devbox
花生_TL007
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

maven 漏洞扫描_idea中maven漏洞扫描

作者：花生_TL007 | 2024-04-15 11:51:48

赞

踩

idea中maven漏洞扫描

dependency-check-maven 插件

添加以下 Maven 插件，第一次 check 会很慢，因为需要下载漏洞包

  1.  
  2. <plugin>
  3.     <groupId>org.owasp</groupId>
  4.     <artifactId>dependency-check-maven</artifactId>
  5.     <version>9.0.9</version>
  6.     <configuration>
  7.         <autoUpdate>true</autoUpdate>
  8.     </configuration>
  9.     <executions>
  10.         <execution>
  11.             <goals>
  12.                 <goal>check</goal>
  13.             </goals>
  14.         </execution>
  15.     </executions>
  16. </plugin>

将以下 jsrepository.json 文件粘贴到 maven 仓库依赖目录下 dependency-check-data/9.0 和 dependency-check-utils/9.0.9 中

在右侧maven 插件 点击 check 后，运行完毕，在项目 target 会出现 dependency-check-report.html 报告

  1.       
  2. {
  3. 	"retire-example": {
  4. 		"vulnerabilities" : [
  5. 			{
  6. 				"below" : "0.0.2",
  7. 				"severity" : "low",
  8. 				"identifiers" : {
  9. 					"CVE" : [ "CVE-XXXX-XXXX" ],
  10. 					"bug" : "1234",
  11. 					"summary" : "bug summary"
  12. 				},
  13. 				"info" : [ "http://github.com/eoftedal/retire.js/" ]
  14. 			}
  15. 		],
  16. 		"extractors" : {
  17. 			"func" : [ "retire.VERSION" ],
  18. 			"filename" : [ "retire-example-(§§version§§)(.min)?\\.js" ],
  19. 			"filecontent"	: [ "/\\*!? Retire-example v(§§version§§)" ],
  20. 			"hashes" : { "07f8b94c8d601a24a1914a1a92bec0e4fafda964" : "0.0.1" }
  21. 		}
  22. 	},
  23.  
  24. 	"jquery": {
  25. 		"bowername": [ "jQuery" ],
  26. 		"vulnerabilities" : [
  27. 			{
  28. 				"below" : "1.6.3",
  29. 				"severity" : "medium",
  30. 				"identifiers" : {
  31. 					"CVE": [ "CVE-2011-4969" ],
  32. 					"summary": "XSS with location.hash"
  33. 				},
  34. 				"info" : [ "https://nvd.nist.gov/vuln/detail/CVE-2011-4969" , "http://research.insecurelabs.org/jquery/test/", "https://bugs.jquery.com/ticket/9521" ]
  35. 			},
  36. 			{
  37. 				"below" : "1.9.0b1",
  38. 				"identifiers": {
  39. 					"CVE" : [ "CVE-2012-6708" ],
  40. 					"bug": "11290",
  41. 					"summary": "Selector interpreted as HTML"
  42. 				},
  43. 				"severity": "medium",
  44. 				"info" : [ "http://bugs.jquery.com/ticket/11290" , "https://nvd.nist.gov/vuln/detail/CVE-2012-6708", "http://research.insecurelabs.org/jquery/test/" ]
  45. 			},
  46. 			{
  47. 				"atOrAbove" : "1.4.0",
  48. 				"below" : "1.12.0",
  49. 				"identifiers": {
  50. 					"issue" : "2432",
  51. 					"summary": "3rd party CORS request may execute",
  52. 				        "CVE": [ "CVE-2015-9251" ]
  53. 				},
  54. 				"severity": "medium",
  55. 				"info" : [ "https://github.com/jquery/jquery/issues/2432", "http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/", "https://nvd.nist.gov/vuln/detail/CVE-2015-9251", "http://research.insecurelabs.org/jquery/test/" ]
  56. 			},
  57. 			{
  58. 				"atOrAbove" : "1.12.3",
  59. 				"below" : "3.0.0-beta1",
  60. 				"identifiers": {
  61. 					"issue" : "2432",
  62. 					"summary": "3rd party CORS request may execute",
  63. 				        "CVE": [ "CVE-2015-9251" ]
  64. 				},
  65. 				"severity": "medium",
  66. 				"info" : [ "https://github.com/jquery/jquery/issues/2432", "http://blog.jquery.com/2016/01/08/jquery-2-2-and-1-12-released/", "https://nvd.nist.gov/vuln/detail/CVE-2015-9251", "http://research.insecurelabs.org/jquery/test/" ]
  67. 			},
  68. 			{
  69. 				"atOrAbove" : "1.8.0",
  70. 				"below" : "1.12.0",
  71. 				"identifiers": {
  72. 					"CVE" : [ "CVE-2015-9251" ],
  73. 					"issue" : "11974",
  74. 					"summary": "parseHTML() executes scripts in event handlers"
  75. 				},
  76. 				"severity": "medium",
  77. 				"info" : [ "https://bugs.jquery.com/ticket/11974", "https://nvd.nist.gov/vuln/detail/CVE-2015-9251", "http://research.insecurelabs.org/jquery/test/" ]
  78. 			},
  79. 			{
  80. 				"atOrAbove" : "1.12.2",
  81. 				"below" : "2.2.0",
  82. 				"identifiers": {
  83. 					"CVE" : [ "CVE-2015-9251" ],
  84. 					"issue" : "11974",
  85. 					"summary": "parseHTML() executes scripts in event handlers"
  86. 				},
  87. 				"severity": "medium",
  88. 				"info" : [ "https://bugs.jquery.com/ticket/11974", "https://nvd.nist.gov/vuln/detail/CVE-2015-9251", "http://research.insecurelabs.org/jquery/test/" ]
  89. 			},
  90. 			{
  91. 				"atOrAbove" : "2.2.2",
  92. 				"below" : "3.0.0",
  93. 				"identifiers": {
  94. 					"CVE" : [ "CVE-2015-9251" ],
  95. 					"issue" : "11974",
  96. 					"summary": "parseHTML() executes scripts in event handlers"
  97. 				},
  98. 				"severity": "medium",
  99. 				"info" : [ "https://bugs.jquery.com/ticket/11974", "https://nvd.nist.gov/vuln/detail/CVE-2015-9251", "http://research.insecurelabs.org/jquery/test/" ]
  100. 			},
  101. 			{
  102. 				"below" : "3.4.0",
  103. 				"identifiers": {
  104. 					"CVE" : [ "CVE-2019-11358" ],
  105. 					"summary": "jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution"
  106. 				},
  107. 				"severity" : "low",
  108. 				"info" : [ "https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/", "https://nvd.nist.gov/vuln/detail/CVE-2019-11358", "https://github.com/jquery/jquery/commit/753d591aea698e57d6db58c9f722cd0808619b1b" ]
  109. 			},
  110. 			{
  111. 				"below" : "3.5.0",
  112. 				"identifiers": {
  113. 					"CVE": [ "CVE-2020-11022" ],
  114. 					"summary": "Regex in its jQuery.htmlPrefilter sometimes may introduce XSS"
  115. 				},
  116. 				"severity" : "medium",
  117. 				"info" : [ "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" ]
  118. 			},
  119. 			{
  120. 				"below" : "3.5.0",
  121. 				"identifiers": {
  122. 					"CVE": [ "CVE-2020-11023" ],
  123. 					"summary": "Regex in its jQuery.htmlPrefilter sometimes may introduce XSS"
  124. 				},
  125. 				"severity" : "medium",
  126. 				"info" : [ "https://blog.jquery.com/2020/04/10/jquery-3-5-0-released/" ]
  127. 			}	
  128. 		],
  129. 		"extractors" : {
  130. 			"func"    		: [
  131. 								"(window.jQuery || window.$ || window.$jq || window.$j).fn.jquery",
  132. 								"require('jquery').fn.jquery"
  133. 			],
  134. 			"uri"			: [ "/(§§version§§)/jquery(\\.min)?\\.js" ],
  135. 			"filename"		: [ "jquery-(§§version§§)(\\.min)?\\.js" ],
  136. 			"filecontent"	: [
  137. 								"/\\*!? jQuery v(§§version§§)", "\\* jQuery JavaScript Library v(§§version§§)",
  138. 								"\\* jQuery (§§version§§) - New Wave Javascript", "// \\$Id: jquery.js,v (§§version§§)",
  139. 								"/\\*! jQuery v(§§version§§)",
  140.                 "[^a-z]f=\"(§§version§§)\",.*[^a-z]jquery:f,",
  141.                 "[^a-z]m=\"(§§version§§)\",.*[^a-z]jquery:m,",
  142.                 "[^a-z.]jquery:[ ]?\"(§§version§§)\"",
  143.                 "\\$\\.documentElement,Q=e.jQuery,Z=e\\.\\$,ee=\\{\\},te=\\[\\],ne=\"(§§version§§)\""
  144. 			],
  145. 			"filecontentreplace" : [
  146. 				"/var [a-z]=[a-z]\\.document,([a-z])=\"(§§version§§)\",([a-z])=.{130,160};\\3\\.fn=\\3\\.prototype=\\{jquery:\\1/$2/"
  147. 			],
  148. 			"hashes"		: {}
  149. 		}
  150. 	},
  151. 	"jquery-migrate" : {
  152. 		"vulnerabilities" : [
  153. 			{
  154. 				"below" : "1.2.0",
  155. 				"severity": "medium",
  156. 				"identifiers": {
  157. 					"release": "jQuery Migrate 1.2.0 Released",
  158. 					"summary": "cross-site-scripting"
  159. 				},
  160. 				"info" : [ "http://blog.jquery.com/2013/05/01/jquery-migrate-1-2-0-released/" ]
  161. 			},
  162. 			{
  163. 				"below" : "1.2.2",
  164. 				"severity": "medium",
  165. 				"identifiers": {
  166. 					"bug": "11290",
  167. 					"summary": "Selector interpreted as HTML"
  168. 				},
  169. 				"info" : [ "http://bugs.jquery.com/ticket/11290" , "http://research.insecurelabs.org/jquery/test/" ]
  170. 			}
  171. 		],
  172. 		"extractors" : {
  173. 			"filename"		: [ "jquery-migrate-(§§version§§)(.min)?\\.js" ],
  174. 			"filecontent"	: [ "/\\*!?(?:\n \\*)? jQuery Migrate(?: -)? v(§§version§§)" ],
  175. 			"hashes"		: {}
  176. 		}
  177. 	},
  178. 	"jquery.validator" : {
  179. 		"bowername": [ "jquery-validator" ],
  180. 		"vulnerabilities" : [
  181. 		],
  182. 		"extractors" : {
  183. 			"func"    		: [ "jQuery.validation.version" ],
  184. 			"filename"		: [ "jquery.validation-(§§version§§)(.min)?\\.js" ],
  185. 			"uri"			: [ "/(§§version§§)/jquery.validation(\\.min)?\\.js" ],
  186. 			"filecontent"	: [ "/\\*!?(?:\n \\*)? jQuery Validation Plugin v(§§version§§)" ],
  187. 			"hashes"		: {}
  188. 		}
  189. 	},
  190. 	"jquery-mobile" : {
  191. 		"bowername": [ "jquery-mobile", "jquery-mobile-min", "jquery-mobile-build", "jquery-mobile-dist", "jquery-mobile-bower" ],
  192. 		"vulnerabilities" : [
  193. 			{
  194. 				"below" : "1.0RC2",
  195. 				"severity": "high",
  196. 				"identifiers": {"osvdb": ["94563", "93562", "94316", "94561", "94560"]},
  197. 				"info" : [ "http://osvdb.org/show/osvdb/94563", "http://osvdb.org/show/osvdb/94562", "http://osvdb.org/show/osvdb/94316", "http://osvdb.org/show/osvdb/94561", "http://osvdb.org/show/osvdb/94560" ]
  198. 			},
  199. 			{
  200. 				"below" : "1.0.1",
  201. 				"severity": "high",
  202. 				"identifiers": {"osvdb": ["94317"]},
  203. 				"info": [ "http://osvdb.org/show/osvdb/94317" ]
  204. 			},
  205. 			{
  206. 				"below" : "1.1.2",
  207. 				"severity": "medium",
  208. 				"identifiers": {
  209. 					"issue": "4787",
  210. 					"release": "http://jquerymobile.com/changelog/1.1.2/",
  211. 					"summary": "location.href cross-site scripting"
  212. 				},
  213. 				"info": [ "http://jquerymobile.com/changelog/1.1.2/", "https://github.com/jquery/jquery-mobile/issues/4787" ]
  214. 			},
  215. 			{
  216. 				"below" : "1.2.0",
  217. 				"severity": "medium",
  218. 				"identifiers": {
  219. 					"issue": "4787",
  220. 					"release": "http://jquerymobile.com/changelog/1.2.0/",
  221. 					"summary": "location.href cross-site scripting"
  222. 				},
  223. 				"info": [ "http://jquerymobile.com/changelog/1.2.0/", "https://github.com/jquery/jquery-mobile/issues/4787" ]
  224. 			},
  225. 			{
  226. 				"below" : "100.0.0",
  227. 				"severity": "medium",
  228. 				"identifiers": {
  229. 					"summary": "open redirect leads to cross site scripting"
  230. 				},
  231. 				"info": [ "http://sirdarckcat.blogspot.no/2017/02/unpatched-0day-jquery-mobile-xss.html" ]
  232. 			},
  233. 			{
  234. 				"below" : "1.3.0",
  235. 				"severity": "high",
  236. 				"identifiers": {
  237. 					"summary": "Endpoint that reflect user input leads to cross site scripting"
  238. 				},
  239. 				"info": [ "https://gist.github.com/jupenur/e5d0c6f9b58aa81860bf74e010cf1685" ]
  240. 			}
  241. 		],
  242. 		"extractors" : {
  243. 			"func"    		: [ "jQuery.mobile.version" ],
  244. 			"filename"		: [ "jquery.mobile-(§§version§§)(.min)?\\.js" ],
  245. 			"uri"			: [ "/(§§version§§)/jquery.mobile(\\.min)?\\.js" ],
  246. 			"filecontent"	: [ "/\\*!?(?:\n \\*)? jQuery Mobile(?: -)? v(§§version§§)" ],
  247. 			"hashes"		: {}
  248. 		}
  249. 	},
  250. 	"jquery-ui-dialog" : {
  251. 		"bowername": [ "jquery-ui", "jquery.ui" ],
  252. 		"vulnerabilities" : [
  253. 			{
  254. 				"atOrAbove": "1.8.9",
  255. 				"below" : "1.10.0",
  256. 				"severity": "medium",
  257. 				"identifiers": {
  258. 					"CVE": [ "CVE-2010-5312" ],
  259. 					"bug": "6016",
  260. 					"summary": "Title cross-site scripting vulnerability"
  261. 				},
  262. 				"info" : [ "http://bugs.jqueryui.com/ticket/6016", "https://nvd.nist.gov/vuln/detail/CVE-2010-5312" ]
  263. 			},
  264. 			{
  265. 				"below" : "1.12.0",
  266. 				"severity": "high",
  267. 				"identifiers": {
  268. 					"CVE": [ "CVE-2016-7103" ],
  269. 					"bug": "281",
  270. 					"summary": "XSS Vulnerability on closeText option"
  271. 				},
  272. 				"info" : [ "https://github.com/jquery/api.jqueryui.com/issues/281", "https://nvd.nist.gov/vuln/detail/CVE-2016-7103", "https://snyk.io/vuln/npm:jquery-ui:20160721" ]
  273. 			}
  274. 		],
  275. 		"extractors" : {
  276. 			"func"    		: [ "jQuery.ui.dialog.version" ],
  277. 			"filecontent"	: [
  278. 				"/\\*!? jQuery UI - v(§§version§§)(.*\n){1,3}.*jquery\\.ui\\.dialog\\.js",
  279. 				"/\\*!?[\n *]+jQuery UI (§§version§§)(.*\n)*.*\\.ui\\.dialog",
  280. 				"/\\*!?[\n *]+jQuery UI Dialog (§§version§§)",
  281. 				"/\\*!? jQuery UI - v(§§version§§)(.*\n){1,3}\\* Includes: .* dialog\\.js"
  282. 			],
  283. 			"hashes"		: {}
  284. 		}
  285. 	},
  286. 	"jquery-ui-autocomplete" : {
  287. 		"bowername": [ "jquery-ui", "jquery.ui" ],
  288. 		"vulnerabilities" : [ ],
  289. 		"extractors" : {
  290. 			"func"    		: [ "jQuery.ui.autocomplete.version" ],
  291. 			"filecontent"	: [
  292. 				"/\\*!? jQuery UI - v(§§version§§)(.*\n){1,3}.*jquery\\.ui\\.autocomplete\\.js",
  293. 				"/\\*!?[\n *]+jQuery UI (§§version§§)(.*\n)*.*\\.ui\\.autocomplete",
  294. 				"/\\*!?[\n *]+jQuery UI Autocomplete (§§version§§)",
  295. 				"/\\*!? jQuery UI - v(§§version§§)(.*\n){1,3}\\* Includes: .* autocomplete\\.js"
  296. 			],
  297. 			"hashes"		: {}
  298. 		}
  299. 	},
  300. 	"jquery-ui-tooltip" : {
  301. 		"bowername": [ "jquery-ui", "jquery.ui" ],
  302. 		"vulnerabilities" : [
  303. 			{
  304. 				"atOrAbove": "1.9.2",
  305. 				"below" : "1.10.0",
  306. 				"severity": "high",
  307. 				"identifiers": {
  308. 					"CVE" : [ "CVE-2012-6662" ],
  309. 					"bug": "8859",
  310. 					"summary": "Autocomplete cross-site scripting vulnerability"
  311. 				},
  312. 				"info" : [ "http://bugs.jqueryui.com/ticket/8859", "https://nvd.nist.gov/vuln/detail/CVE-2012-6662" ]
  313. 			}
  314. 		],
  315. 		"extractors" : {
  316. 			"func"    		: [ "jQuery.ui.tooltip.version" ],
  317. 			"filecontent"	: [
  318. 				"/\\*!? jQuery UI - v(§§version§§)(.*\n){1,3}.*jquery\\.ui\\.tooltip\\.js",
  319. 				"/\\*!?[\n *]+jQuery UI (§§version§§)(.*\n)*.*\\.ui\\.tooltip",
  320. 				"/\\*!?[\n *]+jQuery UI Tooltip (§§version§§)"
  321. 			],
  322. 			"hashes"		: {}
  323. 		}
  324. 	},
  325. 	"jquery.prettyPhoto" : {
  326. 		"bowername": [ "jquery-prettyPhoto" ],
  327. 		"vulnerabilities" : [
  328. 			{
  329. 				"below" : "3.1.5",
  330. 				"severity" : "high",
  331. 				"identifiers" : { "CVE" : [ "CVE-2013-6837" ] },
  332. 				"info" : [ "https://nvd.nist.gov/vuln/detail/CVE-2013-6837" ]
  333. 			},
  334. 			{
  335. 				"below" : "3.1.6",
  336. 				"severity" : "high",
  337. 				"info" : [ "https://github.com/scaron/prettyphoto/issues/149", "https://blog.anantshri.info/forgotten_disclosure_dom_xss_prettyphoto" ]
  338. 			}
  339.  
  340. 		],
  341. 		"extractors" : {
  342. 			"func"    		: [ "jQuery.prettyPhoto.version" ],
  343. 			"filecontent"	: [
  344. 				"/\\*(?:.*[\n\r]+){1,3}.*Class: prettyPhoto(?:.*[\n\r]+){1,3}.*Version: (§§version§§)",
  345. 				"\\.prettyPhoto[ ]?=[ ]?\\{version:[ ]?(?:'|\")(§§version§§)(?:'|\")\\}"
  346. 			],
  347. 			"hashes"		: {}
  348. 		}
  349. 	},
  350. 	"jPlayer" : {
  351. 		"bowername": [ "jPlayer" ],
  352. 		"vulnerabilities" : [
  353. 			{
  354. 				"below" : "2.3.1",
  355. 				"severity": "high",
  356. 				"identifiers": {
  357. 					"CVE": [ "CVE-2013-2023" ],
  358. 					"release" : "2.3.1",
  359. 					"summary" : "XSS vulnerability in actionscript/Jplayer.as in the Flash SWF component" },
  360. 				"info" : [ "http://jplayer.org/latest/release-notes/", "https://nvd.nist.gov/vuln/detail/CVE-2013-2023" ]
  361. 			},
  362. 			{
  363. 				"below" : "2.3.23",
  364. 				"severity": "high",
  365. 				"identifiers": {
  366. 					"CVE": [ "CVE-2013-2022" ],
  367. 					"release": "2.3.23",
  368. 					"summary": "XSS vulnerabilities in actionscript/Jplayer.as in the Flash SWF component"
  369. 				},
  370. 				"info" : [ "http://jplayer.org/latest/release-notes/", "https://nvd.nist.gov/vuln/detail/CVE-2013-2022" ]
  371. 			},
  372. 			{
  373. 				"below" : "2.2.20",
  374. 				"severity": "high",
  375. 				"identifiers": {
  376. 					"CVE": [ "CVE-2013-1942" ],
  377. 					"release": "2.2.20",
  378. 					"summary": "XSS vulnerabilities in actionscript/Jplayer.as in the Flash SWF component"
  379. 				},
  380. 				"info" : [ "http://jplayer.org/latest/release-notes/", "https://nvd.nist.gov/vuln/detail/CVE-2013-1942" ]
  381. 			}
  382. 		],
  383. 		"extractors" : {
  384. 			"func"    		: [ "new jQuery.jPlayer().version.script" ],
  385. 			"filecontent"	: [
  386. 				"/\\*(?:.*[\n\r]+){1,3}.*jPlayer Plugin for jQuery(?:.*[\n\r]+){1,10}.*Version: (§§version§§)"
  387. 			],
  388. 			"hashes"		: {}
  389. 		}
  390. 	},
  391. 	"knockout": {
  392. 		"vulnerabilities" : [
  393. 			{
  394. 				"below" : "3.5.0-beta",
  395. 				"severity": "medium",
  396. 				"identifiers": {"summary": "XSS injection point in attr name binding for browser IE7 and older"},
  397. 				"info" : [ "https://github.com/knockout/knockout/issues/1244" ]
  398. 			}
  399. 		],
  400. 		"extractors" : {
  401. 			"func"    		: [ "ko.version" ],
  402. 			"filename"		: [ "knockout-(§§version§§)(.min)?\\.js"],
  403. 			"filecontent"	: [
  404. 				"\\* Knockout JavaScript library v(§§version§§)"
  405. 			],
  406. 			"hashes"		: {}
  407. 		}
  408. 	},
  409. 	"sessvars": {
  410. 		"vulnerabilities" : [
  411. 			{
  412. 				"below" : "1.01",
  413. 				"severity": "low",
  414. 				"identifiers": {"summary": "Unsanitized data passed to eval()"},
  415. 				"info" : [ "http://www.thomasfrank.se/sessionvars.html" ]
  416. 			}
  417. 		],
  418. 		"extractors" : {
  419. 			"filename"		: [ "sessvars-(§§version§§)(.min)?\\.js"],
  420. 			"filecontent"	: [ "sessvars ver (§§version§§)"],
  421. 			"hashes"		: {}
  422. 		}
  423. 	},
  424. 	"swfobject": {
  425. 		"bowername": [ "swfobject", "swfobject-bower" ],
  426. 		"vulnerabilities" : [
  427. 			{
  428. 				"below" : "2.1",
  429. 				"severity": "medium",
  430. 				"identifiers": {"summary": "DOM-based XSS"},
  431. 				"info" : [ "https://github.com/swfobject/swfobject/wiki/SWFObject-Release-Notes#swfobject-v21-beta7-june-6th-2008" ]
  432. 			}
  433. 		],
  434. 		"extractors" : {
  435. 			"filename"		: [ "swfobject_(§§version§§)(.min)?\\.js"],
  436. 			"filecontent"	: [ "SWFObject v(§§version§§) "],
  437. 			"hashes"		: {}
  438. 		}
  439. 	},
  441. 	"tinyMCE" : {
  442. 		"bowername": [ "tinymce", "tinymce-dist" ],
  443. 		"vulnerabilities" : [
  444. 			{
  445. 				"below" : "1.4.2",
  446. 				"severity" : "high",
  447. 				"identifiers" : {
  448. 					"summary" : "Static code injection vulnerability in inc/function.base.php",
  449. 					"CVE" : [ "CVE-2011-4825" ]
  450. 				},
  451. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2011-4825/" ]
  452. 			},
  453. 			{
  454. 				"below" : "4.2.4",
  455. 				"severity" : "medium",
  456. 				"identifiers" : { "summary" : "xss issues with media plugin not properly filtering out some script attributes." },
  457. 				"info" : [ "https://www.tinymce.com/docs/changelog/" ]
  459. 			},
  460. 			{
  461. 				"below" : "4.2.0",
  462. 				"severity" : "medium",
  463. 				"identifiers" : { "summary" : "FIXED so script elements gets removed by default to prevent possible XSS issues in default config implementations" },
  464. 				"info" : [ "https://www.tinymce.com/docs/changelog/" ]
  466. 			},
  467. 			{
  468. 				"below" : "4.7.12",
  469. 				"severity" : "medium",
  470. 				"identifiers" : { "summary" : "FIXED so links with xlink:href attributes are filtered correctly to prevent XSS." },
  471. 				"info" : [ "https://www.tinymce.com/docs/changelog/" ]
  473. 			}
  474. 		],
  475. 		"extractors" : {
  476. 			"filecontent"	     : [ "// (§§version§§) \\([0-9\\-]+\\)[\n\r]+.{0,1200}l=.tinymce/geom/Rect." ],
  477. 			"filecontentreplace" : [
  478. 										"/tinyMCEPreInit.*majorVersion:.([0-9]+).,minorVersion:.([0-9.]+)./$1.$2/",
  479. 										"/majorVersion:.([0-9]+).,minorVersion:.([0-9.]+).,.*tinyMCEPreInit/$1.$2/"
  480. 								   ],
  481. 			"func" 				 : [ "tinyMCE.majorVersion + '.'+ tinyMCE.minorVersion" ]
  482. 		}
  483. 	},
  485. 	"YUI" : {
  486. 		"bowername": [ "yui", "yui3" ],
  487. 		"vulnerabilities" : [
  488. 			{
  489. 				"atOrAbove" : "3.5.0" ,
  490. 				"below" : "3.9.2",
  491. 				"severity": "high",
  492. 				"identifiers": {"CVE": [ "CVE-2013-4942" ] },
  493. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2013-4942/" ]
  494. 			},
  495. 			{
  496. 				"atOrAbove" : "3.2.0" ,
  497. 				"below" : "3.9.2",
  498. 				"severity": "high",
  499. 				"identifiers": {"CVE": [ "CVE-2013-4941" ] },
  500. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2013-4941/" ]
  501. 			},
  502. 			{
  503. 				"atOrAbove" : "3.0.0",
  504. 				"below" : "3.10.3",
  505. 				"severity": "high",
  506. 				"identifiers": {"CVE": [ "CVE-2013-4940" ] },
  507. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2013-4940/" ]
  508. 			},
  509. 			{
  510. 				"atOrAbove" : "3.0.0" ,
  511. 				"below" : "3.9.2",
  512. 				"severity": "high",
  513. 				"identifiers": {"CVE": [ "CVE-2013-4939" ] },
  514. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2013-4939/" ]
  515. 			},
  516. 			{
  517. 				"atOrAbove" : "2.8.0" ,
  518. 				"below" : "2.9.1",
  519. 				"severity": "high",
  520. 				"identifiers": {"CVE": [ "CVE-2012-5883" ] },
  521. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2012-5883/" ]
  522. 			},
  523. 			{
  524. 				"atOrAbove" : "2.5.0" ,
  525. 				"below" : "2.9.1",
  526. 				"severity": "high",
  527. 				"identifiers": {"CVE": [ "CVE-2012-5882" ] },
  528. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2012-5882/" ]
  529. 			},
  530. 			{
  531. 				"atOrAbove" : "2.4.0" ,
  532. 				"below" : "2.9.1",
  533. 				"severity": "high",
  534. 				"identifiers": {"CVE": [ "CVE-2012-5881" ] },
  535. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2012-5881/" ]
  536. 			},
  537. 			{
  538. 				"below" : "2.9.0",
  539. 				"severity": "medium",
  540. 				"identifiers": {"CVE": [ "CVE-2010-4710" ] },
  541. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2010-4710/" ]
  542. 			},
  543. 			{
  544. 				"atOrAbove" : "2.8.0" ,
  545. 				"below" : "2.8.2",
  546. 				"severity": "high",
  547. 				"identifiers": {"CVE": [ "CVE-2010-4209" ] },
  548. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2010-4209/" ]
  549. 			},
  550. 			{
  551. 				"atOrAbove" : "2.5.0" ,
  552. 				"below" : "2.8.2",
  553. 				"severity": "high",
  554. 				"identifiers": {"CVE": [ "CVE-2010-4208" ] },
  555. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2010-4208/" ]
  556. 			},
  557. 			{
  558. 				"atOrAbove" : "2.4.0" ,
  559. 				"below" : "2.8.2",
  560. 				"severity": "high",
  561. 				"identifiers": {"CVE": [ "CVE-2010-4207" ] },
  562. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2010-4207/" ]
  563. 			}
  564. 		],
  565. 		"extractors" : {
  566. 			"func"    		: [ "YUI.Version", "YAHOO.VERSION" ],
  567. 			"filename"		: [ "yui-(§§version§§)(.min)?\\.js"],
  568. 			"filecontent"	: [ "/*\nYUI (§§version§§)", "/yui/license.(?:html|txt)\nversion: (§§version§§)"],
  569. 			"hashes"		: {}
  570. 		}
  571. 	},
  572. 	"prototypejs" : {
  573. 		"bowername": [ "prototypejs", "prototype.js", "prototypejs-bower" ],
  574. 		"vulnerabilities" : [
  575. 			{
  576. 				"atOrAbove" : "1.6.0",
  577. 				"below" : "1.6.0.2",
  578. 				"severity": "high",
  579. 				"identifiers": {"CVE": [ "CVE-2008-7220" ] },
  580. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2008-7220/", "http://prototypejs.org/2008/01/25/prototype-1-6-0-2-bug-fixes-performance-improvements-and-security/" ] },
  581. 			{
  582. 				"below" : "1.5.1.2",
  583. 				"severity": "high",
  584. 				"identifiers": {"CVE": [ "CVE-2008-7220" ] },
  585. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2008-7220/", "http://prototypejs.org/2008/01/25/prototype-1-6-0-2-bug-fixes-performance-improvements-and-security/" ] }
  586. 		],
  587. 		"extractors" : {
  588. 			"func"    		: [ "Prototype.Version" ],
  589. 			"uri"			: [ "/(§§version§§)/prototype(\\.min)?\\.js" ],
  590. 			"filename"		: [ "prototype-(§§version§§)(.min)?\\.js" ],
  591. 			"filecontent"	: [ "Prototype JavaScript framework, version (§§version§§)",
  592. 								"Prototype[ ]?=[ ]?\\{[ \r\n\t]*Version:[ ]?(?:'|\")(§§version§§)(?:'|\")" ],
  593. 			"hashes"		: {}
  594. 		}
  595. 	},
  596. 	"ember" : {
  597. 		"vulnerabilities" : [
  598. 			{
  599. 				"atOrAbove" : "1.8.0",
  600. 				"below" :"1.11.4",
  601. 				"severity" : "medium",
  602. 				"identifiers": {"CVE": [ "CVE-2015-7565" ] },
  603. 				"info": [ "https://groups.google.com/forum/#!topic/ember-security/OfyQkoSuppY" ]
  604. 			},
  605. 			{
  606. 				"atOrAbove" : "1.12.0",
  607. 				"below" :"1.12.2",
  608. 				"severity" : "medium",
  609. 				"identifiers": {"CVE": [ "CVE-2015-7565" ] },
  610. 				"info": [ "https://groups.google.com/forum/#!topic/ember-security/OfyQkoSuppY" ]
  611. 			},
  612. 			{
  613. 				"atOrAbove" : "1.13.0",
  614. 				"below" : "1.13.12",
  615. 				"severity" : "medium",
  616. 				"identifiers": {"CVE": [ "CVE-2015-7565" ] },
  617. 				"info": [ "https://groups.google.com/forum/#!topic/ember-security/OfyQkoSuppY" ]
  618. 			},
  619. 			{
  620. 				"atOrAbove" : "2.0.0",
  621. 				"below" : "2.0.3",
  622. 				"severity" : "medium",
  623. 				"identifiers": {"CVE": [ "CVE-2015-7565" ] },
  624. 				"info": [ "https://groups.google.com/forum/#!topic/ember-security/OfyQkoSuppY" ]
  625. 			},
  626. 			{
  627. 				"atOrAbove" : "2.1.0",
  628. 				"below" : "2.1.2",
  629. 				"severity" : "medium",
  630. 				"identifiers": {"CVE": [ "CVE-2015-7565" ] },
  631. 				"info": [ "https://groups.google.com/forum/#!topic/ember-security/OfyQkoSuppY" ]
  632. 			},
  633. 			{
  634. 				"atOrAbove" : "2.2.0",
  635. 				"below" : "2.2.1",
  636. 				"severity" : "medium",
  637. 				"identifiers": {"CVE": [ "CVE-2015-7565" ] },
  638. 				"info": [ "https://groups.google.com/forum/#!topic/ember-security/OfyQkoSuppY" ]
  639. 			},
  640. 			{
  641. 				"below" : "1.5.0",
  642. 				"severity": "medium",
  643. 				"identifiers": {
  644. 					"CVE": [ "CVE-2014-0046" ],
  645. 					"summary": "ember-routing-auto-location can be forced to redirect to another domain"
  646. 				},
  647. 				"info" : [ "https://github.com/emberjs/ember.js/blob/v1.5.0/CHANGELOG.md" ]
  648. 			},
  649. 			{
  650. 				"atOrAbove" : "1.3.0-*",
  651. 				"below" : "1.3.2",
  652. 				"severity": "medium",
  653. 				"identifiers": {"CVE": [ "CVE-2014-0046" ] },
  654. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ" ]
  655. 			},
  656. 			{
  657. 				"atOrAbove" : "1.2.0-*",
  658. 				"below" : "1.2.2",
  659. 				"severity": "medium",
  660. 				"identifiers": {"CVE": [ "CVE-2014-0046" ] },
  661. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ" ] },
  662. 			{
  663. 				"atOrAbove" : "1.4.0-*",
  664. 				"below" : "1.4.0-beta.2",
  665. 				"severity": "high",
  666. 				"identifiers": {"CVE": ["CVE-2014-0013", "CVE-2014-0014"]},
  667. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/2kpXXCxISS4", "https://groups.google.com/forum/#!topic/ember-security/PSE4RzTi6l4" ]
  668. 			},
  669. 			{
  670. 				"atOrAbove" : "1.3.0-*",
  671. 				"below" : "1.3.1",
  672. 				"severity": "high",
  673. 				"identifiers": {"CVE": ["CVE-2014-0013", "CVE-2014-0014"]},
  674. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/2kpXXCxISS4", "https://groups.google.com/forum/#!topic/ember-security/PSE4RzTi6l4" ]
  675. 			},
  676. 			{
  677. 				"atOrAbove" : "1.2.0-*",
  678. 				"below" : "1.2.1",
  679. 				"severity": "high",
  680. 				"identifiers": {"CVE": ["CVE-2014-0013", "CVE-2014-0014"]},
  681. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/2kpXXCxISS4", "https://groups.google.com/forum/#!topic/ember-security/PSE4RzTi6l4" ]
  682. 			},
  683. 			{
  684. 				"atOrAbove" : "1.1.0-*",
  685. 				"below" : "1.1.3",
  686. 				"severity": "high",
  687. 				"identifiers": {"CVE": ["CVE-2014-0013", "CVE-2014-0014"]},
  688. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/2kpXXCxISS4", "https://groups.google.com/forum/#!topic/ember-security/PSE4RzTi6l4" ]
  689. 			},
  690. 			{
  691. 				"atOrAbove" : "1.0.0-*",
  692. 				"below" : "1.0.1",
  693. 				"severity": "high",
  694. 				"identifiers": {"CVE": ["CVE-2014-0013", "CVE-2014-0014"]},
  695. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/2kpXXCxISS4", "https://groups.google.com/forum/#!topic/ember-security/PSE4RzTi6l4" ]
  696. 			},
  697. 			{
  698. 				"atOrAbove" : "1.0.0-rc.1",
  699. 				"below" : "1.0.0-rc.1.1",
  700. 				"severity": "medium",
  701. 				"identifiers": {"CVE": [ "CVE-2013-4170" ] },
  702. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
  703. 			},
  704. 			{
  705. 				"atOrAbove" : "1.0.0-rc.2",
  706. 				"below" : "1.0.0-rc.2.1",
  707. 				"severity": "medium",
  708. 				"identifiers": {"CVE": [ "CVE-2013-4170" ] },
  709. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
  710. 			},
  711. 			{
  712. 				"atOrAbove" : "1.0.0-rc.3",
  713. 				"below" : "1.0.0-rc.3.1",
  714. 				"severity": "medium",
  715. 				"identifiers": {"CVE": [ "CVE-2013-4170" ] },
  716. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
  717. 			},
  718. 			{
  719. 				"atOrAbove" : "1.0.0-rc.4",
  720. 				"below" : "1.0.0-rc.4.1",
  721. 				"severity": "medium",
  722. 				"identifiers": {"CVE": [ "CVE-2013-4170" ] },
  723. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
  724. 			},
  725. 			{
  726. 				"atOrAbove" : "1.0.0-rc.5",
  727. 				"below" : "1.0.0-rc.5.1",
  728. 				"severity": "medium",
  729. 				"identifiers": {"CVE": [ "CVE-2013-4170" ] },
  730. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
  731. 			},
  732. 			{
  733. 				"atOrAbove" : "1.0.0-rc.6",
  734. 				"below" : "1.0.0-rc.6.1",
  735. 				"severity": "medium",
  736. 				"identifiers": {"CVE": [ "CVE-2013-4170" ] },
  737. 				"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
  738. 			},
  739. 			{
  740. 				"below" : "0.9.7.1",
  741. 				"info" : [ "https://github.com/emberjs/ember.js/blob/master/CHANGELOG" ]
  742. 			},
  743. 			{
  744. 				"below" : "0.9.7",
  745. 				"severity": "high",
  746. 				"identifiers": {
  747. 					"bug": "699",
  748. 					"summary": "Bound attributes aren't escaped properly"
  749. 				},
  750. 				"info" : [ "https://github.com/emberjs/ember.js/issues/699" ]
  751. 			}
  752. 		],
  753. 		"extractors" : {
  754. 			"func"			: [ "Ember.VERSION" ],
  755. 			"uri"			: [ "/(?:v)?(§§version§§)/ember(\\.min)?\\.js" ],
  756. 			"filename"		: [ "ember-(§§version§§)(\\.min)?\\.js" ],
  757. 			"filecontent"	: [
  758. 				"Project:   Ember -(?:.*\n){9,11}// Version: v(§§version§§)",
  759. 				"// Version: v(§§version§§)(.*\n){10,15}(Ember Debug|@module ember|@class ember)",
  760. 				"Ember.VERSION[ ]?=[ ]?(?:'|\")(§§version§§)(?:'|\")"
  761. 			],
  762. 			"hashes"		: {}
  763. 		}
  764. 	},
  765. 	"dojo" : {
  766. 		"vulnerabilities" : [
  767. 			{
  768. 				"atOrAbove" : "0.4",
  769. 				"below" : "0.4.4",
  770. 				"severity": "high",
  771. 				"identifiers": {"CVE": ["CVE-2010-2276", "CVE-2010-2272"]},
  772. 				"info" : [ "http://dojotoolkit.org/blog/dojo-security-advisory", "http://www.cvedetails.com/cve/CVE-2010-2276/", "http://www.cvedetails.com/cve/CVE-2010-2272/" ]
  773. 			},
  774. 			{
  775. 				"atOrAbove" : "1.0",
  776. 				"below" : "1.0.3",
  777. 				"severity": "high",
  778. 				"identifiers": {"CVE": ["CVE-2010-2276", "CVE-2010-2274", "CVE-2010-2273"]},
  779. 				"info" : [ "http://dojotoolkit.org/blog/dojo-security-advisory", "http://www.cvedetails.com/cve/CVE-2010-2276/", "http://www.cvedetails.com/cve/CVE-2010-2274/", "http://www.cvedetails.com/cve/CVE-2010-2273/" ]
  780. 			},
  781. 			{
  782. 				"atOrAbove" : "1.1",
  783. 				"below" : "1.1.2",
  784. 				"severity": "high",
  785. 				"identifiers": {"CVE": ["CVE-2010-2276", "CVE-2010-2274", "CVE-2010-2273"]},
  786. 				"info" : [ "http://dojotoolkit.org/blog/dojo-security-advisory", "http://www.cvedetails.com/cve/CVE-2010-2276/", "http://www.cvedetails.com/cve/CVE-2010-2274/", "http://www.cvedetails.com/cve/CVE-2010-2273/" ]
  787. 			},
  788. 			{
  789. 				"atOrAbove" : "1.2",
  790. 				"below" : "1.2.4",
  791. 				"severity": "high",
  792. 				"identifiers": {"CVE": ["CVE-2010-2276", "CVE-2010-2274", "CVE-2010-2273"]},
  793. 				"info" : [ "http://dojotoolkit.org/blog/dojo-security-advisory", "http://www.cvedetails.com/cve/CVE-2010-2276/", "http://www.cvedetails.com/cve/CVE-2010-2274/", "http://www.cvedetails.com/cve/CVE-2010-2273/" ]
  794. 			},
  795. 			{
  796. 				"atOrAbove" : "1.3",
  797. 				"below" : "1.3.3",
  798. 				"severity": "high",
  799. 				"identifiers": {"CVE": ["CVE-2010-2276", "CVE-2010-2274", "CVE-2010-2273"]},
  800. 				"info" : [ "http://dojotoolkit.org/blog/dojo-security-advisory", "http://www.cvedetails.com/cve/CVE-2010-2276/", "http://www.cvedetails.com/cve/CVE-2010-2274/", "http://www.cvedetails.com/cve/CVE-2010-2273/" ]
  801. 			},
  802. 			{
  803. 				"atOrAbove" : "1.4",
  804. 				"below" : "1.4.2",
  805. 				"severity": "high",
  806. 				"identifiers": {"CVE": ["CVE-2010-2276", "CVE-2010-2274", "CVE-2010-2273"]},
  807. 				"info" : [ "http://dojotoolkit.org/blog/dojo-security-advisory", "http://www.cvedetails.com/cve/CVE-2010-2276/", "http://www.cvedetails.com/cve/CVE-2010-2274/", "http://www.cvedetails.com/cve/CVE-2010-2273/" ]
  808. 			},
  809. 			{
  810. 				"below" : "1.4.2",
  811. 				"severity": "medium",
  812. 				"identifiers": {"CVE": [ "CVE-2010-2275" ] },
  813. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2010-2275/"]
  814. 			},
  815. 			{
  816. 				"below" : "1.1",
  817. 				"severity": "medium",
  818. 				"identifiers": {"CVE": [ "CVE-2008-6681" ] },
  819. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2008-6681/"]
  820. 			},
  821. 			{
  822. 				"below" : "1.10.10",
  823. 				"severity": "medium",
  824. 				"identifiers": { "PR" : "307" },
  825. 				"info" : [ "https://github.com/dojo/dojo/pull/307" , "https://dojotoolkit.org/blog/dojo-1-14-released"]
  826. 			},
  827. 			{
  828. 				"atOrAbove" : "1.11.0",
  829. 				"below" : "1.11.6",
  830. 				"severity": "medium",
  831. 				"identifiers": { "PR" : "307" },
  832. 				"info" : [ "https://github.com/dojo/dojo/pull/307" , "https://dojotoolkit.org/blog/dojo-1-14-released"]
  833. 			},
  834. 			{
  835. 				"atOrAbove" : "1.12.0",
  836. 				"below" : "1.12.4",
  837. 				"severity": "medium",
  838. 				"identifiers": { "PR" : "307" },
  839. 				"info" : [ "https://github.com/dojo/dojo/pull/307" , "https://dojotoolkit.org/blog/dojo-1-14-released"]
  840. 			},
  841. 			{
  842. 				"atOrAbove" : "1.13.0",
  843. 				"below" : "1.13.1",
  844. 				"severity": "medium",
  845. 				"identifiers": { "PR" : "307" },
  846. 				"info" : [ "https://github.com/dojo/dojo/pull/307" , "https://dojotoolkit.org/blog/dojo-1-14-released"]
  847. 			},
  848.       {
  849.         "below" : "1.14",
  850.         "severity": "medium",
  851.         "identifiers": { "CVE": ["CVE-2018-15494"] },
  852.         "info" : [ "https://dojotoolkit.org/blog/dojo-1-14-released" ]
  853.       }
  854. 		],
  855. 		"extractors" : {
  856. 			"func"				 : [ "dojo.version.toString()" ],
  857. 			"uri"				 : [ "/(?:dojo-)?(§§version§§)/dojo(\\.min)?\\.js" ],
  858. 			"filename"			 : [ "dojo-(§§version§§)(\\.min)?\\.js" ],
  859. 			"filecontentreplace" : [ "/dojo.version=\\{major:([0-9]+),minor:([0-9]+),patch:([0-9]+)/$1.$2.$3/"],
  860. 			"hashes"			 : {
  861. 				"73cdd262799aab850abbe694cd3bfb709ea23627" : "1.4.1",
  862. 				"c8c84eddc732c3cbf370764836a7712f3f873326" : "1.4.0",
  863. 				"d569ce9efb7edaedaec8ca9491aab0c656f7c8f0" : "1.0.0",
  864. 				"ad44e1770895b7fa84aff5a56a0f99b855a83769" : "1.3.2",
  865. 				"8fc10142a06966a8709cd9b8732f7b6db88d0c34" : "1.3.1",
  866. 				"a09b5851a0a3e9d81353745a4663741238ee1b84" : "1.3.0",
  867. 				"2ab48d45abe2f54cdda6ca32193b5ceb2b1bc25d" : "1.2.3",
  868. 				"12208a1e649402e362f528f6aae2c614fc697f8f" : "1.2.0",
  869. 				"72a6a9fbef9fa5a73cd47e49942199147f905206" : "1.1.1"
  870. 			}
  872. 		}
  873. 	},
  874. 	"angularjs" : {
  875. 		"bowername": [ "angularjs", "angular.js" ],
  876. 		"vulnerabilities" : [
  877. 			{
  878. 				"below" : "1.8.0",
  879. 				"severity": "medium",
  880. 				"identifiers": {
  881. 					"summary": "angular.js prior to 1.8.0 allows cross site scripting. The regex-based input HTML replacement may turn sanitized code into unsanitized one.",
  882. 					"CVE": [ "CVE-2020-7676" ] 
  883. 				},
  884. 				"info" : [ "https://nvd.nist.gov/vuln/detail/CVE-2020-7676" ]	
  885. 			},	
  886. 			{
  887. 				"below" : "1.7.9",
  888. 				"severity": "medium",
  889. 				"identifiers": {
  890. 					"summary": "Prototype pollution"
  891. 				},
  892. 				"info" : [ "https://github.com/angular/angular.js/commit/726f49dcf6c23106ddaf5cfd5e2e592841db743a", "https://github.com/angular/angular.js/blob/master/CHANGELOG.md#179-pollution-eradication-2019-11-19" ]
  893. 			},
  894. 			{
  895. 				"atOrAbove" : "1.5.0",
  896. 				"below" : "1.6.9",
  897. 				"severity": "low",
  898. 				"identifiers": {
  899. 					"summary": "XSS through SVG if enableSvg is set"
  900. 				},
  901. 				"info" : [ "https://github.com/angular/angular.js/blob/master/CHANGELOG.md#169-fiery-basilisk-2018-02-02", "https://vulnerabledoma.in/ngSanitize1.6.8_bypass.html" ]
  902. 			},
  903. 			{
  904. 				"atOrAbove" : "1.3.0",
  905. 				"below" : "1.5.0-rc2",
  906. 				"severity": "medium",
  907. 				"identifiers": {
  908. 					"summary": "The attribute usemap can be used as a security exploit"
  909. 				},
  910. 				"info" : [ "https://github.com/angular/angular.js/blob/master/CHANGELOG.md#1230-patronal-resurrection-2016-07-21" ]
  911. 			},
  912. 			{
  913. 				"atOrAbove" : "1.0.0",
  914. 				"below" : "1.2.30",
  915. 				"severity": "medium",
  916. 				"identifiers": {
  917. 					"summary": "The attribute usemap can be used as a security exploit"
  918. 				},
  919. 				"info" : [ "https://github.com/angular/angular.js/blob/master/CHANGELOG.md#1230-patronal-resurrection-2016-07-21" ]
  920. 			},
  921. 			{
  922. 				"below" : "1.6.3",
  923. 				"severity": "medium",
  924. 				"identifiers": {
  925. 					"summary": "Universal CSP bypass via add-on in Firefox"
  926. 				},
  927. 				"info" : [ "https://github.com/mozilla/addons-linter/issues/1000#issuecomment-282083435", "http://pastebin.com/raw/kGrdaypP" ]
  928. 			},
  929. 			{
  930. 				"below" : "1.6.3",
  931. 				"severity": "medium",
  932. 				"identifiers": {
  933. 					"summary": "DOS in $sanitize"
  934. 				},
  935. 				"info" : [ "https://github.com/angular/angular.js/blob/master/CHANGELOG.md", "https://github.com/angular/angular.js/pull/15699" ]
  936. 			},
  937. 			{
  938. 				"below" : "1.6.5",
  939. 				"severity": "low",
  940. 				"identifiers": {
  941. 					"summary": "XSS in $sanitize in Safari/Firefox"
  942. 				},
  943. 				"info" : [ "https://github.com/angular/angular.js/commit/8f31f1ff43b673a24f84422d5c13d6312b2c4d94" ]
  944. 			}
  945. 		],
  946. 		"extractors" : {
  947. 			"func"			: [ "angular.version.full" ],
  948. 			"uri"			: [ "/(§§version§§)/angular(\\.min)?\\.js" ],
  949. 			"filename"		: [ "angular(?:js)?-(§§version§§)(.min)?\\.js" ],
  950. 			"filecontent"	: [
  951. 				"/\\*[ \n]+AngularJS v(§§version§§)",
  952. 				"http://errors\\.angularjs\\.org/(§§version§§)/"
  953. 			],
  954. 			"hashes"		: {}
  955. 		}
  956. 	},
  957. 	"backbone.js" : {
  958. 		"bowername": [ "backbonejs", "backbone" ],
  959. 		"vulnerabilities" : [
  960. 			{
  961. 				"below" : "0.5.0",
  962. 				"severity": "medium",
  963. 				"identifiers": {
  964. 					"release": "0.5.0",
  965. 					"summary": "cross-site scripting vulnerability"
  966. 				},
  967. 				"info" : [ "http://backbonejs.org/#changelog" ]
  968. 			}
  969. 		],
  970. 		"extractors" : {
  971. 			"func"			: [ "Backbone.VERSION" ],
  972. 			"uri"			: [ "/(§§version§§)/backbone(\\.min)?\\.js" ],
  973. 			"filename"		: [ "backbone(?:js)?-(§§version§§)(.min)?\\.js" ],
  974. 			"filecontent"	: [ "//[ ]+Backbone.js (§§version§§)", "a=t.Backbone={}}a.VERSION=\"(§§version§§)\"" ],
  975. 			"hashes"		: {}
  976. 		}
  977. 	},
  978. 	"mustache.js" : {
  979. 		"bowername": [ "mustache.js", "mustache" ],
  980. 		"vulnerabilities" : [
  981. 			{
  982. 				"below" : "0.3.1",
  983. 				"severity": "high",
  984. 				"identifiers": {
  985. 					"bug": "112",
  986. 					"summary": "execution of arbitrary javascript"
  987. 				},
  988. 				"info" : [ "https://github.com/janl/mustache.js/issues/112" ]
  989. 			},
  990. 			{
  991. 				"below" : "2.2.1",
  992. 				"severity": "medium",
  993. 				"identifiers": {
  994. 					"bug": "pull request 530",
  995. 					"summary": "weakness in HTML escaping"
  996. 				},
  997. 				"info" : [ "https://github.com/janl/mustache.js/releases/tag/v2.2.1", "https://github.com/janl/mustache.js/pull/530" ]
  998. 			}
  999. 		],
  1000. 		"extractors" : {
  1001. 			"func"			: [ "Mustache.version" ],
  1002. 			"uri"			: [ "/(§§version§§)/mustache(\\.min)?\\.js" ],
  1003. 			"filename"		: [ "mustache(?:js)?-(§§version§§)(.min)?\\.js" ],
  1004. 			"filecontent"	: [ "name:\"mustache.js\",version:\"(§§version§§)\"",
  1005. 								"[^a-z]mustache.version[ ]?=[ ]?(?:'|\")(§§version§§)(?:'|\")",
  1006. 								"exports.name[ ]?=[ ]?\"mustache.js\";[\n ]*exports.version[ ]?=[ ]?(?:'|\")(§§version§§)(?:'|\");"
  1007. 								],
  1008. 			"hashes"		: {}
  1009. 		}
  1010. 	},
  1011. 	"handlebars" : {
  1012. 		"bowername": [ "handlebars", "handlebars.js" ],
  1013. 		"vulnerabilities" : [
  1014. 			{
  1015. 				"below" : "1.0.0.beta.3",
  1016. 				"severity": "medium",
  1017. 				"identifiers": {
  1018. 					"summary": "poorly sanitized input passed to eval()"
  1019. 				},
  1020. 				"info" : [ "https://github.com/wycats/handlebars.js/pull/68" ]
  1021. 			},
  1022. 			{
  1023. 				"below" : "4.0.0",
  1024. 				"severity": "medium",
  1025. 				"identifiers": {
  1026. 					"summary": "Quoteless attributes in templates can lead to XSS"
  1027. 				},
  1028. 				"info" : [ "https://github.com/wycats/handlebars.js/pull/1083" ]
  1029. 			},
  1030. 			{
  1031. 				"atOrAbove" : "4.0.0",
  1032. 				"below" : "4.0.13",
  1033. 				"severity": "high",
  1034. 				"identifiers": {
  1035. 					"summary": "A prototype pollution vulnerability in handlebars is exploitable if an attacker can control the template"
  1036. 				},
  1037. 				"info" : [
  1038. 					"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-173692",
  1039. 					"https://github.com/wycats/handlebars.js/commit/7372d4e9dffc9d70c09671aa28b9392a1577fd86"
  1040. 				]
  1041. 			},
  1042. 			{
  1043. 				"atOrAbove" : "4.0.0",
  1044. 				"below" : "4.0.14",
  1045. 				"severity": "high",
  1046. 				"identifiers": {
  1047. 					"summary": "A prototype pollution vulnerability in handlebars is exploitable if an attacker can control the template"
  1048. 				},
  1049. 				"info" : [
  1050. 					"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-174183",
  1051. 					"https://github.com/wycats/handlebars.js/issues/1495",
  1052. 					"https://github.com/wycats/handlebars.js/commit/cd38583216dce3252831916323202749431c773e"
  1053. 				]
  1054. 			},
  1055. 			{
  1056. 				"atOrAbove" : "4.1.0",
  1057. 				"below" : "4.1.2",
  1058. 				"severity": "high",
  1059. 				"identifiers": {
  1060. 					"summary": "A prototype pollution vulnerability in handlebars is exploitable if an attacker can control the template"
  1061. 				},
  1062. 				"info" : [
  1063. 					"https://snyk.io/vuln/SNYK-JS-HANDLEBARS-174183",
  1064. 					"https://github.com/wycats/handlebars.js/issues/1495",
  1065. 					"https://github.com/wycats/handlebars.js/commit/cd38583216dce3252831916323202749431c773e"
  1066. 				]
  1067. 			},
  1068. 			{
  1069. 				"below" : "4.3.0",
  1070. 				"severity": "low",
  1071. 				"identifiers": {
  1072. 					"summary": "Disallow calling helperMissing and blockHelperMissing directly"
  1073. 				},
  1074. 				"info" : [
  1075. 					"https://github.com/wycats/handlebars.js/blob/master/release-notes.md#v430---september-24th-2019"
  1076. 				]
  1077. 			},
  1078. 			{
  1079. 				"below" : "4.5.3",
  1080. 				"severity": "medium",
  1081. 				"identifiers": {
  1082. 					"summary": "Prototype pollution"
  1083. 				},
  1084. 				"info" : [
  1085. 					"https://github.com/wycats/handlebars.js/blob/master/release-notes.md#v453---november-18th-2019"
  1086. 				]
  1087. 			}
  1088. 		],
  1089. 		"extractors" : {
  1090. 			"func"			: [ "Handlebars.VERSION" ],
  1091. 			"uri"			: [ "/(§§version§§)/handlebars(\\.min)?\\.js" ],
  1092. 			"filename"		: [ "handlebars(?:js)?-(§§version§§)(.min)?\\.js" ],
  1093. 			"filecontent"	: [
  1094. 				"Handlebars.VERSION = \"(§§version§§)\";", "Handlebars=\\{VERSION:(?:'|\")(§§version§§)(?:'|\")",
  1095. 				"this.Handlebars=\\{\\};[\n\r \t]+\\(function\\([a-z]\\)\\{[a-z].VERSION=(?:'|\")(§§version§§)(?:'|\")",
  1096. 				"/\\*+![\\s]+(?:@license)?[\\s]+handlebars v(§§version§§)"
  1097. 			],
  1098. 			"hashes"		: {}
  1099. 		}
  1100. 	},
  1101. 	"easyXDM" : {
  1102. 		"vulnerabilities" : [
  1103. 			{
  1104. 				"below" : "2.4.18",
  1105. 				"severity": "high",
  1106. 				"identifiers": {"CVE": [ "CVE-2013-5212" ] },
  1107. 				"info" : [ "http://blog.kotowicz.net/2013/09/exploiting-easyxdm-part-1-not-usual.html", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-5212" ]
  1108. 			},
  1109. 			{
  1110. 				"below" : "2.4.19",
  1111. 				"severity": "high",
  1112. 				"identifiers": {"CVE": [ "CVE-2014-1403" ] },
  1113. 				"info" : [ "http://blog.kotowicz.net/2014/01/xssing-with-shakespeare-name-calling.html", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1403" ]
  1114. 			}
  1115. 		],
  1116. 		"extractors" : {
  1117. 			"uri"			: [ "/(?:easyXDM-)?(§§version§§)/easyXDM(\\.min)?\\.js" ],
  1118. 			"filename"		: [ "easyXDM-(§§version§§)(.min)?\\.js" ],
  1119. 			"filecontent"	: [ " \\* easyXDM\n \\* http://easyxdm.net/(?:\r|\n|.)+version:\"(§§version§§)\"",
  1120. 								"@class easyXDM(?:.|\r|\n)+@version (§§version§§)(\r|\n)" ],
  1121. 			"hashes"		: { "cf266e3bc2da372c4f0d6b2bd87bcbaa24d5a643" : "2.4.6"}
  1122. 		}
  1123. 	},
  1124.  
  1125. 	"plupload" : {
  1126. 		"bowername": [ "Plupload", "plupload" ],
  1127. 		"vulnerabilities" : [
  1128. 			{
  1129. 				"below" : "1.5.4",
  1130. 				"severity": "high",
  1131. 				"identifiers": {"CVE": [ "CVE-2012-2401" ] },
  1132. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2012-2401/" ]
  1133. 			},
  1134. 			{
  1135. 				"below" : "1.5.5",
  1136. 				"severity": "high",
  1137. 				"identifiers": {"CVE": [ "CVE-2013-0237" ] },
  1138. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2013-0237/" ]
  1139. 			},
  1140. 			{
  1141. 				"below" : "2.1.9",
  1142. 				"severity": "medium",
  1143. 				"identifiers": {"CVE": [ "CVE-2016-4566" ] },
  1144. 				"info" : [ "https://github.com/moxiecode/plupload/releases" ]
  1145. 			}
  1146. 		],
  1147. 		"extractors" : {
  1148. 			"func"			: [ "plupload.VERSION" ],
  1149. 			"uri"			: [ "/(§§version§§)/plupload(\\.min)?\\.js" ],
  1150. 			"filename"		: [ "plupload-(§§version§§)(.min)?\\.js" ],
  1151. 			"filecontent"	: [ "\\* Plupload - multi-runtime File Uploader(?:\r|\n)+ \\* v(§§version§§)",
  1152. 								"var g=\\{VERSION:\"(§§version§§)\",.*;window.plupload=g\\}"
  1153. 								],
  1154. 			"hashes"		: {}
  1155. 		}
  1156. 	},
  1157.  
  1158. 	"DOMPurify" : {
  1159. 		"bowername": [ "dompurify", "DOMPurify" ],
  1160. 		"vulnerabilities" : [
  1161. 			{
  1162. 				"below" : "0.6.1",
  1163. 				"severity": "medium",
  1164. 				"identifiers": { },
  1165. 				"info" : [ "https://github.com/cure53/DOMPurify/releases/tag/0.6.1" ]
  1166. 			},
  1167. 			{
  1168. 				"below" : "0.8.6",
  1169. 				"severity": "medium",
  1170. 				"identifiers": { },
  1171. 				"info" : [ "https://github.com/cure53/DOMPurify/releases/tag/0.8.6" ]
  1172. 			},
  1173. 			{
  1174. 				"below" : "0.8.9",
  1175. 				"severity": "low",
  1176. 				"identifiers": { "summary": "safari UXSS" },
  1177. 				"info" : [ "https://github.com/cure53/DOMPurify/releases/tag/0.8.9", "https://lists.ruhr-uni-bochum.de/pipermail/dompurify-security/2017-May/000006.html" ]
  1178. 			},
  1179. 			{
  1180. 				"below" : "0.9.0",
  1181. 				"severity": "low",
  1182. 				"identifiers": { "summary": "safari UXSS" },
  1183. 				"info" : [ "https://github.com/cure53/DOMPurify/releases/tag/0.9.0" ]
  1184. 			}
  1185. 		],
  1186. 		"extractors" : {
  1187. 			"func"			: [ "DOMPurify.version" ],
  1188. 			"filecontent"	: [
  1189. 				"DOMPurify.version = '(§§version§§)';",
  1190. 				"DOMPurify.version=\"(§§version§§)\"",
  1191. 				"DOMPurify=.[^\\r\\n]{10,500}\\.version=\"(§§version§§)\""
  1192. 			],
  1193. 			"hashes"		: {}
  1194. 		}
  1195. 	},
  1196.  
  1197. 	"react" : {
  1198. 		"vulnerabilities" : [
  1199. 			{
  1200. 				"atOrAbove" : "0.4.0", "below" : "0.4.2",
  1201. 				"severity" : "low",
  1202. 				"identifiers" : {
  1203. 					"CVE": [ "CVE-2013-7035" ] ,
  1204. 					"summary":"potential XSS vulnerability can arise when using user data as a key"
  1205. 				},
  1206. 				"info": [ "https://facebook.github.io/react/blog/2013/12/18/react-v0.5.2-v0.4.2.html" ]
  1207. 			},
  1208. 			{
  1209. 				"atOrAbove" : "0.5.0", "below" : "0.5.2",
  1210. 				"severity" : "low",
  1211. 				"identifiers" : {
  1212. 					"CVE": [ "CVE-2013-7035" ],
  1213. 					"summary":"potential XSS vulnerability can arise when using user data as a key"
  1214. 				},
  1215. 				"info": [ "https://facebook.github.io/react/blog/2013/12/18/react-v0.5.2-v0.4.2.html" ]
  1216. 			},
  1217. 			{
  1218. 				"below" : "0.14.0",
  1219. 				"severity" : "low",
  1220. 				"identifiers" : { "summary":" including untrusted objects as React children can result in an XSS security vulnerability" },
  1221. 				"info": [ "http://danlec.com/blog/xss-via-a-spoofed-react-element", "https://facebook.github.io/react/blog/2015/10/07/react-v0.14.html" ]
  1222. 			},
  1223. 			{
  1224. 				"atOrAbove" : "16.0.0", "below" : "16.0.1",
  1225. 				"severity" : "low",
  1226. 				"identifiers" : {
  1227. 					"CVE": [ "CVE-2018-6341" ],
  1228. 					"summary":"potential XSS vulnerability when the attacker controls an attribute name"
  1229. 				},
  1230. 				"info": [ "https://github.com/facebook/react/blob/master/CHANGELOG.md", "https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html" ]
  1231. 			},
  1232. 			{
  1233. 				"atOrAbove" : "16.1.0", "below" : "16.1.2",
  1234. 				"severity" : "low",
  1235. 				"identifiers" : {
  1236. 					"CVE": [ "CVE-2018-6341" ],
  1237. 					"summary":"potential XSS vulnerability when the attacker controls an attribute name"
  1238. 				},
  1239. 				"info": [ "https://github.com/facebook/react/blob/master/CHANGELOG.md", "https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html" ]
  1240. 			},
  1241. 			{
  1242. 				"atOrAbove" : "16.2.0", "below" : "16.2.1",
  1243. 				"severity" : "low",
  1244. 				"identifiers" : {
  1245. 					"CVE": [ "CVE-2018-6341" ],
  1246. 					"summary":"potential XSS vulnerability when the attacker controls an attribute name"
  1247. 				},
  1248. 				"info": [ "https://github.com/facebook/react/blob/master/CHANGELOG.md", "https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html" ]
  1249. 			},
  1250. 			{
  1251. 				"atOrAbove" : "16.3.0", "below" : "16.3.3",
  1252. 				"severity" : "low",
  1253. 				"identifiers" : {
  1254. 					"CVE": [ "CVE-2018-6341" ],
  1255. 					"summary":"potential XSS vulnerability when the attacker controls an attribute name"
  1256. 				},
  1257. 				"info": [ "https://github.com/facebook/react/blob/master/CHANGELOG.md", "https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html" ]
  1258. 			},
  1259. 			{
  1260. 				"atOrAbove" : "16.4.0", "below" : "16.4.2",
  1261. 				"severity" : "low",
  1262. 				"identifiers" : {
  1263. 					"CVE": [ "CVE-2018-6341" ],
  1264. 					"summary":"potential XSS vulnerability when the attacker controls an attribute name"
  1265. 				},
  1266. 				"info": [ "https://github.com/facebook/react/blob/master/CHANGELOG.md", "https://reactjs.org/blog/2018/08/01/react-v-16-4-2.html" ]
  1267. 			}
  1268. 		],
  1269. 		"extractors" : {
  1270. 			"func" : [
  1271. 				"react.version",
  1272. 				"require('react').version"
  1273. 			],
  1274. 			"filecontent" : [
  1275. 				"/\\*\\*\n +\\* React \\(with addons\\) ?v(§§version§§)",
  1276. 				"/\\*\\*\n +\\* React v(§§version§§)",
  1277. 				"\"\\./ReactReconciler\":[0-9]+,\"\\./Transaction\":[0-9]+,\"fbjs/lib/invariant\":[0-9]+\\}\\],[0-9]+:\\[function\\(require,module,exports\\)\\{\"use strict\";module\\.exports=\"(§§version§§)\"\\}",
  1278. 				"ReactVersion\\.js[\\*! \\\\/\n\r]{0,100}function\\(e,t\\)\\{\"use strict\";e\\.exports=\"(§§version§§)\"",
  1279. 				"expected a ReactNode.[\\s\\S]{0,1800}?function\\(e,t\\)\\{\"use strict\";e\\.exports=\"(§§version§§)\""
  1280. 			]
  1281. 		}
  1282. 	},
  1283.  
  1284. 	"flowplayer" : {
  1285. 		"vulnerabilities" : [
  1286. 			{
  1287. 				"below" : "5.4.3",
  1288. 				"severity": "medium",
  1289. 				"identifiers": { "summary" : "XSS vulnerability in Flash fallback" },
  1290. 				"info" : [ "https://github.com/flowplayer/flowplayer/issues/381" ]
  1291. 			}
  1292. 		],
  1293. 		"extractors" : {
  1294. 			"uri"			    : [ "flowplayer-(§§version§§)(\\.min)?\\.js" ],
  1295. 			"filename"		: [ "flowplayer-(§§version§§)(\\.min)?\\.js" ]
  1296. 		}
  1297. 	},
  1298.  
  1299. 	"DWR" : {
  1300. 		"vulnerabilities" : [
  1301. 			{
  1302. 				"below" : "1.1.4",
  1303. 				"severity": "high",
  1304. 				"identifiers": { "CVE" : [ "CVE-2007-01-09" ] },
  1305. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2014-5326/", "http://www.cvedetails.com/cve/CVE-2014-5326/" ]
  1306. 			},
  1307. 			{
  1308. 				"below" : "2.0.11",
  1309. 				"severity": "medium",
  1310. 				"identifiers": { "CVE" : ["CVE-2014-5326", "CVE-2014-5325"] },
  1311. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2014-5326/", "http://www.cvedetails.com/cve/CVE-2014-5326/" ]
  1312. 			},
  1313. 			{
  1314. 				"above" : "3",
  1315. 				"below" : "3.0.RC3",
  1316. 				"severity": "medium",
  1317. 				"identifiers": { "CVE" : ["CVE-2014-5326", "CVE-2014-5325"] },
  1318. 				"info" : [ "http://www.cvedetails.com/cve/CVE-2014-5326/", "http://www.cvedetails.com/cve/CVE-2014-5326/" ]
  1319. 			}
  1320. 		],
  1321. 		"extractors" : {
  1322. 			"func"			: [ "dwr.version" ],
  1323. 			"filecontent"	: [
  1324. 				" dwr-(§§version§§).jar"
  1325. 			]
  1326. 		}
  1327. 	},
  1328.  
  1329. 	"moment.js" : {
  1330. 		"bowername": [ "moment", "momentjs" ],
  1331. 		"vulnerabilities" : [
  1332. 			{
  1333. 				"below" : "2.11.2",
  1334. 				"severity": "low",
  1335. 				"identifiers": { "summary":"reDOS - regular expression denial of service" },
  1336. 				"info" : [ "https://github.com/moment/moment/issues/2936" ]
  1337. 			}
  1338. 		],
  1339. 		"extractors" : {
  1340. 			"func"			: [ "moment.version" ],
  1341. 			"filecontent"	: [ "//! moment.js(?:[\n\r]+)//! version : (§§version§§)" ]
  1342. 		}
  1343. 	},
  1344.  
  1345. 	"bootstrap": {
  1346. 		"vulnerabilities" : [
  1347. 			{
  1348. 				"below" : "4.3.1",
  1349. 				"atOrAbove" : "4.0.0",
  1350. 				"identifiers": {
  1351. 					"issue" : "28236",
  1352. 					"summary": "XSS in data-template, data-content and data-title properties of tooltip/popover",
  1353. 					"CVE" : ["CVE-2019-8331"]
  1354. 				},
  1355. 				"severity" : "high",
  1356. 				"info" : [ "https://github.com/twbs/bootstrap/issues/28236" ]
  1357. 			},
  1358. 			{
  1359. 				"below" : "3.4.1",
  1360. 				"identifiers": {
  1361. 					"issue" : "28236",
  1362. 					"summary": "XSS in data-template, data-content and data-title properties of tooltip/popover",
  1363. 					"CVE" : ["CVE-2019-8331"]
  1364. 				},
  1365. 				"severity" : "high",
  1366. 				"info" : [ "https://github.com/twbs/bootstrap/issues/28236" ]
  1367. 			},
  1368. 			{
  1369. 				"below" : "4.1.2",
  1370. 				"atOrAbove" : "4.0.0",
  1371. 				"identifiers": {
  1372. 					"issue" : "20184",
  1373. 					"summary": "XSS in data-target property of scrollspy",
  1374. 					"CVE" : ["CVE-2018-14041"]
  1375. 				},
  1376. 				"severity" : "medium",
  1377. 				"info" : [ "https://github.com/twbs/bootstrap/issues/20184" ]
  1378. 			},
  1379. 			{
  1380. 				"below" : "3.4.0",
  1381. 				"identifiers": {
  1382. 					"issue" : "20184",
  1383. 					"summary": "XSS in data-target property of scrollspy",
  1384. 					"CVE" : ["CVE-2018-14041"]
  1385. 				},
  1386. 				"severity" : "medium",
  1387. 				"info" : [ "https://github.com/twbs/bootstrap/issues/20184" ]
  1388. 			},
  1389. 			{
  1390. 				"below" : "4.1.2",
  1391. 				"atOrAbove" : "4.0.0",
  1392. 				"identifiers": {
  1393. 					"issue" : "20184",
  1394. 					"summary": "XSS in collapse data-parent attribute",
  1395. 					"CVE" : ["CVE-2018-14040"]
  1396. 				},
  1397. 				"severity" : "medium",
  1398. 				"info" : [ "https://github.com/twbs/bootstrap/issues/20184" ]
  1399. 			},
  1400. 			{
  1401. 				"below" : "3.4.0",
  1402. 				"identifiers": {
  1403. 					"issue" : "20184",
  1404. 					"summary": "XSS in collapse data-parent attribute",
  1405. 					"CVE" : ["CVE-2018-14040"]
  1406. 				},
  1407. 				"severity" : "medium",
  1408. 				"info" : [ "https://github.com/twbs/bootstrap/issues/20184" ]
  1409. 			},
  1410. 			{
  1411. 				"below" : "4.1.2",
  1412. 				"atOrAbove" : "4.0.0",
  1413. 				"identifiers": {
  1414. 					"issue" : "20184",
  1415. 					"summary": "XSS in data-container property of tooltip",
  1416. 					"CVE" : ["CVE-2018-14042"]
  1417. 				},
  1418. 				"severity" : "medium",
  1419. 				"info" : [ "https://github.com/twbs/bootstrap/issues/20184" ]
  1420. 			},
  1421. 			{
  1422. 				"below" : "3.4.0",
  1423. 				"identifiers": {
  1424. 					"issue" : "20184",
  1425. 					"summary": "XSS in data-container property of tooltip",
  1426. 					"CVE" : ["CVE-2018-14042"]
  1427. 				},
  1428. 				"severity" : "medium",
  1429. 				"info" : [ "https://github.com/twbs/bootstrap/issues/20184" ]
  1430. 			},
  1431. 			{
  1432. 				"below" : "2.1.0",
  1433. 				"severity": "medium",
  1434. 				"identifiers": {
  1435. 					"summary": "cross-site scripting vulnerability"
  1436. 				},
  1437. 				"info" : [ "https://github.com/twbs/bootstrap/pull/3421" ]
  1438. 			}
  1439. 		],
  1440. 		"extractors" : {
  1441. 			"uri"			: [ "/(§§version§§)/bootstrap(\\.min)?\\.js", "/(§§version§§)/js/bootstrap(\\.min)?\\.js" ],
  1442. 			"filename"		: [ "bootstrap-(§§version§§)(\\.min)?\\.js" ],
  1443. 			"filecontent"	: [
  1444. 								"/\\*!? Bootstrap v(§§version§§)",
  1445. 								"\\* Bootstrap v(§§version§§)",
  1446. 								"/\\*! Bootstrap v(§§version§§)"
  1447. 			],
  1448. 			"hashes"		: {}
  1449. 		}
  1450. 	},
  1451.  
  1452. 	"ckeditor" : {
  1453. 		"vulnerabilities": [
  1454. 			{
  1455. 				"below" : "4.4.3",
  1456. 				"identifiers" : {
  1457. 					"summary" : "XSS"
  1458. 				},
  1459. 				"severity" : "medium",
  1460. 				"info": [ "https://github.com/ckeditor/ckeditor-dev/blob/master/CHANGES.md#ckeditor-443" ]
  1461. 			},
  1462. 			{
  1463. 				"below" : "4.4.6",
  1464. 				"identifiers" : {
  1465. 					"summary" : "XSS"
  1466. 				},
  1467. 				"severity" : "medium",
  1468. 				"info": [ "https://github.com/ckeditor/ckeditor-dev/blob/master/CHANGES.md#ckeditor-446" ]
  1469. 			},
  1470. 			{
  1471. 				"below" : "4.4.8",
  1472. 				"identifiers" : {
  1473. 					"summary" : "XSS"
  1474. 				},
  1475. 				"severity" : "medium",
  1476. 				"info": [ "https://github.com/ckeditor/ckeditor-dev/blob/master/CHANGES.md#ckeditor-448" ]
  1477. 			},
  1478. 			{
  1479. 				"below" : "4.5.11",
  1480. 				"identifiers" : {
  1481. 					"summary" : "XSS"
  1482. 				},
  1483. 				"severity" : "medium",
  1484. 				"info": [ "https://github.com/ckeditor/ckeditor-dev/blob/master/CHANGES.md#ckeditor-4511" ]
  1485. 			},
  1486. 			{
  1487. 				"below" : "4.9.2",
  1488. 				"atOrAbove" : "4.5.11",
  1489. 				"identifiers" : {
  1490. 					"summary" : "XSS if the enhanced image plugin is installed"
  1491. 				},
  1492. 				"severity" : "medium",
  1493. 				"info": [ "https://ckeditor.com/blog/CKEditor-4.9.2-with-a-security-patch-released/", "https://ckeditor.com/cke4/release-notes" ]
  1494. 			},
  1495. 			{
  1496. 				"atOrAbove" : "4.0.0",
  1497. 				"below" : "4.11.0",
  1498. 				"identifiers" : {
  1499. 					"summary" : "XSS vulnerability in the HTML parser"
  1500. 				},
  1501. 				"severity" : "medium",
  1502. 				"info" : [
  1503. 					"https://ckeditor.com/blog/CKEditor-4.11-with-emoji-dropdown-and-auto-link-on-typing-released/",
  1504. 					"https://snyk.io/vuln/SNYK-JS-CKEDITOR-72618"
  1505. 				]
  1506. 			},
  1507. 			{
  1508. 				"below" : "4.14.0",
  1509. 				"identifiers" : {
  1510. 					"summary" : "XSS"
  1511. 				},
  1512. 				"severity" : "low",
  1513. 				"info": [ "https://github.com/ckeditor/ckeditor4/blob/major/CHANGES.md#ckeditor-414" ]
  1514. 			}
  1515. 		],
  1516. 		"extractors" : {
  1517. 			"uri"			: [ "/(§§version§§)/ckeditor(\\.min)?\\.js" ],
  1518. 			"filename"		: [ "ckeditor-(§§version§§)(\\.min)?\\.js" ],
  1519. 			"filecontent"	: [
  1520. 								"ckeditor..js.{4,20}=\\{timestamp:\"[^\"]+\",version:\"(§§version§§)",
  1521. 								"window.CKEDITOR=function\\(\\)\\{var [a-z]=\\{timestamp:\"[^\"]+\",version:\"(§§version§§)"
  1522. 			],
  1523. 			"hashes"		: {},
  1524. 			"func"			: [ "CKEDITOR.version" ]
  1525. 		}
  1526. 	},
  1527.  
  1528.  
  1529. 	"vue" : {
  1530. 		"vulnerabilities" : [
  1531. 			{
  1532. 				"below" : "2.5.17",
  1533. 				"severity" : "medium",
  1534. 				"identifiers" : {
  1535. 					"summary" : "potential xss in ssr when using v-bind"
  1536. 				},
  1537. 				"info" : [ "https://github.com/vuejs/vue/releases/tag/v2.5.17" ]
  1538. 			},
  1539. 			{
  1540. 				"below" : "2.4.3",
  1541. 				"severity" : "medium",
  1542. 				"identifiers" : {
  1543. 					"summary" : "possible xss vector "
  1544. 				},
  1545. 				"info" : [ "https://github.com/vuejs/vue/releases/tag/v2.4.3" ]
  1546. 			}
  1547. 		],
  1548. 		"extractors" : {
  1549. 			"uri"			: [
  1550. 				"/vue@(§§version§§)/dist/vue\\.js"
  1551. 			],
  1552. 			"filename"		: [ "vue-(§§version§§)(\\.min)?\\.js" ],
  1553. 			"filecontent"	: [
  1554. 				"/\\*!\\n * Vue.js v(§§version§§)",
  1555. 				"Vue.version = '(§§version§§)';",
  1556. 				"'(§§version§§)'[^\\n]{0,8000}Vue compiler"
  1557. 			],
  1558. 			"func"			: [ "Vue.version" ]
  1559. 		}
  1560. 	},
  1561.  
  1562. 	"ExtJS" : {
  1563. 		"vulnerabilities" : [
  1564. 			{
  1565. 				"below"       : "6.6.0",
  1566. 				"atOrAbove"   : "4.0.0",
  1567. 				"severity"    : "high",
  1568. 				"identifiers" : {
  1569. 					"CVE"     : [
  1570. 						"CVE-2018-8046"
  1571. 					],
  1572. 					"summary" : "XSS in Sencha Ext JS 4 to 6 via getTip() method of Action Columns"
  1573. 				},
  1574. 				"info"        : [
  1575. 					"http://seclists.org/fulldisclosure/2018/Jul/8",
  1576. 					"https://nvd.nist.gov/vuln/detail/CVE-2018-8046"
  1577. 				]
  1578. 			},
  1579. 			{
  1580. 				"below"       : "6.0.0",
  1581. 				"severity"    : "high",
  1582. 				"identifiers" : {
  1583. 					"CVE"     : [
  1584. 						"CVE-2007-2285"
  1585. 					],
  1586. 					"summary" : "Directory traversal and arbitrary file read"
  1587. 				},
  1588. 				"info"        : [
  1589. 					"https://www.cvedetails.com/cve/CVE-2007-2285/",
  1590. 					"https://packetstormsecurity.com/files/132052/extjs-Arbitrary-File-Read.html",
  1591. 					"https://www.akawebdesign.com/2018/08/14/should-js-frameworks-prevent-xss/"
  1592. 				]
  1593. 			},
  1594. 			{
  1595. 				"below"       : "4.0.0",
  1596. 				"atOrAbove"   : "3.0.0",
  1597. 				"severity"    : "high",
  1598. 				"identifiers" : {
  1599. 					"CVE"     : [
  1600. 						"CVE-2010-4207",
  1601. 						"CVE-2012-5881"
  1602. 					],
  1603. 					"summary" : "XSS vulnerability in ExtJS charts.swf"
  1604. 				},
  1605. 				"info"        : [
  1606. 					"https://www.acunetix.com/vulnerabilities/web/extjs-charts-swf-cross-site-scripting",
  1607. 					"https://typo3.org/security/advisory/typo3-core-sa-2014-001/",
  1608. 					"https://www.akawebdesign.com/2018/08/14/should-js-frameworks-prevent-xss/"
  1609. 				]
  1610. 			}
  1611. 		],
  1612. 		"extractors" : {
  1613. 			"uri" : [
  1614. 				"/extjs/(§§version§§)/.*\\.js"
  1615. 			],
  1616. 			"filename" : [
  1617. 				"/ext-all-(§§version§§)(\\.min)?\\.js",
  1618. 				"/ext-all-debug-(§§version§§)(\\.min)?\\.js",
  1619. 				"/ext-base-(§§version§§)(\\.min)?\\.js"
  1620. 			],
  1621. 			"filecontent" : [
  1622. 				"/*!\n * Ext JS Library (§§version§§)"
  1623. 			],
  1624. 			"func"     : [
  1625. 				"Ext && Ext.versions && Ext.versions.extjs.version",
  1626. 				"Ext && Ext.version"
  1627. 			]
  1628. 		}
  1629. 	},
  1630.  
  1631.  
  1632.  
  1633.  
  1634.  
  1635.  
  1636. 	"dont check" : {
  1637. 		"extractors" : {
  1638. 			"uri" : [
  1639. 				"^http[s]?://(ssl|www).google-analytics.com/ga.js",
  1640. 				"^http[s]?://apis.google.com/js/plusone.js",
  1641. 				"^http[s]?://cdn.cxense.com/cx.js"
  1642. 			]
  1643. 		}
  1644. 	}
  1645. }
  1646.

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/花生_TL007/article/detail/427731
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号