Insecure version of Spring Web MVC used in Confluence Analytics

Hello! A transitive dependency issue has been found in Confluence Analytics: https://atlassian.sourceclear.io/workspaces/Paaina7/issues/vulnerabilities/26465610 Confluence Analytics has a transitive dependency on the Spring Web MVC library, which has a security bug. The issue can be fixed by...

@aliyun-sls/sql (>=0.2.9-dev-10, <=0.3.10-dev-9), @dpjayasekara/tscore (>=0.0.1, <=0.1.1) +29 more potentially affected by CVE-2020-15123 +1 more via codecov (>=3.0.0, <=3.6.1)

codecov NPM version =3.0.0, =0.2.9-dev-10, =0.0.1, =0.0.29, =1.0.10, =1.0.18, =1.0.0, =1.7.0, =1.0.1, =1.0.8, =0.1.1, =0.1.6, =0.1.1, =0.0.1, =1.17.0, =1.22.16 and more Source cves: CVE-2020-15123, CVE-2020-7597 Source advisory: OSV:GHSA-5Q88-CJFQ-G2MH...

08cms (1.0.0), 102f (>=1.0.0, <=1.0.1) +2203 more potentially affected by CVE-2019-10790 via taffydb (>=2.6.2, <=2.7.3)

taffydb NPM version =2.6.2, =1.0.0, =0.0.5, =1.0.0, =1.0.1-beta2, =1.0.40, =2.0.0-alpha.1, =1.6.0, =1.0.0, =1.0.1, =0.3.0, =1.0.2, =0.1.2, =0.2.0 - @adrian-alu0101024363/spread 0.1.3 and more Source cves: CVE-2019-10790 Source advisory: OSV:GHSA-MXHP-79QH-MCX6...

@zambezi/jsbin (3.40.4-ez-bin.5), pin-api (>=1.1.0, <=1.3.1) potentially affected by CVE-2019-10795 via undefsafe (>=2.0.0, <=2.0.1)

undefsafe NPM version =2.0.0, =1.1.0, =1.3.1 Source cves: CVE-2019-10795 Source advisory: SNYK:JS-UNDEFSAFE-548940...

byways (>=1.2.0, <=1.5.2), component-build (>=1.0.0, <=1.2.2) +17 more potentially affected by CVE-2019-10794 via component-flatten (>=0.0.1, <=1.0.1)

component-flatten NPM version =0.0.1, =1.2.0, =1.0.0, =1.0.0, =1.3.0, =0.0.3, =0.1.0, =1.0.0, =1.0.0, =0.2.0, =1.0.0, =1.2.0, =0.0.1, =0.0.1, =0.0.4 - faiton-builder 1.1.10 and more Source cves: CVE-2019-10794 Source advisory: SNYK:JS-COMPONENTFLATTEN-548907...

@philipplgh/electron-app-manager (>=0.12.0, <=0.56.0), electron-app-manager (>=0.56.0, <=0.57.1) +4 more potentially affected by unknown CVE via electron-updater (>=4.0.0, <=4.1.2)

electron-updater NPM version =4.0.0, =0.12.0, =0.56.0, =0.0.2, =4.0.3, =1.0.0, =1.3.1 Source cves: unknown CVE Source advisory: SNYK:JS-ELECTRONUPDATER-561421...

@aliyun-sls/sql (>=0.2.9-dev-10, <=0.3.10-dev-9), @dpjayasekara/tscore (>=0.0.1, <=0.1.1) +29 more potentially affected by CVE-2020-7596 +1 more via codecov (>=3.0.0, <=3.6.1)

codecov NPM version =3.0.0, =0.2.9-dev-10, =0.0.1, =0.0.29, =1.0.10, =1.0.18, =1.0.0, =1.7.0, =1.0.1, =1.0.8, =0.1.1, =0.1.6, =0.1.1, =0.0.1, =1.17.0, =1.22.16 and more Source cves: CVE-2020-7596, CVE-2020-7597 Source advisory: SNYK:JS-CODECOV-548879...

@xapp/stentor (>=1.13.9, <=1.15.0) potentially affected by CVE-2019-10777 via aws-lambda (>=1.0.0, <=1.0.4)

aws-lambda NPM version =1.0.0, =1.13.9, =1.15.0 Source cves: CVE-2019-10777 Source advisory: OSV:GHSA-934X-72XH-5HRG...

@choiceform/ui-foundation (>=0.16.3, <=0.16.6), @gulpjs/update-template (0.1.0) +15 more potentially affected by CVE-2019-10776 via git-diff-apply (>=0.0.5, <=0.22.1)

git-diff-apply NPM version =0.0.5, =0.16.3, =0.1.0, =0.1.0, =0.8.0, =0.1.9, =0.0.1, =0.7.1, =0.2.2, =0.2.3 - ember-precondition 0.2.0 - ember-promise-helpers 1.0.8 and more Source cves: CVE-2019-10776 Source advisory: OSV:GHSA-84CM-V6JP-GJMR...

@colmena/api (0.1.0), @colmena/colmena-loopback (>=0.0.4, <=0.2.1) +57 more potentially affected by CVE-2019-15597 via node-df (>=0.1.1, <=0.1.4)

node-df NPM version =0.1.1, =0.0.4, =0.0.1, =1.1.0, =3.0.0-alpha.8, =3.0.0-alpha.1, =3.0.0-alpha.0, =0.1.0, =1.0.0, =1.30.0, =0.0.1, =1.0.0, =1.0.0, =1.1.3 and more Source cves: CVE-2019-15597 Source advisory: OSV:GHSA-WP7M-MRVF-599C...

@bloomreach/hippo-theme (2.2.3), @covisint/cui-idm-b2x (>=0.2.1, <=1.3.0) +369 more potentially affected by CVE-2019-14863 via angular (>=1.0.8, <=1.4.14)

angular NPM version =1.0.8, =0.2.1, =0.2.0-dev, =1.2.6, =0.3.2, =1.0.4, =0.1.1, =1.0.4, =1.1.24, =1.0.3, =1.0.12, =1.0.7, =0.0.1, =3.2.10-0, =3.2.10-1 and more Source cves: CVE-2019-14863 Source advisory: OSV:GHSA-R5FX-8R73-V86C...

@hpcc-js/dgrid-shim (>=0.1.10, <=0.1.12) potentially affected by CVE-2019-10785 via dojox (1.13.0)

dojox NPM version 1.13.0 is affected by a known vulnerability. The following packages have a transitive dependency on dojox and may be impacted: - @hpcc-js/dgrid-shim =0.1.10, =0.1.12 Source cves: CVE-2019-10785 Source advisory: OSV:GHSA-PG97-WW7H-5MJR...

annatar (>=0.4.3, <=0.5.8), ansi2png-rs (>=0.1.0, <=0.1.1) +83 more potentially affected by CVE-2020-35879 via rulinalg (0.4.2)

rulinalg CARGO version 0.4.2 is affected by a known vulnerability. The following packages have a transitive dependency on rulinalg and may be impacted: - annatar =0.4.3, =0.1.0, =0.2.9, =14.1.0, =0.1.5, =0.1.0, =0.1.0, =0.4.0, =1.0.0, =0.3.2, =0.1.0, =0.1.3 - electro 0.9.3 and more Source cves:...

annatar (>=0.4.3, <=0.5.8), ansi2png-rs (>=0.1.0, <=0.1.1) +96 more potentially affected by unknown CVE via rulinalg (>=0.1.0, <=0.4.2)

rulinalg CARGO version =0.1.0, =0.4.3, =0.1.0, =0.2.9, =14.1.0, =0.1.5, =0.1.0, =0.1.0, =0.4.0, =1.0.0, =0.3.2, =0.3.3 - dali 0.3.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0147...

aiowrap (0.1.0), ambisonic (>=0.1.0, <=0.3.1) +147 more potentially affected by unknown CVE via slice-deque (>=0.1.16, <=0.3.0)

slice-deque CARGO version =0.1.16, =0.1.0, =0.11.0, =0.2.0, =0.1.0, =0.8.0, =0.3.0, =0.6.0, =0.4.0, =0.8.0, =0.2.0, =0.6.0, =0.15.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0158...

aart (>=0.1.0, <=0.1.1), advancedresearch-higher_order_point (>=0.1.0, <=0.3.0) +684 more potentially affected by unknown CVE via lzw (>=0.5.0, <=0.10.0)

lzw CARGO version =0.5.0, =0.1.0, =0.1.0, =0.0.3, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.11.0, =0.2.0, =0.1.0, =0.6.0, =0.15.3 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0144...

lightbeam (>=0.7.0, <=0.15.0), llama-wasm (>=0.1.0, <=0.5.0) +1 more potentially affected by unknown CVE via multi_mut (0.1.3)

multimut CARGO version 0.1.3 is affected by a known vulnerability. The following packages have a transitive dependency on multimut and may be impacted: - lightbeam =0.7.0, =0.1.0, =0.7.0, =0.15.0 Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2020-0169...

approveapi (0.1.0), approveapi_openapi (0.1.1) +185 more potentially affected by unknown CVE via tokio-proto (0.1.1)

tokio-proto CARGO version 0.1.1 is affected by a known vulnerability. The following packages have a transitive dependency on tokio-proto and may be impacted: - approveapi 0.1.0 - approveapiopenapi 0.1.1 - arc-reactor =0.1.0, =0.2.0, =0.2.0, =1.5.0, =0.4.2, =0.5.0, =0.1.0, =0.1.0, =0.1.6 and more...

@angstone/micro (0.0.1), @angstone/microservice (0.0.17) +4 more potentially affected by CVE-2019-10790 via taffy (2.6.2)

taffy NPM version 2.6.2 is affected by a known vulnerability. The following packages have a transitive dependency on taffy and may be impacted: - @angstone/micro 0.0.1 - @angstone/microservice 0.0.17 - anrajs =1.0.0, =0.0.1, =0.0.7, =1.0.6 - neyka 3.0.0 Source cves: CVE-2019-10790 Source advisory...

08cms (1.0.0), 102f (>=1.0.0, <=1.0.1) +2203 more potentially affected by CVE-2019-10790 via taffydb (>=2.6.2, <=2.7.3)

taffydb NPM version =2.6.2, =1.0.0, =0.0.5, =1.0.0, =1.0.1-beta2, =1.0.40, =2.0.0-alpha.1, =1.6.0, =1.0.0, =1.0.1, =0.3.0, =1.0.2, =0.1.2, =0.2.0 - @adrian-alu0101024363/spread 0.1.3 and more Source cves: CVE-2019-10790 Source advisory: SNYK:JS-TAFFYDB-2992450...