roaring-landmask (0.4.0) potentially affected by CVE-2022-2097 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-2097 Source advisory: OSV:GHSA-3WX7-46CH-7RQ2...

@newskit-render/auth (>=0.5.1, <=0.31.0), @newskit-render/core (>=0.57.0, <=1.40.0) +1 more potentially affected by CVE-2022-31127 via next-auth (3.1.0)

next-auth NPM version 3.1.0 is affected by a known vulnerability. The following packages have a transitive dependency on next-auth and may be impacted: - @newskit-render/auth =0.5.1, =0.57.0, =0.35.0, =0.49.2 Source cves: CVE-2022-31127 Source advisory: OSV:GHSA-PGJX-7F9G-9463...

46c-sector (>=1.0.0, <=1.2.1), 7ghost (>=4.11.0, <=4.11.46) +7465 more potentially affected by CVE-2022-31129 +1 more via moment (>=2.18.0, <=2.29.3)

moment NPM version =2.18.0, =1.0.0, =4.11.0, =1.17.6-next.0, =4.13.7-rc4, =1.0.0-beta.1, =1.0.7, =1.43.0, =1.70.1, =1.70.1, =1.85.3, =1.70.2, =1.1.1, =0.0.1-bate.30, =1.16.0, =2.4.4 and more Source cves: CVE-2022-31129, CVE-2023-22467 Source advisory: OSV:GHSA-WC69-RHJR-HC9G...

@dmrvos/infrajs (>=0.0.4, <=0.0.8), @marjose/jstoolkit (>=0.0.2, <=1.0.0-beta) +10 more potentially affected by CVE-2022-31147 via jquery-validation (>=1.14.0, <=1.19.1)

jquery-validation NPM version =1.14.0, =0.0.4, =0.0.2, =0.2.2, =3.0.0, =0.11.28, =0.0.8, =1.4.0, =1.0.0, =3.0.0-prerelease.20170216T120000Z, =1.0.0, =1.0.6 - webpack-symfony-builder 1.0.0 Source cves: CVE-2022-31147 Source advisory: OSV:GHSA-FFMH-X56J-9RC3...

@0xgg/echomd (>=1.0.0, <=1.0.4), @agoose77/jupyterlab-markup (>=0.1.0, <=1.0.1) +456 more potentially affected by CVE-2022-31108 via mermaid (>=8.4.0, <=9.1.1)

mermaid NPM version =8.4.0, =1.0.0, =0.1.0, =0.0.18, =6.8.0, =0.5.0, =0.1.0-integrate-flowzone-f2df00320763c10337790c7657713f782ca7a948, =0.0.2-copy-over-code-9b23b805d2204b212fedd0047ac9423f93c83390, =0.0.2-bring-over-code-43d64c4e7cf302de59073ef35bacdf69932ccba4, =1.0.1, =0.0.1, =1.0.0, =1.0.4 ...

roaring-landmask (0.4.0) potentially affected by CVE-2022-2097 via openssl-src (300.0.0+3.0.0)

openssl-src CARGO version 300.0.0+3.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on openssl-src and may be impacted: - roaring-landmask 0.4.0 Source cves: CVE-2022-2097 Source advisory: OSV:RUSTSEC-2022-0032...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +82 more potentially affected by CVE-2022-23636 +1 more via wasmtime (>=0.7.0, <=0.37.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0-pre, =0.4.0-pre, =0.0.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.3.0 - inkpad-executor 0.1.0 and more Source cves: CVE-2022-23636, CVE-2022-31169 Source advisory: OSV:RUSTSEC-2022-0101...

@5minlab/serverless-typeorm (1.1.0), @abdelrahmannoaman-mdlabs/group-module (>=1.0.1, <=1.0.68) +2283 more potentially affected by CVE-2022-33171 via typeorm (>=0.0.2-alpha.43, <=0.2.45)

typeorm NPM version =0.0.2-alpha.43, =1.0.1, =3.3.4, =1.0.1, =0.0.1, =0.9.3, =1.0.0, =1.1.126, =1.0.0, =1.0.0, =0.0.1, =0.1.0, =0.1.1 and more Source cves: CVE-2022-33171 Source advisory: OSV:GHSA-FX4W-V43J-VC45...

-tompan-reacttemplate (>=1.0.1, <=1.1.0), 08cms (1.0.0) +17639 more potentially affected by CVE-2022-25758 via scss-tokenizer (>=0.1.2, <=0.4.2)

scss-tokenizer NPM version =0.1.2, =1.0.1, =1.0.4, =1.0.3, =0.2.0, =0.0.1, =0.1.0, =0.1.0, =0.1.276 - 5coder-pages 0.2.0 and more Source cves: CVE-2022-25758 Source advisory: OSV:GHSA-7MWH-4PQV-WMR8...

-llscw-react-cli (>=1.0.0, <=1.1.0), 002-node-cli (1.0.0) +13035 more potentially affected by CVE-2022-25900 via git-clone (>=0.0.2, <=0.1.0)

git-clone NPM version =0.0.2, =1.0.0, =0.0.1, =1.0.0, =1.0.11 and more Source cves: CVE-2022-25900 Source advisory: OSV:GHSA-8JMW-WJR8-2X66...

1batch (1.0.0), 30-lines-telegram-bot (>=1.0.0, <=1.0.1) +4715 more potentially affected by CVE-2022-25896 via passport (>=0.1.3, <=0.5.3)

passport NPM version =0.1.3, =1.0.0, =1.1.0, =4.11.0, =0.1.0, =0.0.1, =1.0.3, =1.0.0-alpha, =1.0.0-beta, =1.0.0, =0.0.1, =1.1.18 and more Source cves: CVE-2022-25896 Source advisory: OSV:GHSA-V923-W3X8-WH69...

Solving the indirect vulnerability enigma - fixing indirect vulnerabilities without breaking your dependency tree

Fixing indirect vulnerabilities is one of those complex, tedious and, quite frankly, boring tasks that no one really wants to touch. No one except for Debricked, it seems. Sure, there are lots of ways to do it manually, but can it be done automatically with minimal risk of breaking changes? The...

abstraps (0.1.8), aivm (>=0.2.0, <=0.3.0) +287 more potentially affected by CVE-2022-31104 via cranelift-codegen (>=0.14.0, <=0.84.0)

cranelift-codegen CARGO version =0.14.0, =0.2.0, =0.1.0, =0.1.0, =0.5.0, =0.1.0, =0.1.0, =0.2.9, =0.1.0, =0.2.0, =0.1.0, =0.1.0, =0.26.1, =0.30.1 and more Source cves: CVE-2022-31104 Source advisory: OSV:GHSA-JQWC-C49R-4W2X...

@candlelabs/sdk (>=1.0.1, <=1.0.2), candlelabssdk (1.0.0) potentially affected by CVE-2022-2217 via parse-url (6.0.0)

parse-url NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-url and may be impacted: - @candlelabs/sdk =1.0.1, =1.0.2 - candlelabssdk 1.0.0 Source cves: CVE-2022-2217 Source advisory: OSV:GHSA-Q6WQ-5P59-983W...

@candlelabs/sdk (>=1.0.1, <=1.0.2), candlelabssdk (1.0.0) potentially affected by CVE-2022-2216 via parse-url (6.0.0)

parse-url NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-url and may be impacted: - @candlelabs/sdk =1.0.1, =1.0.2 - candlelabssdk 1.0.0 Source cves: CVE-2022-2216 Source advisory: OSV:GHSA-7F3X-X4PR-WQHJ...

@candlelabs/sdk (>=1.0.1, <=1.0.2), candlelabssdk (1.0.0) potentially affected by CVE-2022-0722 via parse-url (6.0.0)

parse-url NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-url and may be impacted: - @candlelabs/sdk =1.0.1, =1.0.2 - candlelabssdk 1.0.0 Source cves: CVE-2022-0722 Source advisory: OSV:GHSA-4P35-CFCX-8653...

@candlelabs/sdk (>=1.0.1, <=1.0.2), candlelabssdk (1.0.0) potentially affected by CVE-2022-2218 via parse-url (6.0.0)

parse-url NPM version 6.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on parse-url and may be impacted: - @candlelabs/sdk =1.0.1, =1.0.2 - candlelabssdk 1.0.0 Source cves: CVE-2022-2218 Source advisory: OSV:GHSA-JPP7-7CHH-CF67...

auto-wasi (0.1.0), ceres-executor (>=0.1.0, <=0.2.0) +82 more potentially affected by CVE-2022-31104 via wasmtime (>=0.7.0, <=0.37.0)

wasmtime CARGO version =0.7.0, =0.1.0, =0.1.1, =0.5.3-0, =0.4.0-pre, =0.4.0-pre, =0.0.0, =0.40.1, =0.45.0, =0.10.0, =0.1.0, =0.1.0, =0.3.0 - inkpad-executor 0.1.0 and more Source cves: CVE-2022-31104 Source advisory: OSV:RUSTSEC-2022-0095...

amethyst (>=0.11.0, <=0.15.3), amethyst-console (0.1.0) +200 more potentially affected by unknown CVE via clipboard (>=0.1.2, <=0.5.0)

clipboard CARGO version =0.1.2, =0.11.0, =0.2.0, =0.1.0, =0.8.0, =0.6.0, =0.4.0, =0.8.0, =0.2.0, =0.6.0, =0.1.0, =1.4.0, =0.1.0, =0.1.2 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2022-0056...

@0x5e/react-native-alipay (>=0.2.2, <=0.2.7-beta.2), @10yun/cv-mobile-ui (0.3.20) +1225 more potentially affected by CVE-2022-25898 via jsrsasign (>=4.8.2, <=10.5.24)

jsrsasign NPM version =4.8.2, =0.2.2, =0.7.6, =0.7.6, =0.0.83, =0.7.6, =0.7.6, =0.9.0, =0.7.6, =0.7.6, =0.7.6, =0.3.4, =0.3.4, =0.3.4, =0.3.4, =0.8.0 and more Source cves: CVE-2022-25898 Source advisory: OSV:GHSA-3FVG-4V2M-98JF...