Skip to content

Conversation

@yangsec888
Copy link
Contributor

This PR is related to backend code change below:

Signed-off-by: Sam Li2 sli2@MAC-sli.lan

@@ -12546,11 +28617,12 @@
"vue-debounce": {
"version": "2.6.0",
"resolved": "https://registry.npmjs.org/vue-debounce/-/vue-debounce-2.6.0.tgz",
"integrity": "sha512-afSu/LSIyZv7HjLqqmFwgp4k2OhAGIEa8XVH1MYw/qyf6ly7fJbyfUVOagbFRXP4yl61J0ujMVB31DRY0US6RA=="
"integrity": "sha512-afSu/LSIyZv7HjLqqmFwgp4k2OhAGIEa8XVH1MYw/qyf6ly7fJbyfUVOagbFRXP4yl61J0ujMVB31DRY0US6RA==",
"requires": {}
},
"vue-easy-pie-chart": {
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Severe OSS Vulnerability:

pkg:npm/vue-easy-pie-chart@git%2Bssh://git%40github.com/DependencyTrack/vue-easy-pie-chart.git%23e9a3bcb67b8156bcc422d160f522584a21ab0ff6

0 Critical, 1 Severe, 0 Moderate, 0 Unknown vulnerabilities have been found across 1 dependencies

Components
    pkg:npm/vue@2.6.14
      SEVERE Vulnerabilities (1)

        [sonatype-2019-0454] CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

        vue - Cross-Site Scripting (XSS)

        The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

        CVSS Score: 6.1

        CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

        CWE: CWE-79

Reply with "@sonatype-lift help" for more info.
Reply with "@sonatype-lift ignore" to tell LiftBot to leave out the above finding from this PR.
Reply with "@sonatype-lift ignoreall" to tell LiftBot to leave out all the findings from this PR and from the status bar in Github.

When talking to LiftBot, you need to refresh the page to see its response. Click here to get to know more about LiftBot commands.


Was this a good recommendation?
[ 🙁 Not relevant ] - [ 😕 Won't fix ] - [ 😑 Not critical, will fix ] - [ 🙂 Critical, will fix ] - [ 😊 Critical, fixing now ]

@nscuro
Copy link
Member

nscuro commented Jun 27, 2022

Thanks for the PR @yangsec888! Could you please rebase the PR with the current master? Looks like it's carrying some unrelated changes in Alerts.vue.

Sam Li2 and others added 4 commits June 27, 2022 17:19
Signed-off-by: Sam Li2 <sli2@MAC-sli.lan>
Signed-off-by: Sam Li2 <sli2@MAC-sli.lan>
Hmm it's in by accident.

Signed-off-by: Sam Li2 <sli2@MAC-sli.lan>
Signed-off-by: Sam Li2 <sli2@MAC-sli.lan>
@yangsec888
Copy link
Contributor Author

Sorry I messed up the changes. It should be clean-up now. Please check it out again when you have the chance @nscuro

@nscuro nscuro added this to the 4.6 milestone Jun 27, 2022
@nscuro nscuro merged commit 640e17c into DependencyTrack:master Jun 27, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants