Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.
LösungUpgrade to version 1.4.1, 2.0.3 or above.
IdentifikatorenDetailsScanner:
GemnasiumVulnerable Package:
loader-utils:2.0.2Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.
LösungUpgrade to version 1.4.1, 2.0.3 or above.
IdentifikatorenDetailsScanner:
GemnasiumVulnerable Package:
loader-utils:1.4.0A vulnerability exists in Async through 3.2.1 (fixed in 3.2.2), which could let a malicious user obtain privileges via the mapValues() method.
LösungUpgrade to versions 2.6.4, 3.2.2 or above.
IdentifikatorenDetailsScanner:
GemnasiumVulnerable Package:
async:2.6.3A Regular Expression Denial of Service (ReDoS) flaw was found in kangax html-minifier 4.0.0 via the candidate variable in htmlminifier.js.
LösungUnfortunately, there is no solution available yet.
IdentifikatorenDetailsScanner:
GemnasiumVulnerable Package:
html-minifier:4.0.0The regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
LösungUpgrade to version 4.0.10 or above.
IdentifikatorenDetailsScanner:
GemnasiumVulnerable Package:
marked:3.0.8The regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
LösungUpgrade to version 4.0.10 or above.
IdentifikatorenDetailsScanner:
GemnasiumVulnerable Package:
marked:3.0.8Authorization Bypass Through User-Controlled Key in GitHub repository ionicabizau/parse-path prior to 5.0.0. parse-path is unable to detect the right resource. While parsing `http://127.0.0.1#@example.com` url, parse-path thinks that the host/resource is example.com, however the actual resource is 127.0.0.1.
LösungUpgrade to version 5.0.0 or above.
IdentifikatorenDetailsScanner:
GemnasiumVulnerable Package:
parse-path:4.0.3Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository ionicabizau/parse-url prior to 7.0.0.
LösungUpgrade to version 7.0.0 or above.
IdentifikatorenDetailsScanner:
GemnasiumVulnerable Package:
parse-url:6.0.0The package terser before 4.8.1, from 5.0.0 and before 5.14.2 is vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
LösungUpgrade to versions 4.8.1, 5.14.2 or above.
IdentifikatorenDetailsScanner:
GemnasiumVulnerable Package:
terser:4.8.0The package terser before 4.8.1, from 5.0.0 and before 5.14.2 is vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure usage of regular expressions.
LösungUpgrade to versions 4.8.1, 5.14.2 or above.
IdentifikatorenDetailsScanner:
GemnasiumVulnerable Package:
terser:5.12.1glob-parent before 6.0.1 and 5.1.2 is vulnerable to Regular Expression Denial of Service (ReDoS). This issue is fixed in version 6.0.1 and 5.1.2.
LösungUpgrade to versions 5.1.2, 6.0.1 or above.
IdentifikatorenDetailsScanner:
GemnasiumVulnerable Package:
glob-parent:3.1.0