Skip to content

Commit e35835a

Browse files
eoftedaleoftedal
committedSep 19, 2024
Add next.js and dompurify vulns
1 parent 03ba5c5 commit e35835a

5 files changed

+438
-0
lines changed
 

‎repository/jsrepository-master.json

+54
Original file line numberDiff line numberDiff line change
@@ -3174,6 +3174,33 @@
31743174
"bowername": ["dompurify", "DOMPurify"],
31753175
"npmname": "dompurify",
31763176
"vulnerabilities": [
3177+
{
3178+
"ranges": [
3179+
{
3180+
"atOrAbove": "0",
3181+
"below": "2.5.4"
3182+
},
3183+
{
3184+
"atOrAbove": "3.0.0",
3185+
"below": "3.1.3"
3186+
}
3187+
],
3188+
"summary": "DOMPurify allows tampering by prototype pollution",
3189+
"cwe": ["CWE-1321", "CWE-1333"],
3190+
"severity": "high",
3191+
"identifiers": {
3192+
"CVE": ["CVE-2024-45801"],
3193+
"githubID": "GHSA-mmhx-hmjr-r674"
3194+
},
3195+
"info": [
3196+
"https://github.com/advisories/GHSA-mmhx-hmjr-r674",
3197+
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674",
3198+
"https://nvd.nist.gov/vuln/detail/CVE-2024-45801",
3199+
"https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21",
3200+
"https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc",
3201+
"https://github.com/cure53/DOMPurify"
3202+
]
3203+
},
31773204
{
31783205
"ranges": [
31793206
{
@@ -5044,6 +5071,33 @@
50445071
"nextjs": {
50455072
"npmname": "next",
50465073
"vulnerabilities": [
5074+
{
5075+
"ranges": [
5076+
{
5077+
"atOrAbove": "13.5.1",
5078+
"below": "13.5.7"
5079+
},
5080+
{
5081+
"atOrAbove": "14.0.0",
5082+
"below": "14.2.10"
5083+
}
5084+
],
5085+
"summary": "Next.js Cache Poisoning",
5086+
"cwe": ["CWE-349", "CWE-639"],
5087+
"severity": "high",
5088+
"identifiers": {
5089+
"CVE": ["CVE-2024-46982"],
5090+
"githubID": "GHSA-gp8f-8m3g-qvj9"
5091+
},
5092+
"info": [
5093+
"https://github.com/advisories/GHSA-gp8f-8m3g-qvj9",
5094+
"https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9",
5095+
"https://nvd.nist.gov/vuln/detail/CVE-2024-46982",
5096+
"https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3",
5097+
"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda",
5098+
"https://github.com/vercel/next.js"
5099+
]
5100+
},
50475101
{
50485102
"ranges": [
50495103
{

‎repository/jsrepository-v2.json

+96
Original file line numberDiff line numberDiff line change
@@ -4467,6 +4467,54 @@
44674467
"info": [
44684468
"https://github.com/cure53/DOMPurify/releases"
44694469
]
4470+
},
4471+
{
4472+
"atOrAbove": "0",
4473+
"below": "2.5.4",
4474+
"cwe": [
4475+
"CWE-1321",
4476+
"CWE-1333"
4477+
],
4478+
"severity": "high",
4479+
"identifiers": {
4480+
"summary": "DOMPurify allows tampering by prototype pollution",
4481+
"CVE": [
4482+
"CVE-2024-45801"
4483+
],
4484+
"githubID": "GHSA-mmhx-hmjr-r674"
4485+
},
4486+
"info": [
4487+
"https://github.com/advisories/GHSA-mmhx-hmjr-r674",
4488+
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674",
4489+
"https://nvd.nist.gov/vuln/detail/CVE-2024-45801",
4490+
"https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21",
4491+
"https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc",
4492+
"https://github.com/cure53/DOMPurify"
4493+
]
4494+
},
4495+
{
4496+
"atOrAbove": "3.0.0",
4497+
"below": "3.1.3",
4498+
"cwe": [
4499+
"CWE-1321",
4500+
"CWE-1333"
4501+
],
4502+
"severity": "high",
4503+
"identifiers": {
4504+
"summary": "DOMPurify allows tampering by prototype pollution",
4505+
"CVE": [
4506+
"CVE-2024-45801"
4507+
],
4508+
"githubID": "GHSA-mmhx-hmjr-r674"
4509+
},
4510+
"info": [
4511+
"https://github.com/advisories/GHSA-mmhx-hmjr-r674",
4512+
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674",
4513+
"https://nvd.nist.gov/vuln/detail/CVE-2024-45801",
4514+
"https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21",
4515+
"https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc",
4516+
"https://github.com/cure53/DOMPurify"
4517+
]
44704518
}
44714519
],
44724520
"extractors": {
@@ -6777,6 +6825,30 @@
67776825
"https://github.com/vercel/next.js/compare/v13.5.0...v13.5.1"
67786826
]
67796827
},
6828+
{
6829+
"atOrAbove": "13.5.1",
6830+
"below": "13.5.7",
6831+
"cwe": [
6832+
"CWE-349",
6833+
"CWE-639"
6834+
],
6835+
"severity": "high",
6836+
"identifiers": {
6837+
"summary": "Next.js Cache Poisoning",
6838+
"CVE": [
6839+
"CVE-2024-46982"
6840+
],
6841+
"githubID": "GHSA-gp8f-8m3g-qvj9"
6842+
},
6843+
"info": [
6844+
"https://github.com/advisories/GHSA-gp8f-8m3g-qvj9",
6845+
"https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9",
6846+
"https://nvd.nist.gov/vuln/detail/CVE-2024-46982",
6847+
"https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3",
6848+
"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda",
6849+
"https://github.com/vercel/next.js"
6850+
]
6851+
},
67806852
{
67816853
"atOrAbove": "13.4.0",
67826854
"below": "14.1.1",
@@ -6799,6 +6871,30 @@
67996871
"https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085",
68006872
"https://github.com/vercel/next.js"
68016873
]
6874+
},
6875+
{
6876+
"atOrAbove": "14.0.0",
6877+
"below": "14.2.10",
6878+
"cwe": [
6879+
"CWE-349",
6880+
"CWE-639"
6881+
],
6882+
"severity": "high",
6883+
"identifiers": {
6884+
"summary": "Next.js Cache Poisoning",
6885+
"CVE": [
6886+
"CVE-2024-46982"
6887+
],
6888+
"githubID": "GHSA-gp8f-8m3g-qvj9"
6889+
},
6890+
"info": [
6891+
"https://github.com/advisories/GHSA-gp8f-8m3g-qvj9",
6892+
"https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9",
6893+
"https://nvd.nist.gov/vuln/detail/CVE-2024-46982",
6894+
"https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3",
6895+
"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda",
6896+
"https://github.com/vercel/next.js"
6897+
]
68026898
}
68036899
],
68046900
"extractors": {

‎repository/jsrepository-v3.json

+96
Original file line numberDiff line numberDiff line change
@@ -4564,6 +4564,54 @@
45644564
"info": [
45654565
"https://github.com/cure53/DOMPurify/releases"
45664566
]
4567+
},
4568+
{
4569+
"atOrAbove": "0",
4570+
"below": "2.5.4",
4571+
"cwe": [
4572+
"CWE-1321",
4573+
"CWE-1333"
4574+
],
4575+
"severity": "high",
4576+
"identifiers": {
4577+
"summary": "DOMPurify allows tampering by prototype pollution",
4578+
"CVE": [
4579+
"CVE-2024-45801"
4580+
],
4581+
"githubID": "GHSA-mmhx-hmjr-r674"
4582+
},
4583+
"info": [
4584+
"https://github.com/advisories/GHSA-mmhx-hmjr-r674",
4585+
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674",
4586+
"https://nvd.nist.gov/vuln/detail/CVE-2024-45801",
4587+
"https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21",
4588+
"https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc",
4589+
"https://github.com/cure53/DOMPurify"
4590+
]
4591+
},
4592+
{
4593+
"atOrAbove": "3.0.0",
4594+
"below": "3.1.3",
4595+
"cwe": [
4596+
"CWE-1321",
4597+
"CWE-1333"
4598+
],
4599+
"severity": "high",
4600+
"identifiers": {
4601+
"summary": "DOMPurify allows tampering by prototype pollution",
4602+
"CVE": [
4603+
"CVE-2024-45801"
4604+
],
4605+
"githubID": "GHSA-mmhx-hmjr-r674"
4606+
},
4607+
"info": [
4608+
"https://github.com/advisories/GHSA-mmhx-hmjr-r674",
4609+
"https://github.com/cure53/DOMPurify/security/advisories/GHSA-mmhx-hmjr-r674",
4610+
"https://nvd.nist.gov/vuln/detail/CVE-2024-45801",
4611+
"https://github.com/cure53/DOMPurify/commit/1e520262bf4c66b5efda49e2316d6d1246ca7b21",
4612+
"https://github.com/cure53/DOMPurify/commit/26e1d69ca7f769f5c558619d644d90dd8bf26ebc",
4613+
"https://github.com/cure53/DOMPurify"
4614+
]
45674615
}
45684616
],
45694617
"extractors": {
@@ -6939,6 +6987,30 @@
69396987
"https://github.com/vercel/next.js/compare/v13.5.0...v13.5.1"
69406988
]
69416989
},
6990+
{
6991+
"atOrAbove": "13.5.1",
6992+
"below": "13.5.7",
6993+
"cwe": [
6994+
"CWE-349",
6995+
"CWE-639"
6996+
],
6997+
"severity": "high",
6998+
"identifiers": {
6999+
"summary": "Next.js Cache Poisoning",
7000+
"CVE": [
7001+
"CVE-2024-46982"
7002+
],
7003+
"githubID": "GHSA-gp8f-8m3g-qvj9"
7004+
},
7005+
"info": [
7006+
"https://github.com/advisories/GHSA-gp8f-8m3g-qvj9",
7007+
"https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9",
7008+
"https://nvd.nist.gov/vuln/detail/CVE-2024-46982",
7009+
"https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3",
7010+
"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda",
7011+
"https://github.com/vercel/next.js"
7012+
]
7013+
},
69427014
{
69437015
"atOrAbove": "13.4.0",
69447016
"below": "14.1.1",
@@ -6961,6 +7033,30 @@
69617033
"https://github.com/vercel/next.js/commit/8f7a6ca7d21a97bc9f7a1bbe10427b5ad74b9085",
69627034
"https://github.com/vercel/next.js"
69637035
]
7036+
},
7037+
{
7038+
"atOrAbove": "14.0.0",
7039+
"below": "14.2.10",
7040+
"cwe": [
7041+
"CWE-349",
7042+
"CWE-639"
7043+
],
7044+
"severity": "high",
7045+
"identifiers": {
7046+
"summary": "Next.js Cache Poisoning",
7047+
"CVE": [
7048+
"CVE-2024-46982"
7049+
],
7050+
"githubID": "GHSA-gp8f-8m3g-qvj9"
7051+
},
7052+
"info": [
7053+
"https://github.com/advisories/GHSA-gp8f-8m3g-qvj9",
7054+
"https://github.com/vercel/next.js/security/advisories/GHSA-gp8f-8m3g-qvj9",
7055+
"https://nvd.nist.gov/vuln/detail/CVE-2024-46982",
7056+
"https://github.com/vercel/next.js/commit/7ed7f125e07ef0517a331009ed7e32691ba403d3",
7057+
"https://github.com/vercel/next.js/commit/bd164d53af259c05f1ab434004bcfdd3837d7cda",
7058+
"https://github.com/vercel/next.js"
7059+
]
69647060
}
69657061
],
69667062
"extractors": {

0 commit comments

Comments
 (0)
Failed to load comments.