PT-2020-1960

Name of the Vulnerable Software and Affected Versions gulp-scss-lint versions 1.0.0 and earlier Description The issue exists due to the lack of measures to neutralize special elements used in the operating system command. This allows a remote attacker to execute arbitrary commands by injecting th...

dcicsnovault (2.0.0b0), django-gulp (>=2.5.0, <=2.5.1) +1 more potentially affected by CVE-2019-18874 via psutil (4.3.0)

psutil PYPI version 4.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on psutil and may be impacted: - dcicsnovault 2.0.0b0 - django-gulp =2.5.0, =0.1.0, =0.1.3 Source cves: CVE-2019-18874 Source advisory: OSV:PYSEC-2019-41...

django-gulp (>=2.2.0, <=2.3.0) potentially affected by CVE-2019-18874 via psutil (3.3.0)

psutil PYPI version 3.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on psutil and may be impacted: - django-gulp =2.2.0, =2.3.0 Source cves: CVE-2019-18874 Source advisory: OSV:PYSEC-2019-41...

django-gulp (>=2.4.0, <=2.4.1), esrally (>=0.2.0, <=0.7.3) potentially affected by CVE-2019-18874 via psutil (4.1.0)

psutil PYPI version 4.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on psutil and may be impacted: - django-gulp =2.4.0, =0.2.0, =0.7.3 Source cves: CVE-2019-18874 Source advisory: OSV:PYSEC-2019-41...

grunt-dwebp (>=1.0.0, <=1.1.2), gulp-dwebp (>=1.0.0, <=1.0.2) potentially affected by CVE-2016-10633 via dwebp-bin (1.0.0)

dwebp-bin NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dwebp-bin and may be impacted: - grunt-dwebp =1.0.0, =1.0.0, =1.0.2 Source cves: CVE-2016-10633 Source advisory: OSV:GHSA-4PF7-579W-F4GM...

grunt-dwebp (>=1.0.0, <=1.1.2), gulp-dwebp (>=1.0.0, <=1.0.2) potentially affected by CVE-2016-10633 via dwebp-bin (1.0.0)

dwebp-bin NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on dwebp-bin and may be impacted: - grunt-dwebp =1.0.0, =1.0.0, =1.0.2 Source cves: CVE-2016-10633 Source advisory: GHSA-4PF7-579W-F4GM...

anione (>=1.2.0, <=1.2.7), gulp-imageoptim (0.1.0) potentially affected by CVE-2016-10596 via imageoptim (>=0.3.4, <=0.4.2)

imageoptim NPM version =0.3.4, =1.2.0, =1.2.7 - gulp-imageoptim 0.1.0 Source cves: CVE-2016-10596 Source advisory: OSV:GHSA-MM7H-323R-9P4G...

anione (>=1.2.0, <=1.2.7), gulp-imageoptim (0.1.0) potentially affected by CVE-2016-10596 via imageoptim (>=0.3.4, <=0.4.2)

imageoptim NPM version =0.3.4, =1.2.0, =1.2.7 - gulp-imageoptim 0.1.0 Source cves: CVE-2016-10596 Source advisory: GHSA-MM7H-323R-9P4G...

backender (>=0.0.1, <=0.0.7), gulp-backender (>=0.0.4, <=0.0.5) potentially affected by CVE-2016-10604 via dalek-browser-chrome (0.0.11)

dalek-browser-chrome NPM version 0.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on dalek-browser-chrome and may be impacted: - backender =0.0.1, =0.0.4, =0.0.5 Source cves: CVE-2016-10604 Source advisory: OSV:GHSA-6Q8Q-RVF4-M4PG...

backender (>=0.0.1, <=0.0.7), gulp-backender (>=0.0.4, <=0.0.5) potentially affected by CVE-2016-10604 via dalek-browser-chrome (0.0.11)

dalek-browser-chrome NPM version 0.0.11 is affected by a known vulnerability. The following packages have a transitive dependency on dalek-browser-chrome and may be impacted: - backender =0.0.1, =0.0.4, =0.0.5 Source cves: CVE-2016-10604 Source advisory: GHSA-6Q8Q-RVF4-M4PG...

gulp-haxe (>=0.3.0, <=0.4.5) potentially affected by CVE-2016-10692 via haxeshim (>=0.5.6, <=0.6.3)

haxeshim NPM version =0.5.6, =0.3.0, =0.4.5 Source cves: CVE-2016-10692 Source advisory: OSV:GHSA-CR6C-85FH-CQPG...

gulp-haxe (>=0.3.0, <=0.4.5) potentially affected by CVE-2016-10692 via haxeshim (>=0.5.6, <=0.6.3)

haxeshim NPM version =0.5.6, =0.3.0, =0.4.5 Source cves: CVE-2016-10692 Source advisory: GHSA-CR6C-85FH-CQPG...

ecc-gulp-tasks (2.4.3) potentially affected by CVE-2016-10548 via reduce-css-calc (1.2.4)

reduce-css-calc NPM version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on reduce-css-calc and may be impacted: - ecc-gulp-tasks 2.4.3 Source cves: CVE-2016-10548 Source advisory: OSV:GHSA-4662-J96G-MV46...

ecc-gulp-tasks (2.4.3) potentially affected by CVE-2016-10548 via reduce-css-calc (1.2.4)

reduce-css-calc NPM version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on reduce-css-calc and may be impacted: - ecc-gulp-tasks 2.4.3 Source cves: CVE-2016-10548 Source advisory: GHSA-4662-J96G-MV46...

ecc-gulp-tasks (2.4.3) potentially affected by CVE-2016-10548 via reduce-css-calc (1.2.4)

reduce-css-calc NPM version 1.2.4 is affected by a known vulnerability. The following packages have a transitive dependency on reduce-css-calc and may be impacted: - ecc-gulp-tasks 2.4.3 Source cves: CVE-2016-10548 Source advisory: MEND:CVE-2016-10548...

Retire.Js - Scanner Detecting The Use Of JavaScript Libraries With Known Vulnerabilities

What you require you must also retire There is a plethora of JavaScript libraries for use on the Web and in Node.JS apps out there. This greatly simplifies development,but we need to stay up-to-date on security fixes. "Using Components with Known Vulnerabilities" is now a part of the OWASP Top 10...

css-semdiff (>=1.0.0, <=1.1.0), dtsm (>=0.0.1, <=1.1.0) +6 more potentially affected by CVE-2017-1000451 via fs-git (>=0.1.1, <=1.0.1)

fs-git NPM version =0.1.1, =1.0.0, =0.0.1, =0.1.1, =1.0.0, =1.0.8, =0.1.0, =0.0.3, =0.0.11 Source cves: CVE-2017-1000451 Source advisory: MEND:CVE-2017-1000451...