📂 Vulnerable Library - tello-1.2.0.tgz
Digests biscotto metadata
Path to dependency file: /script/package.json
Findings
| Finding |
Severity |
🎯 CVSS |
Exploit Maturity |
EPSS |
Library |
Type |
Fixed in |
Remediation Available |
Reachability |
| CVE-2022-21680 |
🔴 High |
8.7 |
Not Defined |
< 1% |
marked-0.6.3.tgz |
Transitive |
N/A |
❌ |
|
| CVE-2022-21681 |
🔴 High |
8.7 |
Not Defined |
< 1% |
marked-0.6.3.tgz |
Transitive |
N/A |
❌ |
|
| WS-2020-0163 |
🟠 Medium |
5.9 |
N/A |
N/A |
marked-0.6.3.tgz |
Transitive |
N/A |
❌ |
|
| WS-2019-0209 |
🟠 Medium |
5.5 |
N/A |
N/A |
marked-0.6.3.tgz |
Transitive |
N/A |
❌ |
|
| CVE-2021-23358 |
🟡 Low |
1.2 |
Proof of concept |
1.4000001% |
underscore-1.6.0.tgz |
Transitive |
N/A |
❌ |
|
Details
🔴CVE-2022-21680
Vulnerable Library - marked-0.6.3.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.6.3.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
Vulnerability Details
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression "block.def" may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: Jan 14, 2022 12:00 AM
URL: CVE-2022-21680
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-rrrm-qjm4-v8hf
Release Date: Jan 14, 2022 12:00 AM
Fix Resolution : marked - 4.0.10
🔴CVE-2022-21681
Vulnerable Library - marked-0.6.3.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.6.3.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
Vulnerability Details
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression "inline.reflinkSearch" may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: Jan 14, 2022 12:00 AM
URL: CVE-2022-21681
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-5v2h-r2cx-5xgj
Release Date: Jan 14, 2022 12:00 AM
Fix Resolution : marked - 4.0.10
🟠WS-2020-0163
Vulnerable Library - marked-0.6.3.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.6.3.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
Vulnerability Details
marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.
Publish Date: Jul 02, 2020 12:00 AM
URL: WS-2020-0163
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 5.9
Suggested Fix
Type: Upgrade version
Origin: https://github.com/markedjs/marked/releases/tag/v1.1.1
Release Date: Jul 02, 2020 12:00 AM
Fix Resolution : marked - 1.1.1
🟠WS-2019-0209
Vulnerable Library - marked-0.6.3.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.6.3.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
Vulnerability Details
marked before 0.7.0 vulnerable to Redos attack by he _label subrule that may significantly degrade parsing performance of malformed input.
Publish Date: Jul 04, 2019 02:55 PM
URL: WS-2019-0209
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 5.5
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1076
Release Date: Jul 04, 2019 02:55 PM
Fix Resolution : 0.7.0
🟡CVE-2021-23358
Vulnerable Library - underscore-1.6.0.tgz
JavaScript's functional programming helper library.
Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
Vulnerability Details
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Publish Date: Mar 29, 2021 01:15 PM
URL: CVE-2021-23358
Threat Assessment
Exploit Maturity:Proof of concept
EPSS:1.4000001%
Score: 1.2
Suggested Fix
Type: Upgrade version
Origin: GHSA-cf4h-3jhx-xvhq
Release Date: Mar 29, 2021 01:15 PM
Fix Resolution : underscore.js - 1.12.1,underscore - 1.12.1
📂 Vulnerable Library - tello-1.2.0.tgz
Digests biscotto metadata
Path to dependency file: /script/package.json
Findings
Details
🔴CVE-2022-21680
Vulnerable Library - marked-0.6.3.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.6.3.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
markdown-preview-https://www.atom.io/api/packages/markdown-preview/versions/0.160.2/tarball.tgz (Root Library)
tello-1.2.0.tgz (Root Library)
Vulnerability Details
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression "block.def" may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: Jan 14, 2022 12:00 AM
URL: CVE-2022-21680
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-rrrm-qjm4-v8hf
Release Date: Jan 14, 2022 12:00 AM
Fix Resolution : marked - 4.0.10
🔴CVE-2022-21681
Vulnerable Library - marked-0.6.3.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.6.3.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
markdown-preview-https://www.atom.io/api/packages/markdown-preview/versions/0.160.2/tarball.tgz (Root Library)
tello-1.2.0.tgz (Root Library)
Vulnerability Details
Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression "inline.reflinkSearch" may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not use a worker with a time limit may be affected. This issue is patched in version 4.0.10. As a workaround, avoid running untrusted markdown through marked or run marked on a worker thread and set a reasonable time limit to prevent draining resources.
Mend Note: The description of this vulnerability differs from MITRE.
Publish Date: Jan 14, 2022 12:00 AM
URL: CVE-2022-21681
Threat Assessment
Exploit Maturity:Not Defined
EPSS:< 1%
Score: 8.7
Suggested Fix
Type: Upgrade version
Origin: GHSA-5v2h-r2cx-5xgj
Release Date: Jan 14, 2022 12:00 AM
Fix Resolution : marked - 4.0.10
🟠WS-2020-0163
Vulnerable Library - marked-0.6.3.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.6.3.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
markdown-preview-https://www.atom.io/api/packages/markdown-preview/versions/0.160.2/tarball.tgz (Root Library)
tello-1.2.0.tgz (Root Library)
Vulnerability Details
marked before 1.1.1 is vulnerable to Regular Expression Denial of Service (REDoS). rules.js have multiple unused capture groups which can lead to a Denial of Service.
Publish Date: Jul 02, 2020 12:00 AM
URL: WS-2020-0163
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 5.9
Suggested Fix
Type: Upgrade version
Origin: https://github.com/markedjs/marked/releases/tag/v1.1.1
Release Date: Jul 02, 2020 12:00 AM
Fix Resolution : marked - 1.1.1
🟠WS-2019-0209
Vulnerable Library - marked-0.6.3.tgz
A markdown parser built for speed
Library home page: https://registry.npmjs.org/marked/-/marked-0.6.3.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
markdown-preview-https://www.atom.io/api/packages/markdown-preview/versions/0.160.2/tarball.tgz (Root Library)
tello-1.2.0.tgz (Root Library)
Vulnerability Details
marked before 0.7.0 vulnerable to Redos attack by he _label subrule that may significantly degrade parsing performance of malformed input.
Publish Date: Jul 04, 2019 02:55 PM
URL: WS-2019-0209
Threat Assessment
Exploit Maturity:N/A
EPSS:N/A
Score: 5.5
Suggested Fix
Type: Upgrade version
Origin: https://www.npmjs.com/advisories/1076
Release Date: Jul 04, 2019 02:55 PM
Fix Resolution : 0.7.0
🟡CVE-2021-23358
Vulnerable Library - underscore-1.6.0.tgz
JavaScript's functional programming helper library.
Library home page: https://registry.npmjs.org/underscore/-/underscore-1.6.0.tgz
Path to dependency file: /package.json
Dependency Hierarchy:
settings-view-https://www.atom.io/api/packages/settings-view/versions/0.261.3/tarball.tgz (Root Library)
legal-eagle-0.14.0.tgz (Root Library)
tello-1.2.0.tgz (Root Library)
Vulnerability Details
The package underscore from 1.13.0-0 and before 1.13.0-2, from 1.3.2 and before 1.12.1 are vulnerable to Arbitrary Code Injection via the template function, particularly when a variable property is passed as an argument as it is not sanitized.
Publish Date: Mar 29, 2021 01:15 PM
URL: CVE-2021-23358
Threat Assessment
Exploit Maturity:Proof of concept
EPSS:1.4000001%
Score: 1.2
Suggested Fix
Type: Upgrade version
Origin: GHSA-cf4h-3jhx-xvhq
Release Date: Mar 29, 2021 01:15 PM
Fix Resolution : underscore.js - 1.12.1,underscore - 1.12.1