Vulnerable Library - jackson-databind-2.9.9.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /example/quartz-jdbc/pom.xml
Path to vulnerable library: /root/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar
Dependency Hierarchy: - spring-boot-starter-web-2.1.6.RELEASE.jar (Root Library) - spring-boot-starter-json-2.1.6.RELEASE.jar - :x: **jackson-databind-2.9.9.jar** (Vulnerable Library)
Vulnerability Details
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.
Publish Date: 2019-06-19
URL: CVE-2019-12814
CVSS 3 Score Details (5.9)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://github.com/FasterXML/jackson-databind/issues/2341
Release Date: 2019-06-19
Fix Resolution: 2.7.9.6, 2.8.11.4, 2.9.9.1, 2.10.0
Vulnerable Library - jackson-databind-2.9.9.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /example/quartz-jdbc/pom.xml
Path to vulnerable library: /root/.m2/repository/com/fasterxml/jackson/core/jackson-databind/2.9.9/jackson-databind-2.9.9.jar
Dependency Hierarchy: - spring-boot-starter-web-2.1.6.RELEASE.jar (Root Library) - spring-boot-starter-json-2.1.6.RELEASE.jar - :x: **jackson-databind-2.9.9.jar** (Vulnerable Library)
Vulnerability Details
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x through 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint and the service has JDOM 1.x or 2.x jar in the classpath, an attacker can send a specifically crafted JSON message that allows them to read arbitrary local files on the server.
Publish Date: 2019-06-19
URL: CVE-2019-12814
CVSS 3 Score Details (5.9)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://github.com/FasterXML/jackson-databind/issues/2341
Release Date: 2019-06-19
Fix Resolution: 2.7.9.6, 2.8.11.4, 2.9.9.1, 2.10.0
Vulnerable Library - jackson-databind-2.9.2.jarGeneral data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: zaproxy/buildSrc/build.gradle.kts
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.2/1d8d8cb7cf26920ba57fb61fa56da88cc123b21f/jackson-databind-2.9.2.jar
Dependency Hierarchy: - github-api-1.95.jar (Root Library) - :x: **jackson-databind-2.9.2.jar** (Vulnerable Library)
Found in HEAD commit: 13d0feb89469fcd0caba70e9b151d20ad1849e95
Found in base branch: develop
Vulnerability Details
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Publish Date: 2019-05-17
URL: CVE-2019-12086
CVSS 3 Score Details (7.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12086
Release Date: 2019-05-17
Fix Resolution: 2.9.9
Vulnerable Library - jackson-databind-2.9.2.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: zaproxy/buildSrc/build.gradle.kts
Path to vulnerable library: /home/wss-scanner/.gradle/caches/modules-2/files-2.1/com.fasterxml.jackson.core/jackson-databind/2.9.2/1d8d8cb7cf26920ba57fb61fa56da88cc123b21f/jackson-databind-2.9.2.jar
Dependency Hierarchy: - github-api-1.95.jar (Root Library) - :x: **jackson-databind-2.9.2.jar** (Vulnerable Library)
Found in HEAD commit: 13d0feb89469fcd0caba70e9b151d20ad1849e95
Found in base branch: develop
Vulnerability Details
A Polymorphic Typing issue was discovered in FasterXML jackson-databind 2.x before 2.9.9. When Default Typing is enabled (either globally or for a specific property) for an externally exposed JSON endpoint, the service has the mysql-connector-java jar (8.0.14 or earlier) in the classpath, and an attacker can host a crafted MySQL server reachable by the victim, an attacker can send a crafted JSON message that allows them to read arbitrary local files on the server. This occurs because of missing com.mysql.cj.jdbc.admin.MiniAdmin validation.
Publish Date: 2019-05-17
URL: CVE-2019-12086
CVSS 3 Score Details (7.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: None - Availability Impact: None
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-12086
Release Date: 2019-05-17
Fix Resolution: 2.9.9
Your website URL (or attach your complete example):
You can target our live site, since the issue relates to being unable to enter data in the payment forms: https://www.change.org/Your complete test code (or attach your test files):
```js import { t, Selector } from 'testcafe'; fixture('Join Membership with credit card').page('https://www.change.org/'); test('Guest user clicks contribute directly', async () => { await t .navigateTo('s/member') .expect(Selector('[data-testid=""member_landing_page_inline_contribute_button""]').visible) .ok(); await t .click(Selector('[data-testid=""member_landing_page_inline_contribute_button""]'), { speed: 0.3 }) .expect(Selector('[data-testid=""member_payment_form""]').visible) .ok(); await t .click(Selector('[data-testid=""payment-option-button-creditCard')) .expect(Selector('.iframe-form-element').visible) .ok(); const emailAddressInput = Selector('[data-testid=""input_email""]').filterVisible(); const confirmationEmailInput = Selector('[data-testid=""input_confirmation_email""]').filterVisible(); const firstNameInput = Selector('[data-testid=""input_first_name""]'); const lastNameInput = Selector('[data-testid=""input_last_name""]'); await t .typeText(emailAddressInput, 'email@email.com') .typeText(confirmationEmailInput, 'email@email.com') .typeText(firstNameInput, 'Your') .typeText(lastNameInput, 'Name'); await t .switchToIframe(Selector('[data-testid=""credit-card-number""] iframe')) .typeText(Selector('input[name=""cardnumber""]'), '1234123412341234', { replace: true }) .expect(Selector('input[name=""cardnumber""]').value) .eql('1234 1234 1234 1234') .switchToMainWindow(); }); ```Your complete configuration file (if any):
``` N/A ```Your complete test report:
``` Guest user clicks contribute directly 1) AssertionError: expected '' to deeply equal '1234 1234 1234 1234' Browser: Safari 13.0.5 / macOS 10.15.3 31 | 32 | await t 33 | .switchToIframe(Selector('[data-testid=""credit-card-number""] iframe')) 34 | .typeText(Selector('input[name=""cardnumber""]'), '1234123412341234', { replace: true }) 35 | .expect(Selector('input[name=""cardnumber""]').value) > 36 | .eql('1234 1234 1234 1234') 37 | .switchToMainWindow(); 38 |}); 39 | atScreenshots:
``` N/A ```Your website URL (or attach your complete example):
You can target our live site, since the issue relates to being unable to enter data in the payment forms: https://www.change.org/Your complete test code (or attach your test files):
```js import { t, Selector } from 'testcafe'; fixture('Join Membership with credit card').page('https://www.change.org/'); test('Guest user clicks contribute directly', async () => { await t .navigateTo('s/member') .expect(Selector('[data-testid=""member_landing_page_inline_contribute_button""]').visible) .ok(); await t .click(Selector('[data-testid=""member_landing_page_inline_contribute_button""]'), { speed: 0.3 }) .expect(Selector('[data-testid=""member_payment_form""]').visible) .ok(); await t .click(Selector('[data-testid=""payment-option-button-creditCard')) .expect(Selector('.iframe-form-element').visible) .ok(); const emailAddressInput = Selector('[data-testid=""input_email""]').filterVisible(); const confirmationEmailInput = Selector('[data-testid=""input_confirmation_email""]').filterVisible(); const firstNameInput = Selector('[data-testid=""input_first_name""]'); const lastNameInput = Selector('[data-testid=""input_last_name""]'); await t .typeText(emailAddressInput, 'email@email.com') .typeText(confirmationEmailInput, 'email@email.com') .typeText(firstNameInput, 'Your') .typeText(lastNameInput, 'Name'); await t .switchToIframe(Selector('[data-testid=""credit-card-number""] iframe')) .typeText(Selector('input[name=""cardnumber""]'), '1234123412341234', { replace: true }) .expect(Selector('input[name=""cardnumber""]').value) .eql('1234 1234 1234 1234') .switchToMainWindow(); }); ```Your complete configuration file (if any):
``` N/A ```Your complete test report:
``` Guest user clicks contribute directly 1) AssertionError: expected '' to deeply equal '1234 1234 1234 1234' Browser: Safari 13.0.5 / macOS 10.15.3 31 | 32 | await t 33 | .switchToIframe(Selector('[data-testid=""credit-card-number""] iframe')) 34 | .typeText(Selector('input[name=""cardnumber""]'), '1234123412341234', { replace: true }) 35 | .expect(Selector('input[name=""cardnumber""]').value) > 36 | .eql('1234 1234 1234 1234') 37 | .switchToMainWindow(); 38 |}); 39 | atScreenshots:
``` N/A ```Browser Configuration
- mixed active content blocked: false
- image.mem.shared: true
- buildID: 20190622041859
- tracking content blocked: false
- gfx.webrender.blob-images: true
- hasTouchScreen: true
- mixed passive content blocked: false
- gfx.webrender.enabled: false
- gfx.webrender.all: false
- channel: default
Console Messages:
[u'[JavaScript Warning: ""The resource at https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js was blocked because content blocking is enabled."" {file: ""https://smallbusiness.chron.com/rename-dual-boot-windows-start-up-63870.html"" line: 0}]', u'[JavaScript Warning: ""The resource at https://cdn.taboola.com/libtrc/hearstlocalnews-chronmobile/loader.js was blocked because content blocking is enabled."" {file: ""https://smallbusiness.chron.com/rename-dual-boot-windows-start-up-63870.html"" line: 0}]', u'[JavaScript Warning: ""The resource at https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js was blocked because content blocking is enabled."" {file: ""https://smallbusiness.chron.com/rename-dual-boot-windows-start-up-63870.html"" line: 0}]', u'[JavaScript Warning: ""The resource at https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js was blocked because content blocking is enabled."" {file: ""https://smallbusiness.chron.com/rename-dual-boot-windows-start-up-63870.html"" line: 0}]', u'[JavaScript Warning: ""The resource at https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js was blocked because content blocking is enabled."" {file: ""https://smallbusiness.chron.com/rename-dual-boot-windows-start-up-63870.html"" line: 0}]', u'[JavaScript Warning: ""The resource at https://nexus.ensighten.com/hearst/news-3p/Bootstrap.js was blocked because content blocking is enabled."" {file: ""https://smallbusiness.chron.com/rename-dual-boot-windows-start-up-63870.html"" line: 0}]', u'[JavaScript Warning: ""Loading failed for the
`);
}
else
res.end();
})
.listen(4100);
```
#### Provide the test code and the tested page URL (if applicable)
Test code
```js
import { Role, ClientFunction, Selector } from 'testcafe';
fixture `Test authentication`
.page `http://localhost:4100/`;
const role = Role(`http://localhost:4100/#login`, async t => await t.click('input'), { preserveUrl: true });
test('first login', async t => {
await t
.wait(3000)
.useRole(role)
.expect(Selector('h1').innerText).eql('Authorized');
});
test('second login', async t => {
await t
.wait(3000)
.useRole(role)
.expect(Selector('h1').innerText).eql('Authorized');
});
```
### Workaround
```js
import { Role, ClientFunction, Selector } from 'testcafe';
fixture `Test authentication`
.page `http://localhost:4100/`;
const role = Role(`http://localhost:4100/#login`, async t => await t.click('input'), { preserveUrl: true });
const reloadPage = new ClientFunction(() => location.reload(true));
const fixedUseRole = async (t, role) => {
await t.useRole(role);
await reloadPage();
};
test('first login', async t => {
await t.wait(3000)
await fixedUseRole(t, role);
await t.expect(Selector('h1').innerText).eql('Authorized');
});
test('second login', async t => {
await t.wait(3000)
await fixedUseRole(t, role);
await t.expect(Selector('h1').innerText).eql('Authorized');
});
```
### Specify your
* testcafe version: 0.19.0",1.0,"Role doesn't work when page navigation doesn't trigger page reloading - ### Are you requesting a feature or reporting a bug?
bug
### What is the current behavior?
Role doesn't work after first-time initialization. `Cookie`, `localStorage` and `sessionStorage` should be restored when a preserved page is loaded but the page changes only the hash and it isn't reloaded after navigating.
### What is the expected behavior?
Page must be reloaded after the `useRole` function call.
### How would you reproduce the current behavior (if this is a bug)?
Node server:
```js
const http = require('http');
http
.createServer((req, res) => {
if (req.url === '/') {
res.writeHead(200, { 'content-type': 'text/html' });
res.end(`
log in
`);
}
else
res.end();
})
.listen(4100);
```
#### Provide the test code and the tested page URL (if applicable)
Test code
```js
import { Role, ClientFunction, Selector } from 'testcafe';
fixture `Test authentication`
.page `http://localhost:4100/`;
const role = Role(`http://localhost:4100/#login`, async t => await t.click('input'), { preserveUrl: true });
test('first login', async t => {
await t
.wait(3000)
.useRole(role)
.expect(Selector('h1').innerText).eql('Authorized');
});
test('second login', async t => {
await t
.wait(3000)
.useRole(role)
.expect(Selector('h1').innerText).eql('Authorized');
});
```
### Workaround
```js
import { Role, ClientFunction, Selector } from 'testcafe';
fixture `Test authentication`
.page `http://localhost:4100/`;
const role = Role(`http://localhost:4100/#login`, async t => await t.click('input'), { preserveUrl: true });
const reloadPage = new ClientFunction(() => location.reload(true));
const fixedUseRole = async (t, role) => {
await t.useRole(role);
await reloadPage();
};
test('first login', async t => {
await t.wait(3000)
await fixedUseRole(t, role);
await t.expect(Selector('h1').innerText).eql('Authorized');
});
test('second login', async t => {
await t.wait(3000)
await fixedUseRole(t, role);
await t.expect(Selector('h1').innerText).eql('Authorized');
});
```
### Specify your
* testcafe version: 0.19.0",1,role doesn t work when page navigation doesn t trigger page reloading are you requesting a feature or reporting a bug bug what is the current behavior role doesn t work after first time initialization cookie localstorage and sessionstorage should be restored when a preserved page is loaded but the page changes only the hash and it isn t reloaded after navigating what is the expected behavior page must be reloaded after the userole function call how would you reproduce the current behavior if this is a bug node server js const http require http http createserver req res if req url res writehead content type text html res end log in var onhashchange function var newhash location hash if newhash if localstorage getitem isloggedin header textcontent authorized header style display block anchor style display none button style display none else header textcontent unauthorized anchor style display block button style display none else if newhash login if localstorage getitem isloggedin return location hash header style display none anchor style display none button style display block button addeventlistener click function localstorage setitem isloggedin true location hash onhashchange window addeventlistener hashchange onhashchange else res end listen provide the test code and the tested page url if applicable test code js import role clientfunction selector from testcafe fixture test authentication page const role role async t await t click input preserveurl true test first login async t await t wait userole role expect selector innertext eql authorized test second login async t await t wait userole role expect selector innertext eql authorized workaround js import role clientfunction selector from testcafe fixture test authentication page const role role async t await t click input preserveurl true const reloadpage new clientfunction location reload true const fixeduserole async t role await t userole role await reloadpage test first login async t await t wait await fixeduserole t role await t expect selector innertext eql authorized test second login async t await t wait await fixeduserole t role await t expect selector innertext eql authorized specify your testcafe version ,1
169943,20841989809.0,IssuesEvent,2022-03-21 02:02:07,michaeldotson/mini-capstone-vue-app,https://api.github.com/repos/michaeldotson/mini-capstone-vue-app,opened,CVE-2022-24772 (High) detected in node-forge-0.7.5.tgz,security vulnerability,"## CVE-2022-24772 - High Severity Vulnerability
Vulnerable Library - node-forge-0.7.5.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz
Path to dependency file: /mini-capstone-vue-app/package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- cli-service-3.5.1.tgz (Root Library)
- webpack-dev-server-3.2.1.tgz
- selfsigned-1.10.4.tgz
- :x: **node-forge-0.7.5.tgz** (Vulnerable Library)
Vulnerability Details
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24772
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772
Release Date: 2022-03-18
Fix Resolution: node-forge - 1.3.0
***
Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)",True,"CVE-2022-24772 (High) detected in node-forge-0.7.5.tgz - ## CVE-2022-24772 - High Severity Vulnerability
Vulnerable Library - node-forge-0.7.5.tgz
JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.
Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.7.5.tgz
Path to dependency file: /mini-capstone-vue-app/package.json
Path to vulnerable library: /node_modules/node-forge/package.json
Dependency Hierarchy:
- cli-service-3.5.1.tgz (Root Library)
- webpack-dev-server-3.2.1.tgz
- selfsigned-1.10.4.tgz
- :x: **node-forge-0.7.5.tgz** (Vulnerable Library)
Vulnerability Details
Forge (also called `node-forge`) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a `DigestInfo` ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in `node-forge` version 1.3.0. There are currently no known workarounds.
Publish Date: 2022-03-18
URL: CVE-2022-24772
CVSS 3 Score Details (7.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: None
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: None
- Integrity Impact: High
- Availability Impact: None
For more information on CVSS3 Scores, click here.
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772
Release Date: 2022-03-18
Fix Resolution: node-forge - 1.3.0
***
Step up your Open Source Security Game with WhiteSource [here](https://www.whitesourcesoftware.com/full_solution_bolt_github)",0,cve high detected in node forge tgz cve high severity vulnerability vulnerable library node forge tgz javascript implementations of network transports cryptography ciphers pki message digests and various utilities library home page a href path to dependency file mini capstone vue app package json path to vulnerable library node modules node forge package json dependency hierarchy cli service tgz root library webpack dev server tgz selfsigned tgz x node forge tgz vulnerable library vulnerability details forge also called node forge is a native implementation of transport layer security in javascript prior to version rsa pkcs signature verification code does not check for tailing garbage bytes after decoding a digestinfo asn structure this can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used the issue has been addressed in node forge version there are currently no known workarounds publish date url a href cvss score details base score metrics exploitability metrics attack vector network attack complexity low privileges required none user interaction none scope unchanged impact metrics confidentiality impact none integrity impact high availability impact none for more information on scores click a href suggested fix type upgrade version origin a href release date fix resolution node forge step up your open source security game with whitesource ,0
1622,10469215037.0,IssuesEvent,2019-09-22 19:08:08,a-t-0/Productivity-phone,https://api.github.com/repos/a-t-0/Productivity-phone,opened,Sync multiple calenders with davdroid at once,Automation,"Currently, setting up the syncing with the (google) calendars is performed poorly automated by emulating human touch programatically on the phone from a pc.
Davdroid has (random) request for donating, which disables the control/click flow, which leads to a async between commands given from pc and input required on phone.
To solve, modify the davdroid so that it just asks the entire groups containing lists of calendar urls at once (copy pastable with single press, or enterable via api), and asking the username and password only once per group (or reading the username from the input).",1.0,"Sync multiple calenders with davdroid at once - Currently, setting up the syncing with the (google) calendars is performed poorly automated by emulating human touch programatically on the phone from a pc.
Davdroid has (random) request for donating, which disables the control/click flow, which leads to a async between commands given from pc and input required on phone.
To solve, modify the davdroid so that it just asks the entire groups containing lists of calendar urls at once (copy pastable with single press, or enterable via api), and asking the username and password only once per group (or reading the username from the input).",1,sync multiple calenders with davdroid at once currently setting up the syncing with the google calendars is performed poorly automated by emulating human touch programatically on the phone from a pc davdroid has random request for donating which disables the control click flow which leads to a async between commands given from pc and input required on phone to solve modify the davdroid so that it just asks the entire groups containing lists of calendar urls at once copy pastable with single press or enterable via api and asking the username and password only once per group or reading the username from the input ,1
8151,26282565131.0,IssuesEvent,2023-01-07 13:18:52,ita-social-projects/TeachUA,https://api.github.com/repos/ita-social-projects/TeachUA,closed,[Advanced search] Different spelling of center title 'Школа мистецтв імені Миколи Дмитровича Леонтовича',bug Backend Priority: Low Automation,"**Environment:** Windows 11, Google Chrome Version 107.0.5304.107 (Official Build) (64-bit).
**Reproducible:** always.
**Build found:** last commit [7652f37](https://github.com/ita-social-projects/TeachUA/commit/7652f37a2d6de58fe02b06fb38c91acef4b623c7)
**Preconditions**
1. Go to the webpage: https://speak-ukrainian.org.ua/dev/
2. Go to 'Гуртки' tab.
3. Click on 'Розширений пошук' button.
**Steps to reproduce**
1. Click on 'Центр' radio button.
2. Make sure that 'Київ' city is selected (if not, select it).
3. Set 'Район міста' as 'Деснянський'.
4. Click on the center with title 'Школа мистецтв імені Миколи Дмитровича Леонтовича'.
5. Pay attention to the spelling of that title.
6. Go to a database.
7. Execute the following query:
SELECT DISTINCT c.name
FROM centers as c
INNER JOIN locations as l ON c.id=l.center_id
INNER JOIN cities as ct ON l.city_id=ct.id
INNER JOIN districts as ds ON l.district_id=ds.id
WHERE ct.name = 'Київ'
AND ds.name = 'Деснянський';
8. Double-click on the center title 'Школа мистецтв імені Миколи Дмитровича Леонтовича'.
**Actual result**
There are two spaces between the words 'Дмитровича' and 'Леонтовича' on DB.
UI:
DB:
**Expected result**
Center with title 'Школа мистецтв імені Миколи Дмитровича Леонтовича' should have spelled the same on UI and DB (with one space between the words 'Дмитровича' and 'Леонтовича').
**User story and test case links**
User story #274
[Test case](https://jira.softserve.academy/browse/TUA-455)
**Labels to be added**
""Bug"", Priority (""pri: "").
",1.0,"[Advanced search] Different spelling of center title 'Школа мистецтв імені Миколи Дмитровича Леонтовича' - **Environment:** Windows 11, Google Chrome Version 107.0.5304.107 (Official Build) (64-bit).
**Reproducible:** always.
**Build found:** last commit [7652f37](https://github.com/ita-social-projects/TeachUA/commit/7652f37a2d6de58fe02b06fb38c91acef4b623c7)
**Preconditions**
1. Go to the webpage: https://speak-ukrainian.org.ua/dev/
2. Go to 'Гуртки' tab.
3. Click on 'Розширений пошук' button.
**Steps to reproduce**
1. Click on 'Центр' radio button.
2. Make sure that 'Київ' city is selected (if not, select it).
3. Set 'Район міста' as 'Деснянський'.
4. Click on the center with title 'Школа мистецтв імені Миколи Дмитровича Леонтовича'.
5. Pay attention to the spelling of that title.
6. Go to a database.
7. Execute the following query:
SELECT DISTINCT c.name
FROM centers as c
INNER JOIN locations as l ON c.id=l.center_id
INNER JOIN cities as ct ON l.city_id=ct.id
INNER JOIN districts as ds ON l.district_id=ds.id
WHERE ct.name = 'Київ'
AND ds.name = 'Деснянський';
8. Double-click on the center title 'Школа мистецтв імені Миколи Дмитровича Леонтовича'.
**Actual result**
There are two spaces between the words 'Дмитровича' and 'Леонтовича' on DB.
UI:
DB:
**Expected result**
Center with title 'Школа мистецтв імені Миколи Дмитровича Леонтовича' should have spelled the same on UI and DB (with one space between the words 'Дмитровича' and 'Леонтовича').
**User story and test case links**
User story #274
[Test case](https://jira.softserve.academy/browse/TUA-455)
**Labels to be added**
""Bug"", Priority (""pri: "").
",1, different spelling of center title школа мистецтв імені миколи дмитровича леонтовича environment windows google chrome version official build bit reproducible always build found last commit preconditions go to the webpage go to гуртки tab click on розширений пошук button steps to reproduce click on центр radio button make sure that київ city is selected if not select it set район міста as деснянський click on the center with title школа мистецтв імені миколи дмитровича леонтовича pay attention to the spelling of that title go to a database execute the following query select distinct c name from centers as c inner join locations as l on c id l center id inner join cities as ct on l city id ct id inner join districts as ds on l district id ds id where ct name київ and ds name деснянський double click on the center title школа мистецтв імені миколи дмитровича леонтовича actual result there are two spaces between the words дмитровича and леонтовича on db ui db expected result center with title школа мистецтв імені миколи дмитровича леонтовича should have spelled the same on ui and db with one space between the words дмитровича and леонтовича user story and test case links user story labels to be added bug priority pri ,1
1926,11103549389.0,IssuesEvent,2019-12-17 04:21:03,bandprotocol/d3n,https://api.github.com/repos/bandprotocol/d3n,closed,Run EVM bridge automated test for every PR / commit,automation bridge chore,Setup CI to run tests for every push that affects `bridge/evm` directory.,1.0,Run EVM bridge automated test for every PR / commit - Setup CI to run tests for every push that affects `bridge/evm` directory.,1,run evm bridge automated test for every pr commit setup ci to run tests for every push that affects bridge evm directory ,1
214628,16568902759.0,IssuesEvent,2021-05-30 01:43:21,SHOPFIFTEEN/FIFTEEN_FRONT,https://api.github.com/repos/SHOPFIFTEEN/FIFTEEN_FRONT,opened,1-34. 상품관리-등록 관한 Issue,bug documentation,"오류를 재연하기 위해 필요한 조치 (즉, 어떻게 하여 오류를 발견하였나)
관리자 화면에서 상품 등록 시 배송비, 할인율 등 숫자로 입력해야 하는 부분을 글자로 등록 시도
예상했던 동작이나 결과
해당 부분을 어떤 방식으로 수정해야 한다는 경고창 표시
실제 나타난 동작이나 결과
경고창 표시 없이 등록만 불가(어느 부분이 오류인지 확인 불가)
가능한 경우 오류 수정을 위한 제안.
어느 부분이 오류인지 경고창으로 표시할 수 있도록 수정 필요",1.0,"1-34. 상품관리-등록 관한 Issue - 오류를 재연하기 위해 필요한 조치 (즉, 어떻게 하여 오류를 발견하였나)
관리자 화면에서 상품 등록 시 배송비, 할인율 등 숫자로 입력해야 하는 부분을 글자로 등록 시도
예상했던 동작이나 결과
해당 부분을 어떤 방식으로 수정해야 한다는 경고창 표시
실제 나타난 동작이나 결과
경고창 표시 없이 등록만 불가(어느 부분이 오류인지 확인 불가)
가능한 경우 오류 수정을 위한 제안.
어느 부분이 오류인지 경고창으로 표시할 수 있도록 수정 필요",0, 상품관리 등록 관한 issue 오류를 재연하기 위해 필요한 조치 즉 어떻게 하여 오류를 발견하였나 관리자 화면에서 상품 등록 시 배송비 할인율 등 숫자로 입력해야 하는 부분을 글자로 등록 시도 예상했던 동작이나 결과 해당 부분을 어떤 방식으로 수정해야 한다는 경고창 표시 실제 나타난 동작이나 결과 경고창 표시 없이 등록만 불가 어느 부분이 오류인지 확인 불가 가능한 경우 오류 수정을 위한 제안 어느 부분이 오류인지 경고창으로 표시할 수 있도록 수정 필요,0
7469,24946537777.0,IssuesEvent,2022-11-01 01:04:36,dannytsang/homeassistant-config,https://api.github.com/repos/dannytsang/homeassistant-config,opened, Change automations to ⌛timers,automations integration: smartthings,"Similar to #63 but for all other automations that use the ""for"" parameter in automation triggers.
Checklist:
- [ ] Bedroom heated blankets
- [ ] Fans
- [ ] Switches",1.0," Change automations to ⌛timers - Similar to #63 but for all other automations that use the ""for"" parameter in automation triggers.
Checklist:
- [ ] Bedroom heated blankets
- [ ] Fans
- [ ] Switches",1, change automations to ⌛timers similar to but for all other automations that use the for parameter in automation triggers checklist bedroom heated blankets fans switches,1
404,6229997195.0,IssuesEvent,2017-07-11 06:35:23,VP-Technologies/assistant-server,https://api.github.com/repos/VP-Technologies/assistant-server,opened,Implement Creation of Devices DB,automation,"Follow the spec from the doc, and creating a test script with fake devices.",1.0,"Implement Creation of Devices DB - Follow the spec from the doc, and creating a test script with fake devices.",1,implement creation of devices db follow the spec from the doc and creating a test script with fake devices ,1
5978,21781161857.0,IssuesEvent,2022-05-13 19:05:29,dotnet/arcade,https://api.github.com/repos/dotnet/arcade,closed,CG work for dotnet-helix-machines,First Responder Detected By - Automation Helix-Machines Operations,"To drive our CG alert to Zero, please address the following items.
https://dnceng.visualstudio.com/internal/_componentGovernance/dotnet-helix-machines?_a=alerts&typeId=6377838&alerts-view-option=active
We need to address anything with a medium (or higher) priority",1.0,"CG work for dotnet-helix-machines - To drive our CG alert to Zero, please address the following items.
https://dnceng.visualstudio.com/internal/_componentGovernance/dotnet-helix-machines?_a=alerts&typeId=6377838&alerts-view-option=active
We need to address anything with a medium (or higher) priority",1,cg work for dotnet helix machines to drive our cg alert to zero please address the following items we need to address anything with a medium or higher priority,1
4588,16961498009.0,IssuesEvent,2021-06-29 04:59:42,ecotiya/wicum,https://api.github.com/repos/ecotiya/wicum,opened,自動ビルド及び自動テストの導入,automation,"# 【機能要件】
・自動ビルド及び自動テストの導入。
・とりあえずAWSのデプロイまで完了したあとに余裕があったらやる。
# 【タスク】
- [ ] task1
- [ ] task2
- [ ] task3
# 【調査事項】
",1.0,"自動ビルド及び自動テストの導入 - # 【機能要件】
・自動ビルド及び自動テストの導入。
・とりあえずAWSのデプロイまで完了したあとに余裕があったらやる。
# 【タスク】
- [ ] task1
- [ ] task2
- [ ] task3
# 【調査事項】
",1,自動ビルド及び自動テストの導入 【機能要件】 ・自動ビルド及び自動テストの導入。 ・とりあえずawsのデプロイまで完了したあとに余裕があったらやる。 【タスク】 【調査事項】 ,1
2392,11862563563.0,IssuesEvent,2020-03-25 18:09:16,elastic/metricbeat-tests-poc,https://api.github.com/repos/elastic/metricbeat-tests-poc,closed,Validate Helm charts,automation,"Let's use a BDD approach to validate the official Helm charts for elastic. Something like this:
```gherkin
@helm
@k8s
@metricbeat
Feature: The Helm chart is following product recommended configuration for Kubernetes
Scenario: The Metricbeat chart will create recommended K8S resources
Given a cluster is running
When the ""metricbeat"" Elastic's helm chart is installed
Then a pod will be deployed on each node of the cluster by a DaemonSet
And a ""Deployment"" will manage additional pods for metricsets querying internal services
And a ""kube-state-metrics"" chart will retrieve specific Kubernetes metrics
And a ""ConfigMap"" resource contains the ""metricbeat.yml"" content
And a ""ConfigMap"" resource contains the ""kube-state-metrics-metricbeat.yml"" content
And a ""ServiceAccount"" resource manages RBAC
And a ""ClusterRole"" resource manages RBAC
And a ""ClusterRoleBinding"" resource manages RBAC
```",1.0,"Validate Helm charts - Let's use a BDD approach to validate the official Helm charts for elastic. Something like this:
```gherkin
@helm
@k8s
@metricbeat
Feature: The Helm chart is following product recommended configuration for Kubernetes
Scenario: The Metricbeat chart will create recommended K8S resources
Given a cluster is running
When the ""metricbeat"" Elastic's helm chart is installed
Then a pod will be deployed on each node of the cluster by a DaemonSet
And a ""Deployment"" will manage additional pods for metricsets querying internal services
And a ""kube-state-metrics"" chart will retrieve specific Kubernetes metrics
And a ""ConfigMap"" resource contains the ""metricbeat.yml"" content
And a ""ConfigMap"" resource contains the ""kube-state-metrics-metricbeat.yml"" content
And a ""ServiceAccount"" resource manages RBAC
And a ""ClusterRole"" resource manages RBAC
And a ""ClusterRoleBinding"" resource manages RBAC
```",1,validate helm charts let s use a bdd approach to validate the official helm charts for elastic something like this gherkin helm metricbeat feature the helm chart is following product recommended configuration for kubernetes scenario the metricbeat chart will create recommended resources given a cluster is running when the metricbeat elastic s helm chart is installed then a pod will be deployed on each node of the cluster by a daemonset and a deployment will manage additional pods for metricsets querying internal services and a kube state metrics chart will retrieve specific kubernetes metrics and a configmap resource contains the metricbeat yml content and a configmap resource contains the kube state metrics metricbeat yml content and a serviceaccount resource manages rbac and a clusterrole resource manages rbac and a clusterrolebinding resource manages rbac ,1
62496,6798459654.0,IssuesEvent,2017-11-02 05:45:28,minishift/minishift,https://api.github.com/repos/minishift/minishift,closed,make integration failed for cmd-openshift feature,component/integration-test kind/bug priority/major status/needs-info,"```
$ make integration GODOG_OPTS=""-tags cmd-openshift -format pretty""
go install -pkgdir=/home/amit/go/src/github.com/minishift/minishift/out/bindata -ldflags=""-X github.com/minishift/minishift/pkg/version.minishiftVersion=1.5.0 -X github.com/minishift/minishift/pkg/version.b2dIsoVersion=v1.1.0 -X github.com/minishift/minishift/pkg/version.centOsIsoVersion=v1.1.0 -X github.com/minishift/minishift/pkg/version.openshiftVersion=v3.6.0 -X github.com/minishift/minishift/pkg/version.commitSha=0e75c4ec"" ./cmd/minishift
mkdir -p /home/amit/go/src/github.com/minishift/minishift/out/integration-test
go test -timeout 3600s github.com/minishift/minishift/test/integration --tags=integration -v -args --test-dir /home/amit/go/src/github.com/minishift/minishift/out/integration-test --binary /home/amit/go/bin/minishift -tags cmd-openshift -format pretty
Test run using Boot2Docker iso image.
Keeping Minishift cache directory '/home/amit/go/src/github.com/minishift/minishift/out/integration-test/cache' for test run.
Log successfully started, logging into: /home/amit/go/src/github.com/minishift/minishift/out/integration-test/integration.log
Running Integration test in: /home/amit/go/src/github.com/minishift/minishift/out/integration-test
Using binary: /home/amit/go/bin/minishift
Feature: Basic
As a user I can perform basic operations of Minishift and OpenShift
Feature: Openshift commands
Commands ""minishift openshift [sub-command]"" are used for interaction with Openshift
cluster in VM provided by Minishift.
.
.
.
Scenario: Getting existing service without route # features/cmd-openshift.feature:67
When executing ""minishift openshift service nodejs-ex"" succeeds # integration_test.go:652 -> github.com/minishift/minishift/test/integration.executingMinishiftCommandSucceedsOrFails
Then stdout should contain ""nodejs-ex"" # integration_test.go:594 -> github.com/minishift/minishift/test/integration.commandReturnShouldContain
Output did not match. Expected: 'nodejs-ex', Actual: '|-----------|------|----------|-----------|--------|
| NAMESPACE | NAME | NODEPORT | ROUTE-URL | WEIGHT |
|-----------|------|----------|-----------|--------|
|-----------|------|----------|-----------|--------|
'
And stdout should not match
""""""
^http:\/\/nodejs-ex-myproject\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.nip\.io
""""""
Scenario: Getting existing service with route # features/cmd-openshift.feature:100
When executing ""minishift openshift service nodejs-ex"" succeeds # integration_test.go:652 -> github.com/minishift/minishift/test/integration.executingMinishiftCommandSucceedsOrFails
Then stdout should contain ""nodejs-ex"" # integration_test.go:594 -> github.com/minishift/minishift/test/integration.commandReturnShouldContain
Output did not match. Expected: 'nodejs-ex', Actual: '|-----------|------|----------|-----------|--------|
| NAMESPACE | NAME | NODEPORT | ROUTE-URL | WEIGHT |
|-----------|------|----------|-----------|--------|
|-----------|------|----------|-----------|--------|
'
And stdout should match
""""""
http:\/\/nodejs-ex-myproject\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.nip\.io
""""""
.
.
.
--- Failed scenarios:
features/cmd-openshift.feature:39
features/cmd-openshift.feature:69
features/cmd-openshift.feature:93
features/cmd-openshift.feature:102
features/cmd-openshift.feature:110
18 scenarios (13 passed, 5 failed)
48 steps (38 passed, 5 failed, 5 skipped)
2m22.19907923s
testing: warning: no tests to run
PASS
exit status 1
FAIL github.com/minishift/minishift/test/integration 142.214s
make: *** [Makefile:176: integration] Error 1
18:17 $
```",1.0,"make integration failed for cmd-openshift feature - ```
$ make integration GODOG_OPTS=""-tags cmd-openshift -format pretty""
go install -pkgdir=/home/amit/go/src/github.com/minishift/minishift/out/bindata -ldflags=""-X github.com/minishift/minishift/pkg/version.minishiftVersion=1.5.0 -X github.com/minishift/minishift/pkg/version.b2dIsoVersion=v1.1.0 -X github.com/minishift/minishift/pkg/version.centOsIsoVersion=v1.1.0 -X github.com/minishift/minishift/pkg/version.openshiftVersion=v3.6.0 -X github.com/minishift/minishift/pkg/version.commitSha=0e75c4ec"" ./cmd/minishift
mkdir -p /home/amit/go/src/github.com/minishift/minishift/out/integration-test
go test -timeout 3600s github.com/minishift/minishift/test/integration --tags=integration -v -args --test-dir /home/amit/go/src/github.com/minishift/minishift/out/integration-test --binary /home/amit/go/bin/minishift -tags cmd-openshift -format pretty
Test run using Boot2Docker iso image.
Keeping Minishift cache directory '/home/amit/go/src/github.com/minishift/minishift/out/integration-test/cache' for test run.
Log successfully started, logging into: /home/amit/go/src/github.com/minishift/minishift/out/integration-test/integration.log
Running Integration test in: /home/amit/go/src/github.com/minishift/minishift/out/integration-test
Using binary: /home/amit/go/bin/minishift
Feature: Basic
As a user I can perform basic operations of Minishift and OpenShift
Feature: Openshift commands
Commands ""minishift openshift [sub-command]"" are used for interaction with Openshift
cluster in VM provided by Minishift.
.
.
.
Scenario: Getting existing service without route # features/cmd-openshift.feature:67
When executing ""minishift openshift service nodejs-ex"" succeeds # integration_test.go:652 -> github.com/minishift/minishift/test/integration.executingMinishiftCommandSucceedsOrFails
Then stdout should contain ""nodejs-ex"" # integration_test.go:594 -> github.com/minishift/minishift/test/integration.commandReturnShouldContain
Output did not match. Expected: 'nodejs-ex', Actual: '|-----------|------|----------|-----------|--------|
| NAMESPACE | NAME | NODEPORT | ROUTE-URL | WEIGHT |
|-----------|------|----------|-----------|--------|
|-----------|------|----------|-----------|--------|
'
And stdout should not match
""""""
^http:\/\/nodejs-ex-myproject\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.nip\.io
""""""
Scenario: Getting existing service with route # features/cmd-openshift.feature:100
When executing ""minishift openshift service nodejs-ex"" succeeds # integration_test.go:652 -> github.com/minishift/minishift/test/integration.executingMinishiftCommandSucceedsOrFails
Then stdout should contain ""nodejs-ex"" # integration_test.go:594 -> github.com/minishift/minishift/test/integration.commandReturnShouldContain
Output did not match. Expected: 'nodejs-ex', Actual: '|-----------|------|----------|-----------|--------|
| NAMESPACE | NAME | NODEPORT | ROUTE-URL | WEIGHT |
|-----------|------|----------|-----------|--------|
|-----------|------|----------|-----------|--------|
'
And stdout should match
""""""
http:\/\/nodejs-ex-myproject\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.nip\.io
""""""
.
.
.
--- Failed scenarios:
features/cmd-openshift.feature:39
features/cmd-openshift.feature:69
features/cmd-openshift.feature:93
features/cmd-openshift.feature:102
features/cmd-openshift.feature:110
18 scenarios (13 passed, 5 failed)
48 steps (38 passed, 5 failed, 5 skipped)
2m22.19907923s
testing: warning: no tests to run
PASS
exit status 1
FAIL github.com/minishift/minishift/test/integration 142.214s
make: *** [Makefile:176: integration] Error 1
18:17 $
```",0,make integration failed for cmd openshift feature make integration godog opts tags cmd openshift format pretty go install pkgdir home amit go src github com minishift minishift out bindata ldflags x github com minishift minishift pkg version minishiftversion x github com minishift minishift pkg version x github com minishift minishift pkg version centosisoversion x github com minishift minishift pkg version openshiftversion x github com minishift minishift pkg version commitsha cmd minishift mkdir p home amit go src github com minishift minishift out integration test go test timeout github com minishift minishift test integration tags integration v args test dir home amit go src github com minishift minishift out integration test binary home amit go bin minishift tags cmd openshift format pretty test run using iso image keeping minishift cache directory home amit go src github com minishift minishift out integration test cache for test run log successfully started logging into home amit go src github com minishift minishift out integration test integration log running integration test in home amit go src github com minishift minishift out integration test using binary home amit go bin minishift feature basic as a user i can perform basic operations of minishift and openshift feature openshift commands commands minishift openshift are used for interaction with openshift cluster in vm provided by minishift scenario getting existing service without route features cmd openshift feature when executing minishift openshift service nodejs ex succeeds integration test go github com minishift minishift test integration executingminishiftcommandsucceedsorfails then stdout should contain nodejs ex integration test go github com minishift minishift test integration commandreturnshouldcontain output did not match expected nodejs ex actual namespace name nodeport route url weight and stdout should not match http nodejs ex myproject nip io scenario getting existing service with route features cmd openshift feature when executing minishift openshift service nodejs ex succeeds integration test go github com minishift minishift test integration executingminishiftcommandsucceedsorfails then stdout should contain nodejs ex integration test go github com minishift minishift test integration commandreturnshouldcontain output did not match expected nodejs ex actual namespace name nodeport route url weight and stdout should match http nodejs ex myproject nip io failed scenarios features cmd openshift feature features cmd openshift feature features cmd openshift feature features cmd openshift feature features cmd openshift feature scenarios passed failed steps passed failed skipped testing warning no tests to run pass exit status fail github com minishift minishift test integration make error ,0
6040,21940581337.0,IssuesEvent,2022-05-23 17:39:12,pharmaverse/admiral,https://api.github.com/repos/pharmaverse/admiral,closed,Create workflow to automatically create man files,automation,"The workflow should be triggered whenever something is pushed to `devel` or `master`, run `devtools::document()` and commited any updated file in the `man` folder.",1.0,"Create workflow to automatically create man files - The workflow should be triggered whenever something is pushed to `devel` or `master`, run `devtools::document()` and commited any updated file in the `man` folder.",1,create workflow to automatically create man files the workflow should be triggered whenever something is pushed to devel or master run devtools document and commited any updated file in the man folder ,1
137052,11097825807.0,IssuesEvent,2019-12-16 14:07:13,zeebe-io/zeebe,https://api.github.com/repos/zeebe-io/zeebe,closed,LogStreamTest.shouldCloseLogStream unstabled,Status: Needs Review Type: Maintenance Type: Unstable Test,"**Description**
Failed sometimes in the CI.
```
[ERROR] Tests run: 4, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 2.074 s <<< FAILURE! - in io.zeebe.logstreams.log.LogStreamTest
[ERROR] io.zeebe.logstreams.log.LogStreamTest.shouldCloseLogStream Time elapsed: 0.683 s <<< FAILURE!
java.lang.AssertionError:
Expecting code to raise a throwable.
at io.zeebe.logstreams.log.LogStreamTest.shouldCloseLogStream(LogStreamTest.java:91)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
at org.junit.rules.RunRules.evaluate(RunRules.java:20)
at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
at org.junit.runners.Suite.runChild(Suite.java:128)
at org.junit.runners.Suite.runChild(Suite.java:27)
at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
at org.apache.maven.surefire.junitcore.JUnitCore.run(JUnitCore.java:55)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.createRequestAndRun(JUnitCoreWrapper.java:137)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.executeLazy(JUnitCoreWrapper.java:119)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.execute(JUnitCoreWrapper.java:87)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.execute(JUnitCoreWrapper.java:75)
at org.apache.maven.surefire.junitcore.JUnitCoreProvider.invoke(JUnitCoreProvider.java:158)
at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:377)
at org.apache.maven.surefire.booter.ForkedBooter.execute(ForkedBooter.java:138)
at org.apache.maven.surefire.booter.ForkedBooter.run(ForkedBooter.java:465)
at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:451)
```
Output:
```
12:13:49.119 [] [main] INFO io.zeebe.test - Test finished: shouldCreateNewLogStreamBatchWriter(io.zeebe.logstreams.log.LogStreamTest)
12:13:49.120 [] [main] INFO io.zeebe.test - Test started: shouldCloseLogStream(io.zeebe.logstreams.log.LogStreamTest)
12:13:49.313 [io.zeebe.logstreams.impl.LogStreamBuilder$1] [-zb-actors-3] WARN io.zeebe.logstreams - Unexpected non-empty log failed to read the last block
12:13:49.318 [io.zeebe.logstreams.impl.log.LogStreamImpl] [-zb-actors-3] WARN io.zeebe.logstreams - Unexpected non-empty log failed to read the last block
12:13:49.533 [io.zeebe.logstreams.impl.log.LogStreamImpl] [-zb-actors-1] DEBUG io.zeebe.logstreams - Configured log appender back pressure at partition 0 as AppenderVegasCfg{initialLimit=1024, maxConcurrency=32768, alphaLimit=0.7, betaLimit=0.95}. Window limiting is disabled
12:13:49.600 [io.zeebe.logstreams.impl.log.LogStreamImpl] [-zb-actors-3] INFO io.zeebe.logstreams - Close appender for log stream 0
12:13:49.601 [0-write-buffer] [-zb-actors-3] DEBUG io.zeebe.dispatcher - Dispatcher closed
12:13:49.602 [io.zeebe.logstreams.impl.log.LogStreamImpl] [-zb-actors-1] INFO io.zeebe.logstreams - On closing logstream 0 close 1 readers
12:13:49.603 [io.zeebe.logstreams.impl.log.LogStreamImpl] [-zb-actors-1] INFO io.zeebe.logstreams - Close log storage with name 0
```",1.0,"LogStreamTest.shouldCloseLogStream unstabled - **Description**
Failed sometimes in the CI.
```
[ERROR] Tests run: 4, Failures: 1, Errors: 0, Skipped: 0, Time elapsed: 2.074 s <<< FAILURE! - in io.zeebe.logstreams.log.LogStreamTest
[ERROR] io.zeebe.logstreams.log.LogStreamTest.shouldCloseLogStream Time elapsed: 0.683 s <<< FAILURE!
java.lang.AssertionError:
Expecting code to raise a throwable.
at io.zeebe.logstreams.log.LogStreamTest.shouldCloseLogStream(LogStreamTest.java:91)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.base/java.lang.reflect.Method.invoke(Method.java:566)
at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
at org.junit.rules.ExternalResource$1.evaluate(ExternalResource.java:48)
at org.junit.rules.RunRules.evaluate(RunRules.java:20)
at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78)
at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57)
at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
at org.junit.runners.Suite.runChild(Suite.java:128)
at org.junit.runners.Suite.runChild(Suite.java:27)
at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
at org.apache.maven.surefire.junitcore.JUnitCore.run(JUnitCore.java:55)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.createRequestAndRun(JUnitCoreWrapper.java:137)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.executeLazy(JUnitCoreWrapper.java:119)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.execute(JUnitCoreWrapper.java:87)
at org.apache.maven.surefire.junitcore.JUnitCoreWrapper.execute(JUnitCoreWrapper.java:75)
at org.apache.maven.surefire.junitcore.JUnitCoreProvider.invoke(JUnitCoreProvider.java:158)
at org.apache.maven.surefire.booter.ForkedBooter.runSuitesInProcess(ForkedBooter.java:377)
at org.apache.maven.surefire.booter.ForkedBooter.execute(ForkedBooter.java:138)
at org.apache.maven.surefire.booter.ForkedBooter.run(ForkedBooter.java:465)
at org.apache.maven.surefire.booter.ForkedBooter.main(ForkedBooter.java:451)
```
Output:
```
12:13:49.119 [] [main] INFO io.zeebe.test - Test finished: shouldCreateNewLogStreamBatchWriter(io.zeebe.logstreams.log.LogStreamTest)
12:13:49.120 [] [main] INFO io.zeebe.test - Test started: shouldCloseLogStream(io.zeebe.logstreams.log.LogStreamTest)
12:13:49.313 [io.zeebe.logstreams.impl.LogStreamBuilder$1] [-zb-actors-3] WARN io.zeebe.logstreams - Unexpected non-empty log failed to read the last block
12:13:49.318 [io.zeebe.logstreams.impl.log.LogStreamImpl] [-zb-actors-3] WARN io.zeebe.logstreams - Unexpected non-empty log failed to read the last block
12:13:49.533 [io.zeebe.logstreams.impl.log.LogStreamImpl] [-zb-actors-1] DEBUG io.zeebe.logstreams - Configured log appender back pressure at partition 0 as AppenderVegasCfg{initialLimit=1024, maxConcurrency=32768, alphaLimit=0.7, betaLimit=0.95}. Window limiting is disabled
12:13:49.600 [io.zeebe.logstreams.impl.log.LogStreamImpl] [-zb-actors-3] INFO io.zeebe.logstreams - Close appender for log stream 0
12:13:49.601 [0-write-buffer] [-zb-actors-3] DEBUG io.zeebe.dispatcher - Dispatcher closed
12:13:49.602 [io.zeebe.logstreams.impl.log.LogStreamImpl] [-zb-actors-1] INFO io.zeebe.logstreams - On closing logstream 0 close 1 readers
12:13:49.603 [io.zeebe.logstreams.impl.log.LogStreamImpl] [-zb-actors-1] INFO io.zeebe.logstreams - Close log storage with name 0
```",0,logstreamtest shouldcloselogstream unstabled description failed sometimes in the ci tests run failures errors skipped time elapsed s failure in io zeebe logstreams log logstreamtest io zeebe logstreams log logstreamtest shouldcloselogstream time elapsed s failure java lang assertionerror expecting code to raise a throwable at io zeebe logstreams log logstreamtest shouldcloselogstream logstreamtest java at java base jdk internal reflect nativemethodaccessorimpl native method at java base jdk internal reflect nativemethodaccessorimpl invoke nativemethodaccessorimpl java at java base jdk internal reflect delegatingmethodaccessorimpl invoke delegatingmethodaccessorimpl java at java base java lang reflect method invoke method java at org junit runners model frameworkmethod runreflectivecall frameworkmethod java at org junit internal runners model reflectivecallable run reflectivecallable java at org junit runners model frameworkmethod invokeexplosively frameworkmethod java at org junit internal runners statements invokemethod evaluate invokemethod java at org junit internal runners statements runbefores evaluate runbefores java at org junit rules externalresource evaluate externalresource java at org junit rules externalresource evaluate externalresource java at org junit rules runrules evaluate runrules java at org junit runners parentrunner runleaf parentrunner java at org junit runners runchild java at org junit runners runchild java at org junit runners parentrunner run parentrunner java at org junit runners parentrunner schedule parentrunner java at org junit runners parentrunner runchildren parentrunner java at org junit runners parentrunner access parentrunner java at org junit runners parentrunner evaluate parentrunner java at org junit runners parentrunner run parentrunner java at org junit runners suite runchild suite java at org junit runners suite runchild suite java at org junit runners parentrunner run parentrunner java at org junit runners parentrunner schedule parentrunner java at org junit runners parentrunner runchildren parentrunner java at org junit runners parentrunner access parentrunner java at org junit runners parentrunner evaluate parentrunner java at org junit runners parentrunner run parentrunner java at org apache maven surefire junitcore junitcore run junitcore java at org apache maven surefire junitcore junitcorewrapper createrequestandrun junitcorewrapper java at org apache maven surefire junitcore junitcorewrapper executelazy junitcorewrapper java at org apache maven surefire junitcore junitcorewrapper execute junitcorewrapper java at org apache maven surefire junitcore junitcorewrapper execute junitcorewrapper java at org apache maven surefire junitcore junitcoreprovider invoke junitcoreprovider java at org apache maven surefire booter forkedbooter runsuitesinprocess forkedbooter java at org apache maven surefire booter forkedbooter execute forkedbooter java at org apache maven surefire booter forkedbooter run forkedbooter java at org apache maven surefire booter forkedbooter main forkedbooter java output info io zeebe test test finished shouldcreatenewlogstreambatchwriter io zeebe logstreams log logstreamtest info io zeebe test test started shouldcloselogstream io zeebe logstreams log logstreamtest warn io zeebe logstreams unexpected non empty log failed to read the last block warn io zeebe logstreams unexpected non empty log failed to read the last block debug io zeebe logstreams configured log appender back pressure at partition as appendervegascfg initiallimit maxconcurrency alphalimit betalimit window limiting is disabled info io zeebe logstreams close appender for log stream debug io zeebe dispatcher dispatcher closed info io zeebe logstreams on closing logstream close readers info io zeebe logstreams close log storage with name ,0
281243,30888436302.0,IssuesEvent,2023-08-04 01:19:37,hshivhare67/kernel_v4.1.15,https://api.github.com/repos/hshivhare67/kernel_v4.1.15,reopened,CVE-2017-12762 (Critical) detected in linuxlinux-4.6,Mend: dependency security vulnerability,"## CVE-2017-12762 - Critical Severity Vulnerability
Vulnerable Library - linuxlinux-4.6
The Linux Kernel
Library home page: https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/?wsslib=linux
Found in base branch: master
Vulnerable Source Files (2)
/drivers/isdn/i4l/isdn_common.c
/drivers/isdn/i4l/isdn_common.c
Vulnerability Details
In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree.
Publish Date: 2017-08-09
URL: CVE-2017-12762
CVSS 3 Score Details (9.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Release Date: 2017-08-09
Fix Resolution: 3.18.64,v4.13-rc4,4.12.5,4.4.80,4.9.41
Vulnerable Library - linuxlinux-4.6
The Linux Kernel
Library home page: https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/?wsslib=linux
Found in base branch: master
Vulnerable Source Files (2)
/drivers/isdn/i4l/isdn_common.c
/drivers/isdn/i4l/isdn_common.c
Vulnerability Details
In /drivers/isdn/i4l/isdn_net.c: A user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check which can cause a buffer overflow. This affects the Linux kernel 4.9-stable tree, 4.12-stable tree, 3.18-stable tree, and 4.4-stable tree.
Publish Date: 2017-08-09
URL: CVE-2017-12762
CVSS 3 Score Details (9.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Release Date: 2017-08-09
Fix Resolution: 3.18.64,v4.13-rc4,4.12.5,4.4.80,4.9.41
Vulnerable Libraries - bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz
bootstrap-3.3.7.tgz
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.3.7.tgz
Path to dependency file: angular/package.json
Path to vulnerable library: angular/node_modules/bootstrap
Dependency Hierarchy: - angular-benchpress-0.2.2.tgz (Root Library) - :x: **bootstrap-3.3.7.tgz** (Vulnerable Library)
bootstrap-3.1.1.tgz
Sleek, intuitive, and powerful front-end framework for faster and easier web development.
Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.1.1.tgz
Path to dependency file: angular/package.json
Path to vulnerable library: angular/node_modules/bootstrap
Dependency Hierarchy: - :x: **bootstrap-3.1.1.tgz** (Vulnerable Library)
Found in HEAD commit: 72f7fdba608ab5ba7ff145a21673661d5316ebaa
Found in base branch: master
Vulnerability Details
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
Publish Date: 2019-01-09
URL: CVE-2018-20677
CVSS 3 Score Details (6.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677
Release Date: 2019-01-09
Fix Resolution: Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0
Vulnerable Libraries - bootstrap-3.3.7.tgz, bootstrap-3.1.1.tgz
bootstrap-3.3.7.tgz
The most popular front-end framework for developing responsive, mobile first projects on the web.
Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.3.7.tgz
Path to dependency file: angular/package.json
Path to vulnerable library: angular/node_modules/bootstrap
Dependency Hierarchy: - angular-benchpress-0.2.2.tgz (Root Library) - :x: **bootstrap-3.3.7.tgz** (Vulnerable Library)
bootstrap-3.1.1.tgz
Sleek, intuitive, and powerful front-end framework for faster and easier web development.
Library home page: https://registry.npmjs.org/bootstrap/-/bootstrap-3.1.1.tgz
Path to dependency file: angular/package.json
Path to vulnerable library: angular/node_modules/bootstrap
Dependency Hierarchy: - :x: **bootstrap-3.1.1.tgz** (Vulnerable Library)
Found in HEAD commit: 72f7fdba608ab5ba7ff145a21673661d5316ebaa
Found in base branch: master
Vulnerability Details
In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.
Publish Date: 2019-01-09
URL: CVE-2018-20677
CVSS 3 Score Details (6.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-20677
Release Date: 2019-01-09
Fix Resolution: Bootstrap - v3.4.0;NorDroN.AngularTemplate - 0.1.6;Dynamic.NET.Express.ProjectTemplates - 0.8.0;dotnetng.template - 1.0.0.4;ZNxtApp.Core.Module.Theme - 1.0.9-Beta;JMeter - 5.0.0
Vulnerable Library - select2-4.0.0.tgz
Select2 is a jQuery based replacement for select boxes. It supports searching, remote data sets, and infinite scrolling of results.
Library home page: https://registry.npmjs.org/select2/-/select2-4.0.0.tgz
Path to dependency file: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/package.json
Path to vulnerable library: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/node_modules/select2/package.json
Dependency Hierarchy: - :x: **select2-4.0.0.tgz** (Vulnerable Library)
Found in base branch: trunk
Vulnerability Details
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
Publish Date: 2019-03-27
URL: CVE-2016-10744
CVSS 3 Score Details (6.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10744
Release Date: 2019-03-27
Fix Resolution: 4.0.8
Vulnerable Library - select2-4.0.0.tgz
Select2 is a jQuery based replacement for select boxes. It supports searching, remote data sets, and infinite scrolling of results.
Library home page: https://registry.npmjs.org/select2/-/select2-4.0.0.tgz
Path to dependency file: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/package.json
Path to vulnerable library: /hadoop-yarn-project/hadoop-yarn/hadoop-yarn-ui/src/main/webapp/node_modules/select2/package.json
Dependency Hierarchy: - :x: **select2-4.0.0.tgz** (Vulnerable Library)
Found in base branch: trunk
Vulnerability Details
In Select2 through 4.0.5, as used in Snipe-IT and other products, rich selectlists allow XSS. This affects use cases with Ajax remote data loading when HTML templates are used to display listbox data.
Publish Date: 2019-03-27
URL: CVE-2016-10744
CVSS 3 Score Details (6.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-10744
Release Date: 2019-03-27
Fix Resolution: 4.0.8
Vulnerable Libraries - json5-1.0.1.tgz, json5-2.2.0.tgz, json5-0.5.1.tgz
json5-1.0.1.tgz
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz
Path to dependency file: /console2/package.json
Path to vulnerable library: /console2/node_modules/html-webpack-plugin/node_modules/json5/package.json,/console2/node_modules/tsconfig-paths/node_modules/json5/package.json,/console2/node_modules/resolve-url-loader/node_modules/json5/package.json,/console2/node_modules/postcss-loader/node_modules/json5/package.json,/console2/node_modules/babel-loader/node_modules/json5/package.json,/console2/node_modules/mini-css-extract-plugin/node_modules/json5/package.json,/console2/node_modules/webpack/node_modules/json5/package.json
Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - babel-loader-8.1.0.tgz - loader-utils-1.4.0.tgz - :x: **json5-1.0.1.tgz** (Vulnerable Library)
json5-2.2.0.tgz
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-2.2.0.tgz
Path to dependency file: /console2/package.json
Path to vulnerable library: /console2/node_modules/json5/package.json
Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - core-7.12.3.tgz - :x: **json5-2.2.0.tgz** (Vulnerable Library)
json5-0.5.1.tgz
JSON for the ES5 era.
Library home page: https://registry.npmjs.org/json5/-/json5-0.5.1.tgz
Path to dependency file: /console2/package.json
Path to vulnerable library: /console2/node_modules/babel-register/node_modules/json5/package.json,/console2/node_modules/babel-cli/node_modules/json5/package.json
Dependency Hierarchy: - babel-cli-6.26.0.tgz (Root Library) - babel-core-6.26.3.tgz - :x: **json5-0.5.1.tgz** (Vulnerable Library)
Found in HEAD commit: b9420f3b9e73a9d381266ece72f7afb756f35a76
Found in base branch: master
Vulnerability Details
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including version `2.2.1` does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 version 2.2.2 and later.
Publish Date: 2022-12-24
URL: CVE-2022-46175
CVSS 3 Score Details (7.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: Low - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution: json5 - 2.2.2
Vulnerable Libraries - json5-1.0.1.tgz, json5-2.2.0.tgz, json5-0.5.1.tgz
json5-1.0.1.tgz
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz
Path to dependency file: /console2/package.json
Path to vulnerable library: /console2/node_modules/html-webpack-plugin/node_modules/json5/package.json,/console2/node_modules/tsconfig-paths/node_modules/json5/package.json,/console2/node_modules/resolve-url-loader/node_modules/json5/package.json,/console2/node_modules/postcss-loader/node_modules/json5/package.json,/console2/node_modules/babel-loader/node_modules/json5/package.json,/console2/node_modules/mini-css-extract-plugin/node_modules/json5/package.json,/console2/node_modules/webpack/node_modules/json5/package.json
Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - babel-loader-8.1.0.tgz - loader-utils-1.4.0.tgz - :x: **json5-1.0.1.tgz** (Vulnerable Library)
json5-2.2.0.tgz
JSON for humans.
Library home page: https://registry.npmjs.org/json5/-/json5-2.2.0.tgz
Path to dependency file: /console2/package.json
Path to vulnerable library: /console2/node_modules/json5/package.json
Dependency Hierarchy: - react-scripts-4.0.3.tgz (Root Library) - core-7.12.3.tgz - :x: **json5-2.2.0.tgz** (Vulnerable Library)
json5-0.5.1.tgz
JSON for the ES5 era.
Library home page: https://registry.npmjs.org/json5/-/json5-0.5.1.tgz
Path to dependency file: /console2/package.json
Path to vulnerable library: /console2/node_modules/babel-register/node_modules/json5/package.json,/console2/node_modules/babel-cli/node_modules/json5/package.json
Dependency Hierarchy: - babel-cli-6.26.0.tgz (Root Library) - babel-core-6.26.3.tgz - :x: **json5-0.5.1.tgz** (Vulnerable Library)
Found in HEAD commit: b9420f3b9e73a9d381266ece72f7afb756f35a76
Found in base branch: master
Vulnerability Details
JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The `parse` method of the JSON5 library before and including version `2.2.1` does not restrict parsing of keys named `__proto__`, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by `JSON5.parse` and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from `JSON5.parse`. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. `JSON5.parse` should restrict parsing of `__proto__` keys when parsing JSON strings to objects. As a point of reference, the `JSON.parse` method included in JavaScript ignores `__proto__` keys. Simply changing `JSON5.parse` to `JSON.parse` in the examples above mitigates this vulnerability. This vulnerability is patched in json5 version 2.2.2 and later.
Publish Date: 2022-12-24
URL: CVE-2022-46175
CVSS 3 Score Details (7.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: High - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: Low - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175
Release Date: 2022-12-24
Fix Resolution: json5 - 2.2.2
Apparently, even if you use mediaserver, the css and js in cache are not using CDN feature, as the images do.
You should write a Htaccess rule to handle the /themes/[theme]/assets/cache, and use media server url in header when calling the css
",1.0,"[BOOM-3849] css & js should use CDN when activated - > This issue has been migrated from this Forge ticket [http://forge.prestashop.com/browse/BOOM-3849](http://forge.prestashop.com/browse/BOOM-3849) - _**Reporter:**_ jmawad@bobbies.com - _**Created at:**_ Fri, 15 Sep 2017 12:28:15 +0200Apparently, even if you use mediaserver, the css and js in cache are not using CDN feature, as the images do.
You should write a Htaccess rule to handle the /themes/[theme]/assets/cache, and use media server url in header when calling the css
",1, css js should use cdn when activated this issue has been migrated from this forge ticket reporter jmawad bobbies com created at fri sep apparently even if you use mediaserver the css and js in cache are not using cdn feature as the images do you should write a htaccess rule to handle the themes theme assets cache and use media server url in header when calling the css ,1 40824,10583043295.0,IssuesEvent,2019-10-08 12:57:07,ocaml/opam,https://api.github.com/repos/ocaml/opam,closed,Solaris 10 patch command doesn't get file to patch,AREA: BUILD AREA: PORTABILITY,"After editing opam-full-1.2.2-rc2/src_ext/Makefile to remove suppression of recipe echoing: ... if [ -d patches/cmdliner ]; then \ cd cmdliner && \ for p in ../patches/cmdliner/*.patch; do \ patch -p1 < $p; \ done; \ fi Looks like a unified context diff. File to patch: That is, the patch command prompts the user. opam-full-1.2.2-rc2/src_ext/patches/cmdliner/backport_pre_4_00_0.patch diff -Naur cmdliner-0.9.7/src/cmdliner.ml cmdliner-0.9.7.patched/src/cmdliner.ml --- cmdliner-0.9.7/src/cmdliner.ml 2015-02-06 11:33:44.000000000 +0100 +++ cmdliner-0.9.7.patched/src/cmdliner.ml 2015-02-18 23:04:04.000000000 +0100 ... See the man page for the Solaris 10 patch command. http://docs.oracle.com/cd/E19253-01/816-5165/6mbb0m9n6/index.html In particular, we are interested in the ""File Name Determination"" section of that document. If no file operand is specified, patch performs the following steps to obtain a path name: If the patch contains the strings **\* and - - -, patch strips components from the beginning of each path name (depending on the presence or value of the -p option), then tests for the existence of both files in the current directory ... src/cmdliner.ml src/cmdliner.ml ""Both"" files exist. If both files exist, patch assumes that no path name can be obtained from this step ... If no path name can be obtained by applying the previous steps, ... patch will write a prompt to standard output and request a file name interactively from standard input. One possible solution is for the makefile to read the patch file, extracting the path name using the Linux patch command algorithm. Then feed that path name to the patch command explicitly. Alan Feldstein Cosmic Horizon http://www.alanfeldstein.com ",1.0,"Solaris 10 patch command doesn't get file to patch - After editing opam-full-1.2.2-rc2/src_ext/Makefile to remove suppression of recipe echoing: ... if [ -d patches/cmdliner ]; then \ cd cmdliner && \ for p in ../patches/cmdliner/*.patch; do \ patch -p1 < $p; \ done; \ fi Looks like a unified context diff. File to patch: That is, the patch command prompts the user. opam-full-1.2.2-rc2/src_ext/patches/cmdliner/backport_pre_4_00_0.patch diff -Naur cmdliner-0.9.7/src/cmdliner.ml cmdliner-0.9.7.patched/src/cmdliner.ml --- cmdliner-0.9.7/src/cmdliner.ml 2015-02-06 11:33:44.000000000 +0100 +++ cmdliner-0.9.7.patched/src/cmdliner.ml 2015-02-18 23:04:04.000000000 +0100 ... See the man page for the Solaris 10 patch command. http://docs.oracle.com/cd/E19253-01/816-5165/6mbb0m9n6/index.html In particular, we are interested in the ""File Name Determination"" section of that document. If no file operand is specified, patch performs the following steps to obtain a path name: If the patch contains the strings **\* and - - -, patch strips components from the beginning of each path name (depending on the presence or value of the -p option), then tests for the existence of both files in the current directory ... src/cmdliner.ml src/cmdliner.ml ""Both"" files exist. If both files exist, patch assumes that no path name can be obtained from this step ... If no path name can be obtained by applying the previous steps, ... patch will write a prompt to standard output and request a file name interactively from standard input. One possible solution is for the makefile to read the patch file, extracting the path name using the Linux patch command algorithm. Then feed that path name to the patch command explicitly. Alan Feldstein Cosmic Horizon http://www.alanfeldstein.com ",0,solaris patch command doesn t get file to patch after editing opam full src ext makefile to remove suppression of recipe echoing if then cd cmdliner for p in patches cmdliner patch do patch p done fi looks like a unified context diff file to patch that is the patch command prompts the user opam full src ext patches cmdliner backport pre patch diff naur cmdliner src cmdliner ml cmdliner patched src cmdliner ml cmdliner src cmdliner ml cmdliner patched src cmdliner ml see the man page for the solaris patch command in particular we are interested in the file name determination section of that document if no file operand is specified patch performs the following steps to obtain a path name if the patch contains the strings and patch strips components from the beginning of each path name depending on the presence or value of the p option then tests for the existence of both files in the current directory src cmdliner ml src cmdliner ml both files exist if both files exist patch assumes that no path name can be obtained from this step if no path name can be obtained by applying the previous steps patch will write a prompt to standard output and request a file name interactively from standard input one possible solution is for the makefile to read the patch file extracting the path name using the linux patch command algorithm then feed that path name to the patch command explicitly alan feldstein cosmic horizon ,0 2467,12059707107.0,IssuesEvent,2020-04-15 19:46:41,BCDevOps/OpenShift4-RollOut,https://api.github.com/repos/BCDevOps/OpenShift4-RollOut,opened,Upgrade Aporeto For Use with OCP4,tech/automation tech/networking,"Tasks: - [x] Upgrade Aporeto Playbook for current Aporeto Release - [x] Ensure Cordon/Evac Install and Upgrades work as expected - [ ] Upgrade BCGov Network Policy Operator to a supported Operator-SDK version and Test - [x] Write Host Protection Policies - [ ] Move any remaining policy, enforcer, or namespace related policy configuration to NS Management Playbook - [ ] Verify Host Protection is Enabled and Working properly with Assistance from DXC I'll continue adding to this with further detail as things progress. As of today (April 15th 2020) I'm testing the playbook and making some additional changes to ensure host protection works ",1.0,"Upgrade Aporeto For Use with OCP4 - Tasks: - [x] Upgrade Aporeto Playbook for current Aporeto Release - [x] Ensure Cordon/Evac Install and Upgrades work as expected - [ ] Upgrade BCGov Network Policy Operator to a supported Operator-SDK version and Test - [x] Write Host Protection Policies - [ ] Move any remaining policy, enforcer, or namespace related policy configuration to NS Management Playbook - [ ] Verify Host Protection is Enabled and Working properly with Assistance from DXC I'll continue adding to this with further detail as things progress. As of today (April 15th 2020) I'm testing the playbook and making some additional changes to ensure host protection works ",1,upgrade aporeto for use with tasks upgrade aporeto playbook for current aporeto release ensure cordon evac install and upgrades work as expected upgrade bcgov network policy operator to a supported operator sdk version and test write host protection policies move any remaining policy enforcer or namespace related policy configuration to ns management playbook verify host protection is enabled and working properly with assistance from dxc i ll continue adding to this with further detail as things progress as of today april i m testing the playbook and making some additional changes to ensure host protection works ,1 4221,15823876563.0,IssuesEvent,2021-04-06 01:53:41,DevExpress/testcafe,https://api.github.com/repos/DevExpress/testcafe,closed,Fix simulation of 'click' event in drag action,AREA: client FREQUENCY: level 1 STATE: Need improvement STATE: Stale SYSTEM: automations,"We should check that we simulate/skip simulation for `click` event in the end of `drag` action just like the browser does. Take into account the following points: 1) prevention of previous events (mouseup, pointerup, touchup, etc) 2) if drag action is executed for really draggable elements or not 3) touch emulation specificity 4) different browsers specificity",1.0,"Fix simulation of 'click' event in drag action - We should check that we simulate/skip simulation for `click` event in the end of `drag` action just like the browser does. Take into account the following points: 1) prevention of previous events (mouseup, pointerup, touchup, etc) 2) if drag action is executed for really draggable elements or not 3) touch emulation specificity 4) different browsers specificity",1,fix simulation of click event in drag action we should check that we simulate skip simulation for click event in the end of drag action just like the browser does take into account the following points prevention of previous events mouseup pointerup touchup etc if drag action is executed for really draggable elements or not touch emulation specificity different browsers specificity,1 45880,5756917367.0,IssuesEvent,2017-04-26 01:36:58,Microsoft/vscode,https://api.github.com/repos/Microsoft/vscode,opened,Test plan for Emmet features from extension using new APIs,testplan-item,"Test item for #21943 Complexity: 4 **Pre-req for testing** - Clone the repo for the extension https://github.com/Microsoft/vscode-emmet - Run `vsce package` to get the six - Side load the extension by `code-insiders --install-extension emmet-0.0.1.vsix` **Suggestion Items** - As you type an abbreviation, the suggestion list should show the expanded abbreviation. Can be turned off by disabling `emmet.suggestExpandedAbbreviation` - As you type an abbreviation, all possible abbreviations should show in the suggestion list. Can be turned off by disabling `emmet.suggestAbbreviations` **Commands to test:** - _Emmet 2.0: Expand abbreviation_ - The selected text or the text preceeding the cursor if no text is selected is taken as the abbreviation to expand. - Works with html, xml, jade, slim, haml files and css,scss,sass, less, stylus files - _Emmet 2.0: Wrap with abbreviation_ - The selected text or the current line if no text is selected, is wrapped with given abbreviation. - Works with html, xml, jade, slim, haml files - _Emmet 2.0: Remove Tag_ - The tag under the cursor is removed along with the corresponding opening/closing tag. Works with multiple cursors. Works only in html and xml files. - _Emmet 2.0: Update Tag_ - The tag under the cursor is updated to the given tag. Works with multiple cursors. Works only in html and xml files. - _Emmet 2.0: Go to Matching Pair_ - Cursor moves to the tag matching to the tag under cursor. Works with multiple cursors. Works only in html and xml files. ",1.0,"Test plan for Emmet features from extension using new APIs - Test item for #21943 Complexity: 4 **Pre-req for testing** - Clone the repo for the extension https://github.com/Microsoft/vscode-emmet - Run `vsce package` to get the six - Side load the extension by `code-insiders --install-extension emmet-0.0.1.vsix` **Suggestion Items** - As you type an abbreviation, the suggestion list should show the expanded abbreviation. Can be turned off by disabling `emmet.suggestExpandedAbbreviation` - As you type an abbreviation, all possible abbreviations should show in the suggestion list. Can be turned off by disabling `emmet.suggestAbbreviations` **Commands to test:** - _Emmet 2.0: Expand abbreviation_ - The selected text or the text preceeding the cursor if no text is selected is taken as the abbreviation to expand. - Works with html, xml, jade, slim, haml files and css,scss,sass, less, stylus files - _Emmet 2.0: Wrap with abbreviation_ - The selected text or the current line if no text is selected, is wrapped with given abbreviation. - Works with html, xml, jade, slim, haml files - _Emmet 2.0: Remove Tag_ - The tag under the cursor is removed along with the corresponding opening/closing tag. Works with multiple cursors. Works only in html and xml files. - _Emmet 2.0: Update Tag_ - The tag under the cursor is updated to the given tag. Works with multiple cursors. Works only in html and xml files. - _Emmet 2.0: Go to Matching Pair_ - Cursor moves to the tag matching to the tag under cursor. Works with multiple cursors. Works only in html and xml files. ",0,test plan for emmet features from extension using new apis test item for complexity pre req for testing clone the repo for the extension run vsce package to get the six side load the extension by code insiders install extension emmet vsix suggestion items as you type an abbreviation the suggestion list should show the expanded abbreviation can be turned off by disabling emmet suggestexpandedabbreviation as you type an abbreviation all possible abbreviations should show in the suggestion list can be turned off by disabling emmet suggestabbreviations commands to test emmet expand abbreviation the selected text or the text preceeding the cursor if no text is selected is taken as the abbreviation to expand works with html xml jade slim haml files and css scss sass less stylus files emmet wrap with abbreviation the selected text or the current line if no text is selected is wrapped with given abbreviation works with html xml jade slim haml files emmet remove tag the tag under the cursor is removed along with the corresponding opening closing tag works with multiple cursors works only in html and xml files emmet update tag the tag under the cursor is updated to the given tag works with multiple cursors works only in html and xml files emmet go to matching pair cursor moves to the tag matching to the tag under cursor works with multiple cursors works only in html and xml files ,0 7500,24991880294.0,IssuesEvent,2022-11-02 19:33:19,GoogleCloudPlatform/pubsec-declarative-toolkit,https://api.github.com/repos/GoogleCloudPlatform/pubsec-declarative-toolkit,opened,look at checking if there is a way to get workload AR vulnerability checks alongside the infrastructure vulnerability tab results already in SCC-P,developer-experience automation,"Michael will look at checking if there is a way to get workload AR vulnerability checks alongside the infrastructure vulnerability tab results already in SCC-P Artifact Registry scanning of cloud build targeted containerMore
Artifacts: [/sqlsmith/setup=tpch-sf1/setting=no-mutations](https://teamcity.cockroachdb.com/viewLog.html?buildId=1891353&tab=artifacts#/sqlsmith/setup=tpch-sf1/setting=no-mutations) [See this test on roachdash](https://roachdash.crdb.dev/?filter=status%3Aopen+t%3A.%2Asqlsmith%2Fsetup%3Dtpch-sf1%2Fsetting%3Dno-mutations.%2A&sort=title&restgroup=false&display=lastcommented+project) powered by [pkg/cmd/internal/issues](https://github.com/cockroachdb/cockroach/tree/master/pkg/cmd/internal/issues)
More
Artifacts: [/sqlsmith/setup=tpch-sf1/setting=no-mutations](https://teamcity.cockroachdb.com/viewLog.html?buildId=1891353&tab=artifacts#/sqlsmith/setup=tpch-sf1/setting=no-mutations) [See this test on roachdash](https://roachdash.crdb.dev/?filter=status%3Aopen+t%3A.%2Asqlsmith%2Fsetup%3Dtpch-sf1%2Fsetting%3Dno-mutations.%2A&sort=title&restgroup=false&display=lastcommented+project) powered by [pkg/cmd/internal/issues](https://github.com/cockroachdb/cockroach/tree/master/pkg/cmd/internal/issues)
Vulnerable Library - jackson-databind-2.8.8.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /tmp/ws-scm/1010-1/pom.xml
Path to vulnerable library: epository/com/fasterxml/jackson/core/jackson-databind/2.8.8/jackson-databind-2.8.8.jar
Dependency Hierarchy: - :x: **jackson-databind-2.8.8.jar** (Vulnerable Library)
Found in HEAD commit: e42bbbd0a667a61447797ee7b7cee2bbf8be7012
Vulnerability Details
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
Publish Date: 2020-03-26
URL: CVE-2020-10969
CVSS 3 Score Details (8.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10969
Release Date: 2020-03-26
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.6;com.fasterxml.jackson.core:jackson-databind:2.7.9.7
Vulnerable Library - jackson-databind-2.8.8.jar
General data-binding functionality for Jackson: works on core streaming API
Library home page: http://github.com/FasterXML/jackson
Path to dependency file: /tmp/ws-scm/1010-1/pom.xml
Path to vulnerable library: epository/com/fasterxml/jackson/core/jackson-databind/2.8.8/jackson-databind-2.8.8.jar
Dependency Hierarchy: - :x: **jackson-databind-2.8.8.jar** (Vulnerable Library)
Found in HEAD commit: e42bbbd0a667a61447797ee7b7cee2bbf8be7012
Vulnerability Details
FasterXML jackson-databind 2.x before 2.9.10.4 mishandles the interaction between serialization gadgets and typing, related to javax.swing.JEditorPane.
Publish Date: 2020-03-26
URL: CVE-2020-10969
CVSS 3 Score Details (8.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-10969
Release Date: 2020-03-26
Fix Resolution: com.fasterxml.jackson.core:jackson-databind:2.8.11.6;com.fasterxml.jackson.core:jackson-databind:2.7.9.7
Browser Configuration
- None
Browser Configuration
- None
Vulnerable Libraries -
Vulnerability Details
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.
Publish Date: 2018-12-03
URL: CVE-2018-19797
CVSS 3 Score Details (6.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19797
Release Date: 2019-09-01
Fix Resolution: LibSass - 3.6.0
Vulnerable Libraries -
Vulnerability Details
In LibSass 3.5.5, a NULL Pointer Dereference in the function Sass::Selector_List::populate_extends in SharedPtr.hpp (used by ast.cpp and ast_selectors.cpp) may cause a Denial of Service (application crash) via a crafted sass input file.
Publish Date: 2018-12-03
URL: CVE-2018-19797
CVSS 3 Score Details (6.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-19797
Release Date: 2019-09-01
Fix Resolution: LibSass - 3.6.0
Vulnerable Libraries - loader-utils-1.4.0.tgz, loader-utils-1.2.3.tgz
loader-utils-1.4.0.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz
Path to dependency file: /client/package.json
Path to vulnerable library: /client/node_modules/loader-utils/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - css-loader-3.4.2.tgz - :x: **loader-utils-1.4.0.tgz** (Vulnerable Library)
loader-utils-1.2.3.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /client/package.json
Path to vulnerable library: /client/node_modules/adjust-sourcemap-loader/node_modules/loader-utils/package.json,/client/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/client/node_modules/react-dev-utils/node_modules/loader-utils/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **loader-utils-1.2.3.tgz** (Vulnerable Library)
Found in HEAD commit: 0eb270221557ac4df481974af8dfb9ea1288bc9b
Found in base branch: master
Vulnerability Details
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.
Publish Date: 2022-10-12
URL: CVE-2022-37601
CVSS 3 Score Details (9.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Release Date: 2022-10-12
Fix Resolution (loader-utils): 2.0.0
Direct dependency fix Resolution (react-scripts): 5.0.1
Fix Resolution (loader-utils): 2.0.0
Direct dependency fix Resolution (react-scripts): 5.0.1
Vulnerable Libraries - loader-utils-1.4.0.tgz, loader-utils-1.2.3.tgz
loader-utils-1.4.0.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.4.0.tgz
Path to dependency file: /client/package.json
Path to vulnerable library: /client/node_modules/loader-utils/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - css-loader-3.4.2.tgz - :x: **loader-utils-1.4.0.tgz** (Vulnerable Library)
loader-utils-1.2.3.tgz
utils for webpack loaders
Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz
Path to dependency file: /client/package.json
Path to vulnerable library: /client/node_modules/adjust-sourcemap-loader/node_modules/loader-utils/package.json,/client/node_modules/resolve-url-loader/node_modules/loader-utils/package.json,/client/node_modules/react-dev-utils/node_modules/loader-utils/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - react-dev-utils-10.2.1.tgz - :x: **loader-utils-1.2.3.tgz** (Vulnerable Library)
Found in HEAD commit: 0eb270221557ac4df481974af8dfb9ea1288bc9b
Found in base branch: master
Vulnerability Details
Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.
Publish Date: 2022-10-12
URL: CVE-2022-37601
CVSS 3 Score Details (9.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Release Date: 2022-10-12
Fix Resolution (loader-utils): 2.0.0
Direct dependency fix Resolution (react-scripts): 5.0.1
Fix Resolution (loader-utils): 2.0.0
Direct dependency fix Resolution (react-scripts): 5.0.1
Vulnerable Library - datatables-1.10.15.jar
WebJar for DataTables
Library home page: http://webjars.org
Path to dependency file: /web/nibrs-web/pom.xml
Path to vulnerable library: /canner/.m2/repository/org/webjars/datatables/1.10.15/datatables-1.10.15.jar,/web/nibrs-web/target/nibrs-web/WEB-INF/lib/datatables-1.10.15.jar
Dependency Hierarchy: - :x: **datatables-1.10.15.jar** (Vulnerable Library)
Found in HEAD commit: 2643373aa9a184ff4ea81e98caf4009bf2ee8e91
Found in base branch: master
Vulnerability Details
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
Publish Date: 2021-09-27
URL: CVE-2021-23445
CVSS 3 Score Details (6.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23445
Release Date: 2021-09-27
Fix Resolution: 1.10.20
Vulnerable Library - datatables-1.10.15.jar
WebJar for DataTables
Library home page: http://webjars.org
Path to dependency file: /web/nibrs-web/pom.xml
Path to vulnerable library: /canner/.m2/repository/org/webjars/datatables/1.10.15/datatables-1.10.15.jar,/web/nibrs-web/target/nibrs-web/WEB-INF/lib/datatables-1.10.15.jar
Dependency Hierarchy: - :x: **datatables-1.10.15.jar** (Vulnerable Library)
Found in HEAD commit: 2643373aa9a184ff4ea81e98caf4009bf2ee8e91
Found in base branch: master
Vulnerability Details
This affects the package datatables.net before 1.11.3. If an array is passed to the HTML escape entities function it would not have its contents escaped.
Publish Date: 2021-09-27
URL: CVE-2021-23445
CVSS 3 Score Details (6.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: Required - Scope: Changed - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: None
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-23445
Release Date: 2021-09-27
Fix Resolution: 1.10.20
Vulnerable Library - wazuhv3.3.1
Wazuh - The Open Source Security Platform
Library home page: https://github.com/wazuh/wazuh.git
Vulnerable Source Files (2)
proxysql/deps/sqlite3/sqlite-amalgamation-3190200.tar/sqlite-amalgamation-3190200/sqlite3.c
proxysql/deps/sqlite3/sqlite-amalgamation-3190200.tar/sqlite-amalgamation-3190200/sqlite3.c
Vulnerability Details
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
Publish Date: 2019-12-09
URL: CVE-2019-19645
CVSS 3 Score Details (5.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19645
Release Date: 2019-12-09
Fix Resolution: 3.31.0
Vulnerable Library - wazuhv3.3.1
Wazuh - The Open Source Security Platform
Library home page: https://github.com/wazuh/wazuh.git
Vulnerable Source Files (2)
proxysql/deps/sqlite3/sqlite-amalgamation-3190200.tar/sqlite-amalgamation-3190200/sqlite3.c
proxysql/deps/sqlite3/sqlite-amalgamation-3190200.tar/sqlite-amalgamation-3190200/sqlite3.c
Vulnerability Details
alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
Publish Date: 2019-12-09
URL: CVE-2019-19645
CVSS 3 Score Details (5.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2019-19645
Release Date: 2019-12-09
Fix Resolution: 3.31.0
Vulnerable Library - yargs-parser-11.1.1.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-11.1.1.tgz
Path to dependency file: /tmp/ws-scm/concord/console2/package.json
Path to vulnerable library: /tmp/ws-scm/concord/console2/node_modules/webpack-dev-server/node_modules/yargs-parser/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-dev-server-3.10.3.tgz - yargs-12.0.5.tgz - :x: **yargs-parser-11.1.1.tgz** (Vulnerable Library)
Found in HEAD commit: cfb756aae811651de93ac8a69c7191e48bb4960f
Vulnerability Details
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a ""__proto__"" payload.
Publish Date: 2020-03-16
URL: CVE-2020-7608
CVSS 3 Score Details (5.3)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7608
Release Date: 2020-03-16
Fix Resolution: v18.1.1;13.1.2;15.0.1
Vulnerable Library - yargs-parser-11.1.1.tgz
the mighty option parser used by yargs
Library home page: https://registry.npmjs.org/yargs-parser/-/yargs-parser-11.1.1.tgz
Path to dependency file: /tmp/ws-scm/concord/console2/package.json
Path to vulnerable library: /tmp/ws-scm/concord/console2/node_modules/webpack-dev-server/node_modules/yargs-parser/package.json
Dependency Hierarchy: - react-scripts-3.4.1.tgz (Root Library) - webpack-dev-server-3.10.3.tgz - yargs-12.0.5.tgz - :x: **yargs-parser-11.1.1.tgz** (Vulnerable Library)
Found in HEAD commit: cfb756aae811651de93ac8a69c7191e48bb4960f
Vulnerability Details
yargs-parser could be tricked into adding or modifying properties of Object.prototype using a ""__proto__"" payload.
Publish Date: 2020-03-16
URL: CVE-2020-7608
CVSS 3 Score Details (5.3)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: Low - Availability Impact: Low
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7608
Release Date: 2020-03-16
Fix Resolution: v18.1.1;13.1.2;15.0.1
Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy: - :x: **Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl** (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy: - :x: **Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl** (Vulnerable Library)
Vulnerability Details
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
Publish Date: 2021-03-03
URL: CVE-2021-27923
CVSS 3 Score Details (7.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. Vulnerable Libraries - Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl, Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/0d/f3/421598450cb9503f4565d936860763b5af413a61009d87a5ab1e34139672/Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy: - :x: **Pillow-5.4.1-cp27-cp27mu-manylinux1_x86_64.whl** (Vulnerable Library)
Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Python Imaging Library (Fork)
Library home page: https://files.pythonhosted.org/packages/b6/4b/5adc1109908266554fb978154c797c7d71aba43dd15508d8c1565648f6bc/Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl
Dependency Hierarchy: - :x: **Pillow-6.0.0-cp27-cp27mu-manylinux1_x86_64.whl** (Vulnerable Library)
Vulnerability Details
Pillow before 8.1.1 allows attackers to cause a denial of service (memory consumption) because the reported size of a contained image is not properly checked for an ICO container, and thus an attempted memory allocation can be very large.
Publish Date: 2021-03-03
URL: CVE-2021-27923
CVSS 3 Score Details (7.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here.Click to expand
Click to expand
 Vulnerable Library - linuxlinux-4.19.238
The Linux Kernel
Library home page: https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/?wsslib=linux
Found in HEAD commit: 05c0743befb9102e2ecb9fbd0fa8eb43eb8bb5ec
Found in base branch: master
Vulnerable Source Files (2)
/drivers/video/fbdev/sm712fb.c
/drivers/video/fbdev/sm712fb.c
Vulnerability Details
The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers being able to crash the kernel.
Publish Date: 2022-07-13
URL: CVE-2022-2380
CVSS 3 Score Details (6.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://www.linuxkernelcves.com/cves/CVE-2022-2380
Release Date: 2022-07-13
Fix Resolution: v4.9.311,v4.14.276,v4.19.238,v5.4.189,v5.10.110,v5.15.33,v5.16.19,v5.17.2,v5.18
Vulnerable Library - linuxlinux-4.19.238
The Linux Kernel
Library home page: https://mirrors.edge.kernel.org/pub/linux/kernel/v4.x/?wsslib=linux
Found in HEAD commit: 05c0743befb9102e2ecb9fbd0fa8eb43eb8bb5ec
Found in base branch: master
Vulnerable Source Files (2)
/drivers/video/fbdev/sm712fb.c
/drivers/video/fbdev/sm712fb.c
Vulnerability Details
The Linux kernel was found vulnerable out of bounds memory access in the drivers/video/fbdev/sm712fb.c:smtcfb_read() function. The vulnerability could result in local attackers being able to crash the kernel.
Publish Date: 2022-07-13
URL: CVE-2022-2380
CVSS 3 Score Details (6.1)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: Low - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://www.linuxkernelcves.com/cves/CVE-2022-2380
Release Date: 2022-07-13
Fix Resolution: v4.9.311,v4.14.276,v4.19.238,v5.4.189,v5.10.110,v5.15.33,v5.16.19,v5.17.2,v5.18
Template name
김건우 - 진행 상황v 0.1.0
새로 추가할 기능, 페이지, 파일에 대한 suggestTemplate Content
About
**현재 상황 안내** 1. 회원가입 시스템 구현 (express.js) (완) 2. 로그인 시스템 구현 (완) 3. 주문 내역 구현 중 (11/26 예정) 4. myPage 추가 (11/26 예정) 5. navbar issue 관련 수정 #6 (진행 중) 아마도 시간 상 로컬 server.js의 array 형태로 데이터베이스를 대체 (13강 chat 저장 방식 처럼) 회원 가입 요청에는 form 형태를 사용해서 사용자가 기입한 내용을 server로 전달 후 array에 저장. **Additional Info** `npm install body-parser` `npm install express -save` 필요 로그인 후 받는 토큰으로 인해서 충돌이 일어날 수 있음에 유의 ",1.0,"현재 진행 상황 -Template name
김건우 - 진행 상황v 0.1.0
새로 추가할 기능, 페이지, 파일에 대한 suggestTemplate Content
About
**현재 상황 안내** 1. 회원가입 시스템 구현 (express.js) (완) 2. 로그인 시스템 구현 (완) 3. 주문 내역 구현 중 (11/26 예정) 4. myPage 추가 (11/26 예정) 5. navbar issue 관련 수정 #6 (진행 중) 아마도 시간 상 로컬 server.js의 array 형태로 데이터베이스를 대체 (13강 chat 저장 방식 처럼) 회원 가입 요청에는 form 형태를 사용해서 사용자가 기입한 내용을 server로 전달 후 array에 저장. **Additional Info** `npm install body-parser` `npm install express -save` 필요 로그인 후 받는 토큰으로 인해서 충돌이 일어날 수 있음에 유의 ",0,현재 진행 상황 template name 김건우 진행 상황 v 새로 추가할 기능 페이지 파일에 대한 suggest template content about 현재 상황 안내 회원가입 시스템 구현 express js 완 로그인 시스템 구현 완 주문 내역 구현 중 예정 mypage 추가 예정 navbar issue 관련 수정 진행 중 아마도 시간 상 로컬 server js의 array 형태로 데이터베이스를 대체 chat 저장 방식 처럼 회원 가입 요청에는 form 형태를 사용해서 사용자가 기입한 내용을 server로 전달 후 array에 저장 additional info npm install body parser npm install express save 필요 로그인 후 받는 토큰으로 인해서 충돌이 일어날 수 있음에 유의 ,0 761329,26676623435.0,IssuesEvent,2023-01-26 14:43:39,eclipse-sirius/sirius-components,https://api.github.com/repos/eclipse-sirius/sirius-components,opened,Upload document does not work properly if a special resource factory is needed,type: bug difficulty: starter priority: low package: core,"* [X] **I have checked that this bug has not yet been reported by someone else** * [X] **I have checked that this bug appears on Chrome** * [X] **I have specified the version** : latest * [X] **I have specified my environment** : All ### Actual behavior For example UML resource need special resource factory to instanciate and resolve the proxies. If the factory needed to resolved the pathmap protocol is not present, then it fails. ### Steps to reproduce no reproducible scenario in Sirius-Web yet. ### Expected behavior The registered special resrouce factory should be present on the resourceSet used to instanciate the uploaded resourceSet ",1.0,"Upload document does not work properly if a special resource factory is needed - * [X] **I have checked that this bug has not yet been reported by someone else** * [X] **I have checked that this bug appears on Chrome** * [X] **I have specified the version** : latest * [X] **I have specified my environment** : All ### Actual behavior For example UML resource need special resource factory to instanciate and resolve the proxies. If the factory needed to resolved the pathmap protocol is not present, then it fails. ### Steps to reproduce no reproducible scenario in Sirius-Web yet. ### Expected behavior The registered special resrouce factory should be present on the resourceSet used to instanciate the uploaded resourceSet ",0,upload document does not work properly if a special resource factory is needed i have checked that this bug has not yet been reported by someone else i have checked that this bug appears on chrome i have specified the version latest i have specified my environment all actual behavior for example uml resource need special resource factory to instanciate and resolve the proxies if the factory needed to resolved the pathmap protocol is not present then it fails steps to reproduce no reproducible scenario in sirius web yet expected behavior the registered special resrouce factory should be present on the resourceset used to instanciate the uploaded resourceset ,0 238892,7784187614.0,IssuesEvent,2018-06-06 12:32:35,umple/umple,https://api.github.com/repos/umple/umple,closed,Document unspecified in the user manual,Component-UserDocs Diffic-Easy Priority-Medium,"In the state machine section of the user manual, describe the use of the 'unspecified' event to handle situations where a message is received that is not understood. Note that this can be used in regular and queued state machines. Come up with a realistic example",1.0,"Document unspecified in the user manual - In the state machine section of the user manual, describe the use of the 'unspecified' event to handle situations where a message is received that is not understood. Note that this can be used in regular and queued state machines. Come up with a realistic example",0,document unspecified in the user manual in the state machine section of the user manual describe the use of the unspecified event to handle situations where a message is received that is not understood note that this can be used in regular and queued state machines come up with a realistic example,0 7233,24490276542.0,IssuesEvent,2022-10-10 00:12:18,astropy/astropy,https://api.github.com/repos/astropy/astropy,closed,Have good commit messages with commitizen,Feature Request needs-discussion dev-automation,"### Description https://commitizen-tools.github.io/commitizen/ + pre-commit to enforce good commit messages. ### Additional context ""Commitizen is a tool designed for teams. Its main purpose is to define a standard way of committing rules and communicating it (using the cli provided by commitizen). The reasoning behind it is that it is easier to read, and enforces writing descriptive commits. Besides that, having a convention on your commits makes it possible to parse them and use them for something else, like generating automatically the version or a changelog."" (https://commitizen-tools.github.io/commitizen/)",1.0,"Have good commit messages with commitizen - ### Description https://commitizen-tools.github.io/commitizen/ + pre-commit to enforce good commit messages. ### Additional context ""Commitizen is a tool designed for teams. Its main purpose is to define a standard way of committing rules and communicating it (using the cli provided by commitizen). The reasoning behind it is that it is easier to read, and enforces writing descriptive commits. Besides that, having a convention on your commits makes it possible to parse them and use them for something else, like generating automatically the version or a changelog."" (https://commitizen-tools.github.io/commitizen/)",1,have good commit messages with commitizen description pre commit to enforce good commit messages additional context commitizen is a tool designed for teams its main purpose is to define a standard way of committing rules and communicating it using the cli provided by commitizen the reasoning behind it is that it is easier to read and enforces writing descriptive commits besides that having a convention on your commits makes it possible to parse them and use them for something else like generating automatically the version or a changelog ,1 6725,7745110548.0,IssuesEvent,2018-05-29 17:16:09,aws/aws-sdk-ruby,https://api.github.com/repos/aws/aws-sdk-ruby,closed,run_instances with tag_specifications field with resource_type: spot-instances-request not supported!,closing-soon-if-no-response service api," Hi, Calling Aws::EC2::Client run_instances method with tag_specification resource type ""spot-instances-request"" stack the following: ``` [type:error] [error_type:Aws::EC2::Errors::InvalidParameterValue][message:""'spot-instances-request' is not a valid taggable resource type for this operation.""] /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/seahorse/client/plugins/raise_response_errors.rb:15:in `call' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/aws-sdk-core/plugins/jsonvalue_converter.rb:20:in `call' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/aws-sdk-core/plugins/idempotency_token.rb:18:in `call' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/aws-sdk-core/plugins/param_converter.rb:20:in `call' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/seahorse/client/plugins/response_target.rb:21:in `call' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/seahorse/client/request.rb:70:in `send_request' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/seahorse/client/base.rb:207:in `block (2 levels) in define_operation_methods' ``` but in the [documentation](https://docs.aws.amazon.com/sdkforruby/api/Aws/EC2/Client.html) the support type are: ""accepts customer-gateway, dhcp-options, image, instance, internet-gateway, network-acl, network-interface, reserved-instances, route-table, snapshot, **spot-instances-request**, subnet, security-group, volume, vpc, vpn-connection, vpn-gateway"". aws-sdk-core (= 2.11.4) ruby:2.3 ubuntu 16.04 example call: ``` client.run_instances( ... tag_specifications: [{ resource_type: 'spot-instances-request', tags: { name: name } }], instance_market_options: { market_type: ""spot"", spot_options: { spot_instance_type: ""one-time"", instance_interruption_behavior: ""terminate"", }, } ) ```",1.0,"run_instances with tag_specifications field with resource_type: spot-instances-request not supported! - Hi, Calling Aws::EC2::Client run_instances method with tag_specification resource type ""spot-instances-request"" stack the following: ``` [type:error] [error_type:Aws::EC2::Errors::InvalidParameterValue][message:""'spot-instances-request' is not a valid taggable resource type for this operation.""] /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/seahorse/client/plugins/raise_response_errors.rb:15:in `call' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/aws-sdk-core/plugins/jsonvalue_converter.rb:20:in `call' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/aws-sdk-core/plugins/idempotency_token.rb:18:in `call' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/aws-sdk-core/plugins/param_converter.rb:20:in `call' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/seahorse/client/plugins/response_target.rb:21:in `call' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/seahorse/client/request.rb:70:in `send_request' /app/vendor/bundle/ruby/2.3.0/gems/aws-sdk-core-2.10.125/lib/seahorse/client/base.rb:207:in `block (2 levels) in define_operation_methods' ``` but in the [documentation](https://docs.aws.amazon.com/sdkforruby/api/Aws/EC2/Client.html) the support type are: ""accepts customer-gateway, dhcp-options, image, instance, internet-gateway, network-acl, network-interface, reserved-instances, route-table, snapshot, **spot-instances-request**, subnet, security-group, volume, vpc, vpn-connection, vpn-gateway"". aws-sdk-core (= 2.11.4) ruby:2.3 ubuntu 16.04 example call: ``` client.run_instances( ... tag_specifications: [{ resource_type: 'spot-instances-request', tags: { name: name } }], instance_market_options: { market_type: ""spot"", spot_options: { spot_instance_type: ""one-time"", instance_interruption_behavior: ""terminate"", }, } ) ```",0,run instances with tag specifications field with resource type spot instances request not supported hi calling aws client run instances method with tag specification resource type spot instances request stack the following app vendor bundle ruby gems aws sdk core lib seahorse client plugins raise response errors rb in call app vendor bundle ruby gems aws sdk core lib aws sdk core plugins jsonvalue converter rb in call app vendor bundle ruby gems aws sdk core lib aws sdk core plugins idempotency token rb in call app vendor bundle ruby gems aws sdk core lib aws sdk core plugins param converter rb in call app vendor bundle ruby gems aws sdk core lib seahorse client plugins response target rb in call app vendor bundle ruby gems aws sdk core lib seahorse client request rb in send request app vendor bundle ruby gems aws sdk core lib seahorse client base rb in block levels in define operation methods but in the the support type are accepts customer gateway dhcp options image instance internet gateway network acl network interface reserved instances route table snapshot spot instances request subnet security group volume vpc vpn connection vpn gateway aws sdk core ruby ubuntu example call client run instances tag specifications resource type spot instances request tags name name instance market options market type spot spot options spot instance type one time instance interruption behavior terminate ,0 6610,23515552187.0,IssuesEvent,2022-08-18 20:56:28,o3de/o3de,https://api.github.com/repos/o3de/o3de,opened,PhysX Fixed Joint Component returns a memory access violation when getting its Component Property Tree with types,kind/bug needs-triage kind/automation sig/simulation,"**Describe the bug** When attempting to get the **Component Property Tree** from a **PhysX Fixed Joint Component** a memory access violation is returned **Steps to reproduce** Steps to reproduce the behavior: 1. Create a Python Editor Test that makes a call to get the **Component Property Tree** from the **PhysX Fixed Joint Component**. ``` test_entity = EditorEntity.create_editor_entity(""Test"") test_component = test_entity.add_component(""PhysX Fixed Joint"") print(test_component.get_property_type_visibility()) ``` or ``` test_entity = hydra.Entity(""test"") entity.create_entity(position, [""PhysX Fixed Joint""]) component = test_entity.components[0] print(hydra.get_property_tree(component) ``` 2. Run automation **Expected behavior** A property tree with paths is returned and printed to the stream **Actual behavior** A Read Access Memory exception is returned **Callstack** ``` ``` ",1.0,"PhysX Fixed Joint Component returns a memory access violation when getting its Component Property Tree with types - **Describe the bug** When attempting to get the **Component Property Tree** from a **PhysX Fixed Joint Component** a memory access violation is returned **Steps to reproduce** Steps to reproduce the behavior: 1. Create a Python Editor Test that makes a call to get the **Component Property Tree** from the **PhysX Fixed Joint Component**. ``` test_entity = EditorEntity.create_editor_entity(""Test"") test_component = test_entity.add_component(""PhysX Fixed Joint"") print(test_component.get_property_type_visibility()) ``` or ``` test_entity = hydra.Entity(""test"") entity.create_entity(position, [""PhysX Fixed Joint""]) component = test_entity.components[0] print(hydra.get_property_tree(component) ``` 2. Run automation **Expected behavior** A property tree with paths is returned and printed to the stream **Actual behavior** A Read Access Memory exception is returned **Callstack** ``` ``` ",1,physx fixed joint component returns a memory access violation when getting its component property tree with types describe the bug when attempting to get the component property tree from a physx fixed joint component a memory access violation is returned steps to reproduce steps to reproduce the behavior create a python editor test that makes a call to get the component property tree from the physx fixed joint component test entity editorentity create editor entity test test component test entity add component physx fixed joint print test component get property type visibility or test entity hydra entity test entity create entity position component test entity components print hydra get property tree component run automation expected behavior a property tree with paths is returned and printed to the stream actual behavior a read access memory exception is returned callstack ,1 29267,11738897192.0,IssuesEvent,2020-03-11 16:48:00,QubesOS/qubes-issues,https://api.github.com/repos/QubesOS/qubes-issues,reopened,Mount /rw and /home with nosuid + nodev,C: templates P: default T: enhancement security,"**The problem you're addressing (if any)** When a template has been configured to enforce internal user permissions, malware that gains a temporarily useful privilege escalation may continue as root user indefinitely in AppVMs by setting up executables in /home that have +s SUID bit set. The effect is that an OS patch for the initial vulnerability will not de-privilege malware that exploited it. Similarly, the ability to create device node files in /home can permit privilege escalation, and such nodes normally don't belong in /home. **Describe the solution you'd like** Change the /rw and /home entries in /etc/fstab to use the `nosuid` and `nodev` options. This works even with bind mounts. **Where is the value to a user, and who might that user be?** Users who do not want malware to persist indefinitely or easily gain root privileges may remove the 'qubes-core-agent-passwordless-root' package, or reconfigure templates according to the 'vm-sudo' doc or Qubes-VM-hardening. Mounting /rw and /home with `nosuid` + `nodev` bolsters security in such template configurations by giving OS security patches a chance to de-privilege malware. **Relevant [documentation](https://www.qubes-os.org/doc/) you've consulted** https://www.qubes-os.org/doc/vm-sudo/ https://github.com/tasket/Qubes-VM-hardening ",True,"Mount /rw and /home with nosuid + nodev - **The problem you're addressing (if any)** When a template has been configured to enforce internal user permissions, malware that gains a temporarily useful privilege escalation may continue as root user indefinitely in AppVMs by setting up executables in /home that have +s SUID bit set. The effect is that an OS patch for the initial vulnerability will not de-privilege malware that exploited it. Similarly, the ability to create device node files in /home can permit privilege escalation, and such nodes normally don't belong in /home. **Describe the solution you'd like** Change the /rw and /home entries in /etc/fstab to use the `nosuid` and `nodev` options. This works even with bind mounts. **Where is the value to a user, and who might that user be?** Users who do not want malware to persist indefinitely or easily gain root privileges may remove the 'qubes-core-agent-passwordless-root' package, or reconfigure templates according to the 'vm-sudo' doc or Qubes-VM-hardening. Mounting /rw and /home with `nosuid` + `nodev` bolsters security in such template configurations by giving OS security patches a chance to de-privilege malware. **Relevant [documentation](https://www.qubes-os.org/doc/) you've consulted** https://www.qubes-os.org/doc/vm-sudo/ https://github.com/tasket/Qubes-VM-hardening ",0,mount rw and home with nosuid nodev the problem you re addressing if any when a template has been configured to enforce internal user permissions malware that gains a temporarily useful privilege escalation may continue as root user indefinitely in appvms by setting up executables in home that have s suid bit set the effect is that an os patch for the initial vulnerability will not de privilege malware that exploited it similarly the ability to create device node files in home can permit privilege escalation and such nodes normally don t belong in home describe the solution you d like change the rw and home entries in etc fstab to use the nosuid and nodev options this works even with bind mounts where is the value to a user and who might that user be users who do not want malware to persist indefinitely or easily gain root privileges may remove the qubes core agent passwordless root package or reconfigure templates according to the vm sudo doc or qubes vm hardening mounting rw and home with nosuid nodev bolsters security in such template configurations by giving os security patches a chance to de privilege malware relevant you ve consulted ,0 10065,7078137500.0,IssuesEvent,2018-01-10 01:48:41,tensorflow/tensorflow,https://api.github.com/repos/tensorflow/tensorflow,closed,Cannot show stderr when using Jupyter,type:bug/performance,"Hello, Could you please have a look about this. I am using TF and Jupyter. But what makes me confuse is that the log text cannot be shown in Jupyter output cell (but it output correctly in ipython). I think it is because of the stderr. This issue have been discussed before in #3047. You add several lines to determine whether or not current context is in an interactive environment. However, even if I use Jupyter, the return value of ""sys.flags.interactive"" is still zero. and the logger lever can never be setted to ""info"" and use ""stdout"" instead of ""stderr"". Thanks a lot!",True,"Cannot show stderr when using Jupyter - Hello, Could you please have a look about this. I am using TF and Jupyter. But what makes me confuse is that the log text cannot be shown in Jupyter output cell (but it output correctly in ipython). I think it is because of the stderr. This issue have been discussed before in #3047. You add several lines to determine whether or not current context is in an interactive environment. However, even if I use Jupyter, the return value of ""sys.flags.interactive"" is still zero. and the logger lever can never be setted to ""info"" and use ""stdout"" instead of ""stderr"". Thanks a lot!",0,cannot show stderr when using jupyter hello could you please have a look about this i am using tf and jupyter but what makes me confuse is that the log text cannot be shown in jupyter output cell but it output correctly in ipython i think it is because of the stderr this issue have been discussed before in you add several lines to determine whether or not current context is in an interactive environment however even if i use jupyter the return value of sys flags interactive is still zero and the logger lever can never be setted to info and use stdout instead of stderr thanks a lot ,0 45744,2939041074.0,IssuesEvent,2015-07-01 14:24:36,HPI-SWA-Teaching/SWT15-Project-13,https://api.github.com/repos/HPI-SWA-Teaching/SWT15-Project-13,opened,Ausgabe von Rückgabewerten,priority: normal type: bug,"Die Ausgabe von Rückgabewerten sollte per ```printOn:``` passieren, nicht per ```asString```.",1.0,"Ausgabe von Rückgabewerten - Die Ausgabe von Rückgabewerten sollte per ```printOn:``` passieren, nicht per ```asString```.",0,ausgabe von rückgabewerten die ausgabe von rückgabewerten sollte per printon passieren nicht per asstring ,0 4073,15356139065.0,IssuesEvent,2021-03-01 12:01:47,mozilla-mobile/firefox-ios,https://api.github.com/repos/mozilla-mobile/firefox-ios,opened,[XCUITest] Select latest stack Xcode 12.4 and iOS version 14.4 to run the tests in all schemes,eng:automation,"For RunAllXCUITests we are still using iOS 14.0 and due to recent changes with WKWebView app is crashing and around ~100 tests failing. ",1.0,"[XCUITest] Select latest stack Xcode 12.4 and iOS version 14.4 to run the tests in all schemes - For RunAllXCUITests we are still using iOS 14.0 and due to recent changes with WKWebView app is crashing and around ~100 tests failing. ",1, select latest stack xcode and ios version to run the tests in all schemes for runallxcuitests we are still using ios and due to recent changes with wkwebview app is crashing and around tests failing ,1 5838,21391225891.0,IssuesEvent,2022-04-21 07:19:59,mozilla-mobile/firefox-ios,https://api.github.com/repos/mozilla-mobile/firefox-ios,closed,Improve automatic string import to not take changes in unrelated files,eng:automation,"In this PR the automation is changing the package.resolved file by removing one line: https://github.com/mozilla-mobile/firefox-ios/pull/10505/files#diff-6edf4db475d69aa9d1d8c8cc7cba4419a30e16fddfb130b90bf06e2a5b809cb4L142 In this case that's not critical but it could be in case there is a package change. We need to be sure that only `locale.lproj` files are changed ┆Issue is synchronized with this [Jira Task](https://mozilla-hub.atlassian.net/browse/FXIOS-4101) ",1.0,"Improve automatic string import to not take changes in unrelated files - In this PR the automation is changing the package.resolved file by removing one line: https://github.com/mozilla-mobile/firefox-ios/pull/10505/files#diff-6edf4db475d69aa9d1d8c8cc7cba4419a30e16fddfb130b90bf06e2a5b809cb4L142 In this case that's not critical but it could be in case there is a package change. We need to be sure that only `locale.lproj` files are changed ┆Issue is synchronized with this [Jira Task](https://mozilla-hub.atlassian.net/browse/FXIOS-4101) ",1,improve automatic string import to not take changes in unrelated files in this pr the automation is changing the package resolved file by removing one line in this case that s not critical but it could be in case there is a package change we need to be sure that only locale lproj files are changed ┆issue is synchronized with this ,1 5866,21508957367.0,IssuesEvent,2022-04-28 00:47:54,rancher-sandbox/rancher-desktop,https://api.github.com/repos/rancher-sandbox/rancher-desktop,opened,"Change ""restart"" to ""VM restart""",kind/enhancement area/automation,"```console PS C:\Users\Jan\Downloads> rdctl start --container-engine containerd Status: triggering a restart to apply changes. ``` ""Restart"" is alarming because it could mean a reboot of the host, but it really is just a reboot of the VM. The message should make that clear.",1.0,"Change ""restart"" to ""VM restart"" - ```console PS C:\Users\Jan\Downloads> rdctl start --container-engine containerd Status: triggering a restart to apply changes. ``` ""Restart"" is alarming because it could mean a reboot of the host, but it really is just a reboot of the VM. The message should make that clear.",1,change restart to vm restart console ps c users jan downloads rdctl start container engine containerd status triggering a restart to apply changes restart is alarming because it could mean a reboot of the host but it really is just a reboot of the vm the message should make that clear ,1 8684,27172086752.0,IssuesEvent,2023-02-17 20:26:37,OneDrive/onedrive-api-docs,https://api.github.com/repos/OneDrive/onedrive-api-docs,closed,HTTP Error 423 (Locked) not documented,area:Docs automation:Closed,"Hello, while using the REST API to delete a file I got a response with status 423 (Locked) and body: ``` { ""error"": { ""code"": ""accessDenied"", ""innerError"": { ""date"": ""2018-09-12T06:12:46"", ""request-id"": ""74d9b899-d03e-44c1-8e36-f3c80dc00718"" }, ""message"": ""Lock token does not match existing lock"" } } ``` The error is self-explanatory and the `accessDenied` code is documented; however the [error section](https://github.com/OneDrive/onedrive-api-docs/blob/live/docs/rest-api/concepts/errors.md) does not say that the 423 status may be returned by the API.",1.0,"HTTP Error 423 (Locked) not documented - Hello, while using the REST API to delete a file I got a response with status 423 (Locked) and body: ``` { ""error"": { ""code"": ""accessDenied"", ""innerError"": { ""date"": ""2018-09-12T06:12:46"", ""request-id"": ""74d9b899-d03e-44c1-8e36-f3c80dc00718"" }, ""message"": ""Lock token does not match existing lock"" } } ``` The error is self-explanatory and the `accessDenied` code is documented; however the [error section](https://github.com/OneDrive/onedrive-api-docs/blob/live/docs/rest-api/concepts/errors.md) does not say that the 423 status may be returned by the API.",1,http error locked not documented hello while using the rest api to delete a file i got a response with status locked and body error code accessdenied innererror date request id message lock token does not match existing lock the error is self explanatory and the accessdenied code is documented however the does not say that the status may be returned by the api ,1 1519,10272574502.0,IssuesEvent,2019-08-23 16:49:07,mozilla-mobile/fenix,https://api.github.com/repos/mozilla-mobile/fenix,opened,Temporarily disable screenshots UI tests til androidx upgrade,eng:automation,"Android Gradle Plugin 3.5.0 requires AndroidX dependencies for testing , but screengrab doesn't work yet with AndroidX. @colintheshots has contributed back a patch (see: https://github.com/fastlane/fastlane/pull/15217). Until Google maintainers pick it up and create a build, we'll need to temporarily disable the screenshots tests. cc: @isabelrios @npark-mozilla see also: https://github.com/mozilla-mobile/fenix/pull/4903 ",1.0,"Temporarily disable screenshots UI tests til androidx upgrade - Android Gradle Plugin 3.5.0 requires AndroidX dependencies for testing , but screengrab doesn't work yet with AndroidX. @colintheshots has contributed back a patch (see: https://github.com/fastlane/fastlane/pull/15217). Until Google maintainers pick it up and create a build, we'll need to temporarily disable the screenshots tests. cc: @isabelrios @npark-mozilla see also: https://github.com/mozilla-mobile/fenix/pull/4903 ",1,temporarily disable screenshots ui tests til androidx upgrade android gradle plugin requires androidx dependencies for testing but screengrab doesn t work yet with androidx colintheshots has contributed back a patch see until google maintainers pick it up and create a build we ll need to temporarily disable the screenshots tests cc isabelrios npark mozilla see also ,1 106526,16682352536.0,IssuesEvent,2021-06-08 02:32:00,vipinsun/TrustID,https://api.github.com/repos/vipinsun/TrustID,opened,WS-2020-0132 (Medium) detected in jsrsasign-7.2.2.tgz,security vulnerability,"## WS-2020-0132 - Medium Severity Vulnerability Vulnerable Library - jsrsasign-7.2.2.tgz
opensource free pure JavaScript cryptographic library supports RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp and CAdES and JSON Web Signature(JWS)/Token(JWT)/Key(JWK)
Library home page: https://registry.npmjs.org/jsrsasign/-/jsrsasign-7.2.2.tgz
Path to dependency file: TrustID/trustid-sdk/package.json
Path to vulnerable library: TrustID/trustid-sdk/node_modules/jsrsasign/package.json
Dependency Hierarchy: - fabric-ca-client-2.1.0.tgz (Root Library) - :x: **jsrsasign-7.2.2.tgz** (Vulnerable Library)
Found in HEAD commit: 1c9178c5a1b42520307da1fa7f9b1899276178ed
Found in base branch: master
Vulnerability Details
jsrsasign 4.0.0 through 8.0.12 is vulnerable to side-channel attack.
Publish Date: 2020-06-30
URL: WS-2020-0132
CVSS 3 Score Details (4.6)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: N/A - Attack Complexity: N/A - Privileges Required: N/A - User Interaction: N/A - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-g753-jx37-7xwh
Release Date: 2020-07-14
Fix Resolution: jsrsasign - 8.0.13
Vulnerable Library - jsrsasign-7.2.2.tgz
opensource free pure JavaScript cryptographic library supports RSA/RSAPSS/ECDSA/DSA signing/validation, ASN.1, PKCS#1/5/8 private/public key, X.509 certificate, CRL, OCSP, CMS SignedData, TimeStamp and CAdES and JSON Web Signature(JWS)/Token(JWT)/Key(JWK)
Library home page: https://registry.npmjs.org/jsrsasign/-/jsrsasign-7.2.2.tgz
Path to dependency file: TrustID/trustid-sdk/package.json
Path to vulnerable library: TrustID/trustid-sdk/node_modules/jsrsasign/package.json
Dependency Hierarchy: - fabric-ca-client-2.1.0.tgz (Root Library) - :x: **jsrsasign-7.2.2.tgz** (Vulnerable Library)
Found in HEAD commit: 1c9178c5a1b42520307da1fa7f9b1899276178ed
Found in base branch: master
Vulnerability Details
jsrsasign 4.0.0 through 8.0.12 is vulnerable to side-channel attack.
Publish Date: 2020-06-30
URL: WS-2020-0132
CVSS 3 Score Details (4.6)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: N/A - Attack Complexity: N/A - Privileges Required: N/A - User Interaction: N/A - Scope: N/A - Impact Metrics: - Confidentiality Impact: N/A - Integrity Impact: N/A - Availability Impact: N/A
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-g753-jx37-7xwh
Release Date: 2020-07-14
Fix Resolution: jsrsasign - 8.0.13
Vulnerable Libraries - linuxlinux-4.19.294, linuxlinux-4.19.294
Vulnerability Details
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088.
Publish Date: 2022-10-17
URL: CVE-2022-3565
CVSS 3 Score Details (7.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://www.linuxkernelcves.com/cves/CVE-2022-3565
Release Date: 2022-10-17
Fix Resolution: v4.9.331,v4.14.296,v4.19.262,v5.4.220,v5.10.150,v5.15.75,v6.0.3
Vulnerable Libraries - linuxlinux-4.19.294, linuxlinux-4.19.294
Vulnerability Details
A vulnerability, which was classified as critical, has been found in Linux Kernel. Affected by this issue is the function del_timer of the file drivers/isdn/mISDN/l1oip_core.c of the component Bluetooth. The manipulation leads to use after free. It is recommended to apply a patch to fix this issue. The identifier of this vulnerability is VDB-211088.
Publish Date: 2022-10-17
URL: CVE-2022-3565
CVSS 3 Score Details (7.8)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Local - Attack Complexity: Low - Privileges Required: Low - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: High - Integrity Impact: High - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://www.linuxkernelcves.com/cves/CVE-2022-3565
Release Date: 2022-10-17
Fix Resolution: v4.9.331,v4.14.296,v4.19.262,v5.4.220,v5.10.150,v5.15.75,v6.0.3
Migrated from https://code.icecube.wisc.edu/ticket/1956, reported by jvansanten and owned by
```json { ""status"": ""closed"", ""changetime"": ""2017-03-14T20:23:10"", ""description"": ""Trying to deserialize an S frame written with IceSim 4 with current software fails with \n{{{\nFATAL (phys-services): Version 117 is from the future (SamplingSurface.cxx:50 in void I3Surfaces::SamplingSurface::serialize(Archive&, unsigned int) [with Archive = icecube::archive::portable_binary_iarchive])\n}}}\n\nThis is probably because the refactor added a new layer in the inheritance tree, the current code tries to read a class ID and version from the stream that are not there. While empty base classes do not take up space in memory, they turn out to matter quite a bit for serialization."", ""reporter"": ""jvansanten"", ""cc"": """", ""resolution"": ""invalid"", ""_ts"": ""1489522990898099"", ""component"": ""combo core"", ""summary"": ""[MuonGun] Surfaces refactor broke deserialization of pre-IceSim5 S frames"", ""priority"": ""critical"", ""keywords"": """", ""time"": ""2017-03-14T15:16:30"", ""milestone"": """", ""owner"": """", ""type"": ""defect"" } ```
Migrated from https://code.icecube.wisc.edu/ticket/1956, reported by jvansanten and owned by
```json { ""status"": ""closed"", ""changetime"": ""2017-03-14T20:23:10"", ""description"": ""Trying to deserialize an S frame written with IceSim 4 with current software fails with \n{{{\nFATAL (phys-services): Version 117 is from the future (SamplingSurface.cxx:50 in void I3Surfaces::SamplingSurface::serialize(Archive&, unsigned int) [with Archive = icecube::archive::portable_binary_iarchive])\n}}}\n\nThis is probably because the refactor added a new layer in the inheritance tree, the current code tries to read a class ID and version from the stream that are not there. While empty base classes do not take up space in memory, they turn out to matter quite a bit for serialization."", ""reporter"": ""jvansanten"", ""cc"": """", ""resolution"": ""invalid"", ""_ts"": ""1489522990898099"", ""component"": ""combo core"", ""summary"": ""[MuonGun] Surfaces refactor broke deserialization of pre-IceSim5 S frames"", ""priority"": ""critical"", ""keywords"": """", ""time"": ""2017-03-14T15:16:30"", ""milestone"": """", ""owner"": """", ""type"": ""defect"" } ```
- Log in like an user
- Go to a Space area
- Open context menu
- Click 'Draw on Canvas'
- Draw something
Result: when an user draws something the image isn't displayed on the screen, but I can see what I have drown on this space in any other browser / device
",1.0,"[CNVERG-54] iPhone 6, iPad 3 mini. Space area: Context Menu: Draw on Canvas: when an user draws something the image isn't displayed - [reporter=""a.shemerey"", created=""Wed, 22 Jul 2015 15:45:05 +0300""]- Log in like an user
- Go to a Space area
- Open context menu
- Click 'Draw on Canvas'
- Draw something
Result: when an user draws something the image isn't displayed on the screen, but I can see what I have drown on this space in any other browser / device
",0, iphone ipad mini space area context menu draw on canvas when an user draws something the image isn t displayed log in like an user go to a space area open context menu click draw on canvas draw something result when an user draws something the image isn t displayed on the screen but i can see what i have drown on this space in any other browser device ,0 344073,24796741785.0,IssuesEvent,2022-10-24 17:57:18,Eleanorgruth/whats-cookin,https://api.github.com/repos/Eleanorgruth/whats-cookin,closed,README.md,documentation,"- [x] Overview of project and goals - [x] Overview of technologies used, challenges, wins, and any other reflections - [x] Screenshots/gifs of your app - [x] List of contributors",1.0,"README.md - - [x] Overview of project and goals - [x] Overview of technologies used, challenges, wins, and any other reflections - [x] Screenshots/gifs of your app - [x] List of contributors",0,readme md overview of project and goals overview of technologies used challenges wins and any other reflections screenshots gifs of your app list of contributors,0 8766,27172225269.0,IssuesEvent,2023-02-17 20:34:15,OneDrive/onedrive-api-docs,https://api.github.com/repos/OneDrive/onedrive-api-docs,closed,App registration is not up to date,area:Docs automation:Closed,"App registration has moved in to Azure. Corresponding settings that should be done under Platforms header is hard to find. //Olof --- #### Document Details ⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.* * ID: f02010cc-2715-86ca-b3fe-e4f92e934fdb * Version Independent ID: 27b3e16e-f80f-32f4-0e4f-69cfcd1cf769 * Content: [Create an app with Microsoft Graph - OneDrive API - OneDrive dev center](https://docs.microsoft.com/en-us/onedrive/developer/rest-api/getting-started/app-registration?view=odsp-graph-online#feedback) * Content Source: [docs/rest-api/getting-started/app-registration.md](https://github.com/OneDrive/onedrive-api-docs/blob/live/docs/rest-api/getting-started/app-registration.md) * Product: **onedrive** * GitHub Login: @rgregg * Microsoft Alias: **rgregg**",1.0,"App registration is not up to date - App registration has moved in to Azure. Corresponding settings that should be done under Platforms header is hard to find. //Olof --- #### Document Details ⚠ *Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.* * ID: f02010cc-2715-86ca-b3fe-e4f92e934fdb * Version Independent ID: 27b3e16e-f80f-32f4-0e4f-69cfcd1cf769 * Content: [Create an app with Microsoft Graph - OneDrive API - OneDrive dev center](https://docs.microsoft.com/en-us/onedrive/developer/rest-api/getting-started/app-registration?view=odsp-graph-online#feedback) * Content Source: [docs/rest-api/getting-started/app-registration.md](https://github.com/OneDrive/onedrive-api-docs/blob/live/docs/rest-api/getting-started/app-registration.md) * Product: **onedrive** * GitHub Login: @rgregg * Microsoft Alias: **rgregg**",1,app registration is not up to date app registration has moved in to azure corresponding settings that should be done under platforms header is hard to find olof document details ⚠ do not edit this section it is required for docs microsoft com ➟ github issue linking id version independent id content content source product onedrive github login rgregg microsoft alias rgregg ,1 4203,15797217504.0,IssuesEvent,2021-04-02 16:18:06,uiowa/uiowa,https://api.github.com/repos/uiowa/uiowa,closed,Replace broken links in admissions AOS miration postImportProcess.,5 points admissions.uiowa.edu automation,"There are 1500+ broken links in the AOS migration. The report is happening in the `postImportProcess` method now. I think we can stick with that and expand it. We can replace some using the migration map and others using a manual map of source -> destination NIDs that admissions created. We should double check all fields are being scanned that need to be.",1.0,"Replace broken links in admissions AOS miration postImportProcess. - There are 1500+ broken links in the AOS migration. The report is happening in the `postImportProcess` method now. I think we can stick with that and expand it. We can replace some using the migration map and others using a manual map of source -> destination NIDs that admissions created. We should double check all fields are being scanned that need to be.",1,replace broken links in admissions aos miration postimportprocess there are broken links in the aos migration the report is happening in the postimportprocess method now i think we can stick with that and expand it we can replace some using the migration map and others using a manual map of source destination nids that admissions created we should double check all fields are being scanned that need to be ,1 1713,10595012391.0,IssuesEvent,2019-10-09 18:02:27,IBM/ibm-spectrum-scale-csi-operator,https://api.github.com/repos/IBM/ibm-spectrum-scale-csi-operator,closed,Convert Operator deployment to playbook,Component: Automation Component: Bundling Phase: Development Severity: 2 Type: Enhancement Type: wontfix,The Operator deployment shouldn't be Bash. The original bash scripts were written when I wasn't as Ansible literate. I believe a playbook would be easier to comprehend and could ensure stateful information before the operator even triggers,1.0,Convert Operator deployment to playbook - The Operator deployment shouldn't be Bash. The original bash scripts were written when I wasn't as Ansible literate. I believe a playbook would be easier to comprehend and could ensure stateful information before the operator even triggers,1,convert operator deployment to playbook the operator deployment shouldn t be bash the original bash scripts were written when i wasn t as ansible literate i believe a playbook would be easier to comprehend and could ensure stateful information before the operator even triggers,1 978,8953064301.0,IssuesEvent,2019-01-25 18:20:05,mozilla-mobile/fenix,https://api.github.com/repos/mozilla-mobile/fenix,closed,Setup testing track on Google Play,🤖 automation,"Build, sign and upload Nightly builds to Google Play testing track.",1.0,"Setup testing track on Google Play - Build, sign and upload Nightly builds to Google Play testing track.",1,setup testing track on google play build sign and upload nightly builds to google play testing track ,1 88910,3787374593.0,IssuesEvent,2016-03-21 10:21:18,HubTurbo/HubTurbo,https://api.github.com/repos/HubTurbo/HubTurbo,closed,CONTRIBUTING.md should also reference process.md,aspect-devops forFirstTimers priority.medium,"Currently only points to [dev guide](https://github.com/HubTurbo/HubTurbo/blob/master/docs/developerGuide.md) and [workflow.md](https://github.com/HubTurbo/HubTurbo/blob/master/docs/workflow.md). Making [**process.md**](https://github.com/HubTurbo/HubTurbo/blob/master/docs/process.md) immediately visible from [CONTRIBUTING.md](https://github.com/HubTurbo/HubTurbo/blob/master/CONTRIBUTING.md) means that new contributors will be handed the following information on a silver platter: 1. The guidelines and conventions for submitting pull requests 2. Exposes how pull requests are approved for merging. This change should (hopefully) let new contributors catch simple problems in their PRs without a dev having to step in.",1.0,"CONTRIBUTING.md should also reference process.md - Currently only points to [dev guide](https://github.com/HubTurbo/HubTurbo/blob/master/docs/developerGuide.md) and [workflow.md](https://github.com/HubTurbo/HubTurbo/blob/master/docs/workflow.md). Making [**process.md**](https://github.com/HubTurbo/HubTurbo/blob/master/docs/process.md) immediately visible from [CONTRIBUTING.md](https://github.com/HubTurbo/HubTurbo/blob/master/CONTRIBUTING.md) means that new contributors will be handed the following information on a silver platter: 1. The guidelines and conventions for submitting pull requests 2. Exposes how pull requests are approved for merging. This change should (hopefully) let new contributors catch simple problems in their PRs without a dev having to step in.",0,contributing md should also reference process md currently only points to and making immediately visible from means that new contributors will be handed the following information on a silver platter the guidelines and conventions for submitting pull requests exposes how pull requests are approved for merging this change should hopefully let new contributors catch simple problems in their prs without a dev having to step in ,0 335546,10155142005.0,IssuesEvent,2019-08-06 09:38:01,webcompat/web-bugs,https://api.github.com/repos/webcompat/web-bugs,closed,m.flickr.com - see bug description,browser-firefox-mobile engine-gecko priority-important," **URL**: https://m.flickr.com/#/photos/65665666@N06/8679478921 **Browser / Version**: Firefox Mobile 68.0 **Operating System**: Android **Tested Another Browser**: No **Problem type**: Something else **Description**: content not visible **Steps to Reproduce**: It is not possible to see pictures posted on this siteBrowser Configuration
- None
Browser Configuration
- None
Vulnerable Library - system.security.cryptography.xml.4.4.1.nupkg
Provides classes to support the creation and validation of XML digital signatures. The classes in th...
Library home page: https://api.nuget.org/packages/system.security.cryptography.xml.4.4.1.nupkg
Path to dependency file: MvcAreasForEPiServer/src/MvcAreasForEPiServer/MvcAreasForEPiServer.csproj
Path to vulnerable library: /dotnet_FTZGBK/20211118100056/System.Security.Cryptography.Xml.4.4.1/System.Security.Cryptography.Xml.4.4.1.nupkg
Dependency Hierarchy: - :x: **system.security.cryptography.xml.4.4.1.nupkg** (Vulnerable Library)
Found in HEAD commit: 93afd136db816f65690c05bd5f312a9a5c3562fe
Vulnerability Details
A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka "".NET and .NET Core Denial of Service Vulnerability."" This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7/4.7.1, Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1, .NET Core 2.0, Microsoft .NET Framework 4.7.2.
Publish Date: 2018-05-09
URL: CVE-2018-0765
CVSS 3 Score Details (7.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-35hc-x2cw-2j4v
Release Date: 2018-05-09
Fix Resolution: 4.4.2
Vulnerable Library - system.security.cryptography.xml.4.4.1.nupkg
Provides classes to support the creation and validation of XML digital signatures. The classes in th...
Library home page: https://api.nuget.org/packages/system.security.cryptography.xml.4.4.1.nupkg
Path to dependency file: MvcAreasForEPiServer/src/MvcAreasForEPiServer/MvcAreasForEPiServer.csproj
Path to vulnerable library: /dotnet_FTZGBK/20211118100056/System.Security.Cryptography.Xml.4.4.1/System.Security.Cryptography.Xml.4.4.1.nupkg
Dependency Hierarchy: - :x: **system.security.cryptography.xml.4.4.1.nupkg** (Vulnerable Library)
Found in HEAD commit: 93afd136db816f65690c05bd5f312a9a5c3562fe
Vulnerability Details
A denial of service vulnerability exists when .NET and .NET Core improperly process XML documents, aka "".NET and .NET Core Denial of Service Vulnerability."" This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.7.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.7/4.7.1, Microsoft .NET Framework 4.6, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6.2/4.7/4.7.1, .NET Core 2.0, Microsoft .NET Framework 4.7.2.
Publish Date: 2018-05-09
URL: CVE-2018-0765
CVSS 3 Score Details (7.5)
Base Score Metrics: - Exploitability Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Impact Metrics: - Confidentiality Impact: None - Integrity Impact: None - Availability Impact: High
For more information on CVSS3 Scores, click here. Suggested Fix
Type: Upgrade version
Origin: https://github.com/advisories/GHSA-35hc-x2cw-2j4v
Release Date: 2018-05-09
Fix Resolution: 4.4.2