap","severity":"moderate","github_advisory_id":"GHSA-j8xg-fqg3-53r7","cves":["CVE-2023-26115"],"access":"public","patched_versions":"<0.0.0","cvss":{"score":5.3,"vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"},"updated":"2023-06-27T22:32:05.000Z","recommendation":"None","cwe":[],"found_by":null,"deleted":null,"id":1092330,"references":"- https://nvd.nist.gov/vuln/detail/CVE-2023-26115\n- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-4058657\n- https://security.snyk.io/vuln/SNYK-JS-WORDWRAP-3149973\n- https://github.com/jonschlinkert/word-wrap/blob/master/index.js#L39\n- https://github.com/advisories/GHSA-j8xg-fqg3-53r7","created":"2023-06-22T06:30:18.000Z","reported_by":null,"title":"word-wrap vulnerable to Regular Expression Denial of Service","npm_advisory_id":null,"overview":"All versions of the package word-wrap are vulnerable to Regular Expression Denial of Service (ReDoS) due to the usage of an insecure regular expression within the result variable.\n","url":"https://github.com/advisories/GHSA-j8xg-fqg3-53r7"}}}
{"type":"auditSummary","data":{"vulnerabilities":{"info":0,"low":1,"moderate":18,"high":5,"critical":0},"dependencies":1153,"devDependencies":0,"optionalDependencies":0,"totalDependencies":1153}}