bull-arena-2.4.5.tgz: 45 vulnerabilities (highest severity is: 9.8)

<details><summary><img src='https://whitesource-resources.whitesourcesoftware.com/vulnerability_details.png' width=19 height=20> Vulnerable Library - bull-arena-2.4.5.tgz</summary>


Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


</details>

## Vulnerabilities

| CVE | Severity | <img src='https://whitesource-resources.whitesourcesoftware.com/cvss3.png' width=19 height=20> CVSS | Dependency | Type | Fixed in (bull-arena version) | Remediation Possible** | Reachability |
| ------------- | ------------- | ----- | ----- | ----- | ------------- | --- | --- |
| [WS-2022-0280](https://github.com/moment/moment-timezone/commit/ce955a301ff372e8e9fb3a5b516620c60e7a082a) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | moment-timezone-0.5.21.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2018-0211](https://github.com/dominictarr/event-stream/issues/116) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | detected in multiple dependencies | Transitive | 2.5.0 | &#9989;| |
| [CVE-2022-37598](https://www.mend.io/vulnerability-database/CVE-2022-37598) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | uglify-js-3.4.9.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2021-44906](https://www.mend.io/vulnerability-database/CVE-2021-44906) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | detected in multiple dependencies | Transitive | 2.5.0 | &#9989;| |
| [CVE-2019-19919](https://www.mend.io/vulnerability-database/CVE-2019-19919) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2019-10747](https://www.mend.io/vulnerability-database/CVE-2019-10747) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | detected in multiple dependencies | Transitive | 2.5.0 | &#9989;| |
| [CVE-2019-10746](https://www.mend.io/vulnerability-database/CVE-2019-10746) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.8 | mixin-deep-1.3.1.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2022-0284](https://github.com/moment/moment-timezone/commit/7915ac567ab19700e44ad6b5d8ef0b85e48a9e75) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.1 | moment-timezone-0.5.21.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2018-0627](https://www.npmjs.com/advisories/737) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.1 | flatmap-stream-0.1.1.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2019-10744](https://www.mend.io/vulnerability-database/CVE-2019-10744) | <img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> Critical | 9.1 | lodash-4.17.11.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2021-32820](https://www.mend.io/vulnerability-database/CVE-2021-32820) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.6 | express-handlebars-3.0.0.tgz | Transitive | 2.8.2 | &#9989;| |
| [CVE-2021-37712](https://www.mend.io/vulnerability-database/CVE-2021-37712) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.2 | tar-4.4.6.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2019-0333](https://github.com/wycats/handlebars.js/commit/f7f05d7558e674856686b62a00cde5758f3b7a08) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.1 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2019-20920](https://www.mend.io/vulnerability-database/CVE-2019-20920) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 8.1 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2019-0493](https://github.com/handlebars-lang/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2019-0492](https://github.com/handlebars-lang/handlebars.js/commit/198887808780bbef9dba67a8af68ece091d5baa7) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2019-0318](https://github.com/wycats/handlebars.js/commit/8d5530ee2c3ea9f0aee3fde310b9f36887d00b8b) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2024-4068](https://www.mend.io/vulnerability-database/CVE-2024-4068) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | detected in multiple dependencies | Transitive | N/A* | &#10060;| |
| [CVE-2022-38900](https://www.mend.io/vulnerability-database/CVE-2022-38900) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | decode-uri-component-0.2.0.tgz | Transitive | 2.5.0 | &#10060;| |
| [CVE-2022-3517](https://www.mend.io/vulnerability-database/CVE-2022-3517) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | minimatch-3.0.4.tgz | Transitive | N/A* | &#10060;| |
| [CVE-2022-31129](https://www.mend.io/vulnerability-database/CVE-2022-31129) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | moment-2.22.2.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2022-24999](https://www.mend.io/vulnerability-database/CVE-2022-24999) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | qs-6.5.2.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2022-24785](https://www.mend.io/vulnerability-database/CVE-2022-24785) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | moment-2.22.2.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2021-3807](https://www.mend.io/vulnerability-database/CVE-2021-3807) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | ansi-regex-3.0.0.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2019-20922](https://www.mend.io/vulnerability-database/CVE-2019-20922) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2019-20149](https://www.mend.io/vulnerability-database/CVE-2019-20149) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | kind-of-6.0.2.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2019-12041](https://www.mend.io/vulnerability-database/CVE-2019-12041) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | remarkable-1.7.1.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2017-16116](https://www.mend.io/vulnerability-database/CVE-2017-16116) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.5 | underscore.string-2.4.0.tgz | Transitive | N/A* | &#10060;| |
| [CVE-2020-8203](https://www.mend.io/vulnerability-database/CVE-2020-8203) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.4 | lodash-4.17.11.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2019-0064](https://github.com/wycats/handlebars.js/compare/v4.1.1...v4.1.2) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.3 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2020-8116](https://www.mend.io/vulnerability-database/CVE-2020-8116) | <img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> High | 7.3 | dot-prop-4.2.0.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2019-10795](https://www.mend.io/vulnerability-database/CVE-2019-10795) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 6.3 | undefsafe-2.0.2.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2017-3770](https://github.com/gregjacobs/Autolinker.js/commit/f21ea015366cfa62c4e45d4bd117681e82e9b2bf) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 6.1 | autolinker-0.15.3.tgz | Transitive | 3.7.0 | &#9989;| |
| [CVE-2019-12043](https://www.mend.io/vulnerability-database/CVE-2019-12043) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 6.1 | remarkable-1.7.1.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2019-0103](https://github.com/wycats/handlebars.js/issues/1267#issue-187151586) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.6 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2021-23369](https://www.mend.io/vulnerability-database/CVE-2021-23369) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.6 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2020-7598](https://www.mend.io/vulnerability-database/CVE-2020-7598) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.6 | detected in multiple dependencies | Transitive | 2.5.0 | &#9989;| |
| [WS-2019-0540](https://github.com/gregjacobs/Autolinker.js/pull/260) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.3 | autolinker-0.15.3.tgz | Transitive | 3.7.0 | &#9989;| |
| [CVE-2022-33987](https://www.mend.io/vulnerability-database/CVE-2022-33987) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.3 | got-6.7.1.tgz | Transitive | 2.8.2 | &#9989;| |
| [CVE-2021-29469](https://www.mend.io/vulnerability-database/CVE-2021-29469) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.3 | redis-2.8.0.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2020-28500](https://www.mend.io/vulnerability-database/CVE-2020-28500) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.3 | lodash-4.17.11.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2019-0332](https://github.com/wycats/handlebars.js/commit/198887808780bbef9dba67a8af68ece091d5baa7) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.0 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [WS-2019-0331](https://github.com/wycats/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 5.0 | handlebars-4.0.12.tgz | Transitive | 2.5.0 | &#9989;| |
| [CVE-2024-10491](https://www.mend.io/vulnerability-database/CVE-2024-10491) | <img src='https://whitesource-resources.whitesourcesoftware.com/medium_vul.png?' width=19 height=20> Medium | 4.0 | express-4.16.4.tgz | Transitive | N/A* | &#10060;| |
| [CVE-2021-23358](https://www.mend.io/vulnerability-database/CVE-2021-23358) | <img src='https://whitesource-resources.whitesourcesoftware.com/low_vul.png?' width=19 height=20> Low | 3.3 | underscore-1.7.0.tgz | Transitive | 2.5.0 | &#9989;| |
*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

## Details


> Partial details (18 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application. 

<details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> WS-2022-0280</summary>


### Vulnerable Library - moment-timezone-0.5.21.tgz

Parse and display moments in any timezone.
Library home page: <a href="https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.21.tgz">https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.21.tgz</a>
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - bull-3.4.8.tgz
 - cron-parser-2.6.0.tgz
 - :x: **moment-timezone-0.5.21.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
Command Injection in moment-timezone before 0.5.35.

Publish Date: 2024-10-29
URL: <a href=https://github.com/moment/moment-timezone/commit/ce955a301ff372e8e9fb3a5b516620c60e7a082a>WS-2022-0280</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-56x4-j7p9-fcf9">https://github.com/advisories/GHSA-56x4-j7p9-fcf9</a>
Release Date: 2022-08-30
Fix Resolution (moment-timezone): 0.5.35
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> WS-2018-0211</summary>


### Vulnerable Libraries - event-stream-3.3.6.tgz, flatmap-stream-0.1.1.tgz



### event-stream-3.3.6.tgz

construct pipes of streams of events
Library home page: <a href="https://registry.npmjs.org/event-stream/-/event-stream-3.3.6.tgz">https://registry.npmjs.org/event-stream/-/event-stream-3.3.6.tgz</a>
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - nodemon-1.18.4.tgz
 - pstree.remy-1.1.0.tgz
 - ps-tree-1.1.0.tgz
 - :x: **event-stream-3.3.6.tgz** (Vulnerable Library)


### flatmap-stream-0.1.1.tgz

UNMAINTAINED
Library home page: <a href="https://registry.npmjs.org/flatmap-stream/-/flatmap-stream-0.1.1.tgz">https://registry.npmjs.org/flatmap-stream/-/flatmap-stream-0.1.1.tgz</a>
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - nodemon-1.18.4.tgz
 - pstree.remy-1.1.0.tgz
 - ps-tree-1.1.0.tgz
 - event-stream-3.3.6.tgz
 - :x: **flatmap-stream-0.1.1.tgz** (Vulnerable Library)


Found in base branch: main




### Vulnerability Details
 
 
Malicious code in event-stream, the ownership \event-stream\ node_module was transferred

Publish Date: 2018-11-28
URL: <a href=https://github.com/dominictarr/event-stream/issues/116>WS-2018-0211</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://nvd.nist.gov/vuln/detail/WS-2018-0211">https://nvd.nist.gov/vuln/detail/WS-2018-0211</a>
Release Date: 2018-11-28
Fix Resolution (event-stream): 4.0.0
Direct dependency fix Resolution (bull-arena): 2.5.0Fix Resolution (flatmap-stream): 4.0.0
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2022-37598</summary>


### Vulnerable Library - uglify-js-3.4.9.tgz

JavaScript parser, mangler/compressor and beautifier toolkit
Library home page: <a href="https://registry.npmjs.org/uglify-js/-/uglify-js-3.4.9.tgz">https://registry.npmjs.org/uglify-js/-/uglify-js-3.4.9.tgz</a>
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - handlebars-4.0.12.tgz
 - :x: **uglify-js-3.4.9.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
Prototype pollution vulnerability in function DEFNODE in ast.js in mishoo UglifyJS 3.13.2 via the name variable in ast.js. NOTE: the vendor considers this an invalid report.

Publish Date: 2022-10-20
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2022-37598>CVE-2022-37598</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2022-10-20
Fix Resolution (uglify-js): 3.13.10
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2021-44906</summary>


### Vulnerable Libraries - minimist-1.2.0.tgz, minimist-0.0.10.tgz, minimist-0.0.8.tgz



### minimist-1.2.0.tgz

parse argument options
Library home page: <a href="https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz">https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz</a>
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn/lockfile_only_change/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn/lockfile_only_change/node_modules/minimist/package.json,/npm_and_yarn/spec/fixtures/projects/npm8/os_mismatch/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/npm8/git_dependency_local_file/node_modules/minimist/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/npm6/git_dependency_local_file/node_modules/minimist/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/npm6/os_mismatch/package.json,/npm_and_yarn/spec/fixtures/projects/npm6/git_dependency_local_file/node_modules/minimist/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/git_dependency_local_file/node_modules/minimist/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/dist_tag/node_modules/npm/node_modules/update-notifier/node_modules/latest-version/node_modules/package-json/node_modules/registry-url/node_modules/rc/node_modules/minimist/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/dist_tag/node_modules/npm/node_modules/update-notifier/node_modules/latest-version/node_modules/package-json/node_modules/registry-url/node_modules/rc/node_modules/minimist/package.json,/npm_and_yarn/spec/fixtures/projects/npm8/git_dependency_local_file/node_modules/minimist/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/lockfile_only_change/node_modules/minimist/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/npm6/os_mismatch/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/git_dependency_local_file/node_modules/minimist/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/dist_tag/node_modules/npm/node_modules/update-notifier/node_modules/latest-version/node_modules/package-json/node_modules/registry-auth-token/node_modules/rc/node_modules/minimist/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/npm8/os_mismatch/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/dist_tag/node_modules/npm/node_modules/update-notifier/node_modules/latest-version/node_modules/package-json/node_modules/registry-auth-token/node_modules/rc/node_modules/minimist/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - nodemon-1.18.4.tgz
 - update-notifier-2.5.0.tgz
 - latest-version-3.1.0.tgz
 - package-json-4.0.1.tgz
 - registry-url-3.1.0.tgz
 - rc-1.2.8.tgz
 - :x: **minimist-1.2.0.tgz** (Vulnerable Library)


### minimist-0.0.10.tgz

parse argument options
Library home page: <a href="https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz">https://registry.npmjs.org/minimist/-/minimist-0.0.10.tgz</a>


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - handlebars-4.0.12.tgz
 - optimist-0.6.1.tgz
 - :x: **minimist-0.0.10.tgz** (Vulnerable Library)


### minimist-0.0.8.tgz

parse argument options
Library home page: <a href="https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz">https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz</a>


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - nodemon-1.18.4.tgz
 - chokidar-2.0.4.tgz
 - fsevents-1.2.4.tgz
 - node-pre-gyp-0.10.3.tgz
 - tar-4.4.6.tgz
 - mkdirp-0.5.1.tgz
 - :x: **minimist-0.0.8.tgz** (Vulnerable Library)


Found in base branch: main




### Vulnerability Details
 
 
Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2021-44906>CVE-2021-44906</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2022-03-17
Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (bull-arena): 2.5.0Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (bull-arena): 2.5.0Fix Resolution (minimist): 1.2.6
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2019-19919</summary>


### Vulnerable Library - handlebars-4.0.12.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: <a href="https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz">https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz</a>
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - :x: **handlebars-4.0.12.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
Versions of handlebars prior to 4.3.0 are vulnerable to Prototype Pollution leading to Remote Code Execution. Templates may alter an Object's proto and defineGetter properties, which may allow an attacker to execute arbitrary code through crafted payloads.
 Mend Note: Converted from WS-2019-0368, on 2022-11-08.

Publish Date: 2019-12-20
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-19919>CVE-2019-19919</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://www.npmjs.com/advisories/1164">https://www.npmjs.com/advisories/1164</a>
Release Date: 2019-12-20
Fix Resolution (handlebars): 4.3.0
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2019-10747</summary>


### Vulnerable Libraries - set-value-0.4.3.tgz, set-value-2.0.0.tgz



### set-value-0.4.3.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: <a href="https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz">https://registry.npmjs.org/set-value/-/set-value-0.4.3.tgz</a>
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - nodemon-1.18.4.tgz
 - chokidar-2.0.4.tgz
 - braces-2.3.2.tgz
 - snapdragon-0.8.2.tgz
 - base-0.11.2.tgz
 - cache-base-1.0.1.tgz
 - union-value-1.0.0.tgz
 - :x: **set-value-0.4.3.tgz** (Vulnerable Library)


### set-value-2.0.0.tgz

Create nested values and any intermediaries using dot notation (`'a.b.c'`) paths.
Library home page: <a href="https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz">https://registry.npmjs.org/set-value/-/set-value-2.0.0.tgz</a>
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - nodemon-1.18.4.tgz
 - chokidar-2.0.4.tgz
 - braces-2.3.2.tgz
 - snapdragon-0.8.2.tgz
 - base-0.11.2.tgz
 - cache-base-1.0.1.tgz
 - :x: **set-value-2.0.0.tgz** (Vulnerable Library)


Found in base branch: main




### Vulnerability Details
 
 
set-value is vulnerable to Prototype Pollution in versions lower than 3.0.1. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using any of the constructor, prototype and proto payloads.

Publish Date: 2019-08-23
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-10747>CVE-2019-10747</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2019-08-23
Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (bull-arena): 2.5.0Fix Resolution (set-value): 2.0.1
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2019-10746</summary>


### Vulnerable Library - mixin-deep-1.3.1.tgz

Deeply mix the properties of objects into the first object. Like merge-deep, but doesn't clone.
Library home page: <a href="https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz">https://registry.npmjs.org/mixin-deep/-/mixin-deep-1.3.1.tgz</a>
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - nodemon-1.18.4.tgz
 - chokidar-2.0.4.tgz
 - braces-2.3.2.tgz
 - snapdragon-0.8.2.tgz
 - base-0.11.2.tgz
 - :x: **mixin-deep-1.3.1.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
mixin-deep is vulnerable to Prototype Pollution in versions before 1.3.2 and version 2.0.0. The function mixin-deep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-08-23
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-10746>CVE-2019-10746</a>




### CVSS 3 Score Details (9.8)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2019-08-23
Fix Resolution (mixin-deep): 1.3.2
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> WS-2022-0284</summary>


### Vulnerable Library - moment-timezone-0.5.21.tgz

Parse and display moments in any timezone.
Library home page: <a href="https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.21.tgz">https://registry.npmjs.org/moment-timezone/-/moment-timezone-0.5.21.tgz</a>
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - bull-3.4.8.tgz
 - cron-parser-2.6.0.tgz
 - :x: **moment-timezone-0.5.21.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
Cleartext Transmission of Sensitive Information in moment-timezone

Publish Date: 2024-10-29
URL: <a href=https://github.com/moment/moment-timezone/commit/7915ac567ab19700e44ad6b5d8ef0b85e48a9e75>WS-2022-0284</a>




### CVSS 3 Score Details (9.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-v78c-4p63-2j6c">https://github.com/advisories/GHSA-v78c-4p63-2j6c</a>
Release Date: 2022-08-30
Fix Resolution (moment-timezone): 0.5.35
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> WS-2018-0627</summary>


### Vulnerable Library - flatmap-stream-0.1.1.tgz

UNMAINTAINED
Library home page: <a href="https://registry.npmjs.org/flatmap-stream/-/flatmap-stream-0.1.1.tgz">https://registry.npmjs.org/flatmap-stream/-/flatmap-stream-0.1.1.tgz</a>
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - nodemon-1.18.4.tgz
 - pstree.remy-1.1.0.tgz
 - ps-tree-1.1.0.tgz
 - event-stream-3.3.6.tgz
 - :x: **flatmap-stream-0.1.1.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
Flatmap-stream version 0.1.1 is a malicious package. The malicious code attemptes to steal bitcoins stored in the Copay wallets in order to transfer the funds to a remote server

Publish Date: 2018-11-27
URL: <a href=https://www.npmjs.com/advisories/737>WS-2018-0627</a>




### CVSS 3 Score Details (9.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://nvd.nist.gov/vuln/detail/WS-2018-0627">https://nvd.nist.gov/vuln/detail/WS-2018-0627</a>
Release Date: 2018-11-27
Fix Resolution (flatmap-stream): 0.1.2
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/critical_vul.png?' width=19 height=20> CVE-2019-10744</summary>


### Vulnerable Library - lodash-4.17.11.tgz

Lodash modular utilities.
Library home page: <a href="https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz">https://registry.npmjs.org/lodash/-/lodash-4.17.11.tgz</a>
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/npm8/peer_dependency_changed/node_modules/react-apollo/node_modules/lodash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/npm6/peer_dependency_changed/node_modules/react-apollo/node_modules/lodash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/npm8/peer_dependency_changed/node_modules/react-apollo/node_modules/lodash/package.json,/npm_and_yarn/spec/fixtures/projects/pnpm/peer_dependency_changed/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/pnpm/peer_dependency_changed/package.json,/npm_and_yarn/spec/fixtures/projects/npm6/peer_dependency_changed/node_modules/react-apollo/node_modules/lodash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - :x: **lodash-4.17.11.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.

Publish Date: 2019-07-25
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-10744>CVE-2019-10744</a>




### CVSS 3 Score Details (9.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/advisories/GHSA-jf85-cpcp-j695">https://github.com/advisories/GHSA-jf85-cpcp-j695</a>
Release Date: 2019-07-26
Fix Resolution (lodash): 4.17.12
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2021-32820</summary>


### Vulnerable Library - express-handlebars-3.0.0.tgz

A Handlebars view engine for Express which doesn't suck.
Library home page: <a href="https://registry.npmjs.org/express-handlebars/-/express-handlebars-3.0.0.tgz">https://registry.npmjs.org/express-handlebars/-/express-handlebars-3.0.0.tgz</a>
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - :x: **express-handlebars-3.0.0.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
Express-handlebars is a Handlebars view engine for Express. Express-handlebars mixes pure template data with engine configuration options through the Express render API. More specifically, the layout parameter may trigger file disclosure vulnerabilities in downstream applications. This potential vulnerability is somewhat restricted in that only files with existing extentions (i.e. file.extension) can be included, files that lack an extension will have .handlebars appended to them. For complete details refer to the referenced GHSL-2021-018 report. Notes in documentation have been added to help users avoid this potential information exposure vulnerability.

Publish Date: 2021-05-14
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2021-32820>CVE-2021-32820</a>




### CVSS 3 Score Details (8.6)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: None
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://nvd.nist.gov/vuln/detail/CVE-2021-32820">https://nvd.nist.gov/vuln/detail/CVE-2021-32820</a>
Release Date: 2021-05-14
Fix Resolution (express-handlebars): 5.3.3
Direct dependency fix Resolution (bull-arena): 2.8.2






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2021-37712</summary>


### Vulnerable Library - tar-4.4.6.tgz

tar for node
Library home page: <a href="https://registry.npmjs.org/tar/-/tar-4.4.6.tgz">https://registry.npmjs.org/tar/-/tar-4.4.6.tgz</a>
Path to dependency file: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - nodemon-1.18.4.tgz
 - chokidar-2.0.4.tgz
 - fsevents-1.2.4.tgz
 - node-pre-gyp-0.10.3.tgz
 - :x: **tar-4.4.6.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: 2021-08-31
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2021-37712>CVE-2021-37712</a>




### CVSS 3 Score Details (8.2)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Local
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: Required
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: None

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p">https://github.com/npm/node-tar/security/advisories/GHSA-qq89-hq3f-393p</a>
Release Date: 2021-08-31
Fix Resolution (tar): 4.4.18
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> WS-2019-0333</summary>


### Vulnerable Library - handlebars-4.0.12.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: <a href="https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz">https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz</a>
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - :x: **handlebars-4.0.12.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
In handlebars, versions prior to v4.5.3 are vulnerable to prototype pollution. Using a malicious template it's possbile to add or modify properties to the Object prototype. This can also lead to DOS and RCE in certain conditions.

Publish Date: 2019-11-18
URL: <a href=https://github.com/wycats/handlebars.js/commit/f7f05d7558e674856686b62a00cde5758f3b7a08>WS-2019-0333</a>




### CVSS 3 Score Details (8.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: High
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://www.npmjs.com/advisories/1325">https://www.npmjs.com/advisories/1325</a>
Release Date: 2019-11-18
Fix Resolution (handlebars): 4.5.3
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2019-20920</summary>


### Vulnerable Library - handlebars-4.0.12.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: <a href="https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz">https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz</a>
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - :x: **handlebars-4.0.12.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
Handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript. This can be used to run arbitrary code on a server processing Handlebars templates or in a victim's browser (effectively serving as XSS).

Publish Date: 2020-09-30
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2019-20920>CVE-2019-20920</a>




### CVSS 3 Score Details (8.1)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: High
 - Privileges Required: None
 - User Interaction: None
 - Scope: Changed
- Impact Metrics:
 - Confidentiality Impact: High
 - Integrity Impact: Low
 - Availability Impact: Low

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://www.npmjs.com/advisories/1316">https://www.npmjs.com/advisories/1316</a>
Release Date: 2020-10-15
Fix Resolution (handlebars): 4.5.3
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> WS-2019-0493</summary>


### Vulnerable Library - handlebars-4.0.12.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: <a href="https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz">https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz</a>
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - :x: **handlebars-4.0.12.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
handlebars before 3.0.8 and 4.x before 4.5.2 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.

Publish Date: 2019-11-14
URL: <a href=https://github.com/handlebars-lang/handlebars.js/commit/d54137810a49939fd2ad01a91a34e182ece4528e>WS-2019-0493</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://www.npmjs.com/advisories/1316">https://www.npmjs.com/advisories/1316</a>
Release Date: 2019-11-14
Fix Resolution (handlebars): 4.5.2
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> WS-2019-0492</summary>


### Vulnerable Library - handlebars-4.0.12.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: <a href="https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz">https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz</a>
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - :x: **handlebars-4.0.12.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
handlebars before 3.0.8 and 4.x before 4.5.3 is vulnerable to Arbitrary Code Execution. The package's lookup helper fails to properly validate templates, allowing attackers to submit templates that execute arbitrary JavaScript in the system.

Publish Date: 2019-11-19
URL: <a href=https://github.com/handlebars-lang/handlebars.js/commit/198887808780bbef9dba67a8af68ece091d5baa7>WS-2019-0492</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://www.npmjs.com/advisories/1324">https://www.npmjs.com/advisories/1324</a>
Release Date: 2019-11-19
Fix Resolution (handlebars): 4.5.3
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> WS-2019-0318</summary>


### Vulnerable Library - handlebars-4.0.12.tgz

Handlebars provides the power necessary to let you build semantic templates effectively with no frustration
Library home page: <a href="https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz">https://registry.npmjs.org/handlebars/-/handlebars-4.0.12.tgz</a>
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - :x: **handlebars-4.0.12.tgz** (Vulnerable Library)
Found in base branch: main




### Vulnerability Details
 
 
In "showdownjs/showdown", versions prior to v4.4.5 are vulnerable against Regular expression Denial of Service (ReDOS) once receiving specially-crafted templates.

Publish Date: 2019-10-20
URL: <a href=https://github.com/wycats/handlebars.js/commit/8d5530ee2c3ea9f0aee3fde310b9f36887d00b8b>WS-2019-0318</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Origin: <a href="https://www.npmjs.com/advisories/1300">https://www.npmjs.com/advisories/1300</a>
Release Date: 2019-10-20
Fix Resolution (handlebars): 4.4.5
Direct dependency fix Resolution (bull-arena): 2.5.0






:rescue_worker_helmet: Automatic Remediation will be attempted for this issue.
</details><details>

<summary><img src='https://whitesource-resources.whitesourcesoftware.com/high_vul.png?' width=19 height=20> CVE-2024-4068</summary>


### Vulnerable Libraries - braces-2.3.2.tgz, braces-1.8.5.tgz



### braces-2.3.2.tgz

Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.
Library home page: <a href="https://registry.npmjs.org/braces/-/braces-2.3.2.tgz">https://registry.npmjs.org/braces/-/braces-2.3.2.tgz</a>
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/sane/node_modules/braces/package.json,/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/sane/node_modules/braces/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/readdirp/node_modules/braces/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/readdirp/node_modules/braces/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - nodemon-1.18.4.tgz
 - chokidar-2.0.4.tgz
 - :x: **braces-2.3.2.tgz** (Vulnerable Library)


### braces-1.8.5.tgz

Fastest brace expansion for node.js, with the most complete support for the Bash 4.3 braces specification.
Library home page: <a href="https://registry.npmjs.org/braces/-/braces-1.8.5.tgz">https://registry.npmjs.org/braces/-/braces-1.8.5.tgz</a>
Path to dependency file: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/pnpm/lockfile_only_change/package.json
Path to vulnerable library: /updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/pnpm/lockfile_only_change/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/lockfile_only_change/node_modules/braces/package.json,/npm_and_yarn/spec/fixtures/projects/pnpm/lockfile_only_change/package.json,/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/braces/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/lockfile_only_change/node_modules/braces/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn_berry/lockfile_only_change/node_modules/braces/package.json,/updater/vendor/cache/npm_and_yarn/helpers/node_modules/braces/package.json,/updater/vendor/cache/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/spec/fixtures/projects/yarn/github_dependency_slash/package.json,/npm_and_yarn/helpers/node_modules/braces/package.json


Dependency Hierarchy:
 - bull-arena-2.4.5.tgz (Root Library)
 - handlebars-helpers-0.8.4.tgz
 - micromatch-2.3.11.tgz
 - :x: **braces-1.8.5.tgz** (Vulnerable Library)


Found in base branch: main




### Vulnerability Details
 
 
The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.

Publish Date: 2024-05-13
URL: <a href=https://www.mend.io/vulnerability-database/CVE-2024-4068>CVE-2024-4068</a>




### CVSS 3 Score Details (7.5)


Base Score Metrics:
- Exploitability Metrics:
 - Attack Vector: Network
 - Attack Complexity: Low
 - Privileges Required: None
 - User Interaction: None
 - Scope: Unchanged
- Impact Metrics:
 - Confidentiality Impact: None
 - Integrity Impact: None
 - Availability Impact: High

For more information on CVSS3 Scores, click <a href="https://www.first.org/cvss/calculator/3.0">here</a>.




### Suggested Fix


Type: Upgrade version
Release Date: 2024-05-13
Fix Resolution: braces - 3.0.3





</details>

***

:rescue_worker_helmet:Automatic Remediation will be attempted for this issue.

CVE	Severity	CVSS	Dependency	Type	Fixed in (bull-arena version)	Remediation Possible**
WS-2022-0280	Critical	9.8	moment-timezone-0.5.21.tgz	Transitive	2.5.0	✅
WS-2018-0211	Critical	9.8	detected in multiple dependencies	Transitive	2.5.0	✅
CVE-2022-37598	Critical	9.8	uglify-js-3.4.9.tgz	Transitive	2.5.0	✅
CVE-2021-44906	Critical	9.8	detected in multiple dependencies	Transitive	2.5.0	✅
CVE-2019-19919	Critical	9.8	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
CVE-2019-10747	Critical	9.8	detected in multiple dependencies	Transitive	2.5.0	✅
CVE-2019-10746	Critical	9.8	mixin-deep-1.3.1.tgz	Transitive	2.5.0	✅
WS-2022-0284	Critical	9.1	moment-timezone-0.5.21.tgz	Transitive	2.5.0	✅
WS-2018-0627	Critical	9.1	flatmap-stream-0.1.1.tgz	Transitive	2.5.0	✅
CVE-2019-10744	Critical	9.1	lodash-4.17.11.tgz	Transitive	2.5.0	✅
CVE-2021-32820	High	8.6	express-handlebars-3.0.0.tgz	Transitive	2.8.2	✅
CVE-2021-37712	High	8.2	tar-4.4.6.tgz	Transitive	2.5.0	✅
WS-2019-0333	High	8.1	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
CVE-2019-20920	High	8.1	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
WS-2019-0493	High	7.5	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
WS-2019-0492	High	7.5	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
WS-2019-0318	High	7.5	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
CVE-2024-4068	High	7.5	detected in multiple dependencies	Transitive	N/A*	❌
CVE-2022-38900	High	7.5	decode-uri-component-0.2.0.tgz	Transitive	2.5.0	❌
CVE-2022-3517	High	7.5	minimatch-3.0.4.tgz	Transitive	N/A*	❌
CVE-2022-31129	High	7.5	moment-2.22.2.tgz	Transitive	2.5.0	✅
CVE-2022-24999	High	7.5	qs-6.5.2.tgz	Transitive	2.5.0	✅
CVE-2022-24785	High	7.5	moment-2.22.2.tgz	Transitive	2.5.0	✅
CVE-2021-3807	High	7.5	ansi-regex-3.0.0.tgz	Transitive	2.5.0	✅
CVE-2019-20922	High	7.5	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
CVE-2019-20149	High	7.5	kind-of-6.0.2.tgz	Transitive	2.5.0	✅
CVE-2019-12041	High	7.5	remarkable-1.7.1.tgz	Transitive	2.5.0	✅
CVE-2017-16116	High	7.5	underscore.string-2.4.0.tgz	Transitive	N/A*	❌
CVE-2020-8203	High	7.4	lodash-4.17.11.tgz	Transitive	2.5.0	✅
WS-2019-0064	High	7.3	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
CVE-2020-8116	High	7.3	dot-prop-4.2.0.tgz	Transitive	2.5.0	✅
CVE-2019-10795	Medium	6.3	undefsafe-2.0.2.tgz	Transitive	2.5.0	✅
WS-2017-3770	Medium	6.1	autolinker-0.15.3.tgz	Transitive	3.7.0	✅
CVE-2019-12043	Medium	6.1	remarkable-1.7.1.tgz	Transitive	2.5.0	✅
WS-2019-0103	Medium	5.6	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
CVE-2021-23369	Medium	5.6	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
CVE-2020-7598	Medium	5.6	detected in multiple dependencies	Transitive	2.5.0	✅
WS-2019-0540	Medium	5.3	autolinker-0.15.3.tgz	Transitive	3.7.0	✅
CVE-2022-33987	Medium	5.3	got-6.7.1.tgz	Transitive	2.8.2	✅
CVE-2021-29469	Medium	5.3	redis-2.8.0.tgz	Transitive	2.5.0	✅
CVE-2020-28500	Medium	5.3	lodash-4.17.11.tgz	Transitive	2.5.0	✅
WS-2019-0332	Medium	5.0	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
WS-2019-0331	Medium	5.0	handlebars-4.0.12.tgz	Transitive	2.5.0	✅
CVE-2024-10491	Medium	4.0	express-4.16.4.tgz	Transitive	N/A*	❌
CVE-2021-23358	Low	3.3	underscore-1.7.0.tgz	Transitive	2.5.0	✅

bull-arena-2.4.5.tgz: 45 vulnerabilities (highest severity is: 9.8) #54

Description

Vulnerabilities

Details

Vulnerable Library - moment-timezone-0.5.21.tgz

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Libraries - event-stream-3.3.6.tgz, flatmap-stream-0.1.1.tgz

event-stream-3.3.6.tgz

flatmap-stream-0.1.1.tgz

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - uglify-js-3.4.9.tgz

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Libraries - minimist-1.2.0.tgz, minimist-0.0.10.tgz, minimist-0.0.8.tgz

minimist-1.2.0.tgz

minimist-0.0.10.tgz

minimist-0.0.8.tgz

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - handlebars-4.0.12.tgz

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Libraries - set-value-0.4.3.tgz, set-value-2.0.0.tgz

set-value-0.4.3.tgz

set-value-2.0.0.tgz

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - mixin-deep-1.3.1.tgz

Vulnerability Details

CVSS 3 Score Details (9.8)

Suggested Fix

Vulnerable Library - moment-timezone-0.5.21.tgz

Vulnerability Details

CVSS 3 Score Details (9.1)

Suggested Fix

Vulnerable Library - flatmap-stream-0.1.1.tgz

Vulnerability Details

CVSS 3 Score Details (9.1)

Suggested Fix

Vulnerable Library - lodash-4.17.11.tgz

Vulnerability Details

CVSS 3 Score Details (9.1)

Suggested Fix

Vulnerable Library - express-handlebars-3.0.0.tgz

Vulnerability Details

CVSS 3 Score Details (8.6)

Suggested Fix

Vulnerable Library - tar-4.4.6.tgz

Vulnerability Details

CVSS 3 Score Details (8.2)

Suggested Fix

Vulnerable Library - handlebars-4.0.12.tgz

Vulnerability Details

CVSS 3 Score Details (8.1)

Suggested Fix

Vulnerable Library - handlebars-4.0.12.tgz

Vulnerability Details

CVSS 3 Score Details (8.1)

Suggested Fix

Vulnerable Library - handlebars-4.0.12.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - handlebars-4.0.12.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Library - handlebars-4.0.12.tgz

Vulnerability Details

CVSS 3 Score Details (7.5)

Suggested Fix

Vulnerable Libraries - braces-2.3.2.tgz, braces-1.8.5.tgz