ID Severity Found By Description Purl
CVE-2020-7645 Gitlab Gemnasium All versions of chrome-launcher allow execution of arbitrary commands, by controlling the `$HOME` environment variable in Linux operating systems. pkg:npm/chrome-launcher@0.13.4
CVE-2021-44906 Gitlab Gemnasium , Anchore Grype , Sonotype OSS-Index Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95). pkg:npm/minimist@1.2.5
CVE-2021-3918 Gitlab Gemnasium , Anchore Grype , Sonotype OSS-Index json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') pkg:npm/json-schema@0.2.3
sonatype-2019-0206 Sonotype OSS-Index 1 non-CVE vulnerability found. To see more details, please create a free account at https://ossindex.sonatype.org/ and request for this information using your registered account pkg:npm/execa@0.7.0
GMS-2020-2 Gitlab Gemnasium Attackers could trick execa into executing arbitrary binaries. This behaviour is caused by the setting `preferLocal=true` which makes execa search for locally installed binaries and executes them. This vulnerability is usually only exploitable when using execa on a client-side LOCAL application. pkg:npm/execa@0.7.0
sonatype-2021-4879 Sonotype OSS-Index 1 non-CVE vulnerability found. To see more details, please create a free account at https://ossindex.sonatype.org/ and request for this information using your registered account pkg:npm/minimatch@3.0.4
CVE-2022-25851 Anchore Grype , Sonotype OSS-Index The package jpeg-js before 0.4.4 are vulnerable to Denial of Service (DoS) where a particular piece of input will cause to enter an infinite loop and never return. pkg:npm/jpeg-js@0.4.3
CVE-2021-3807 Gitlab Gemnasium , Anchore Grype , Sonotype OSS-Index ansi-regex - Regular Expression Denial of Service (ReDoS) [CVE-2021-3807] ansi-regex - Regular Expression Denial of Service (ReDoS) [CVE-2021-3807] pkg:npm/ansi-regex@4.1.0
sonatype-2012-0022 Sonotype OSS-Index 1 non-CVE vulnerability found. To see more details, please create a free account at https://ossindex.sonatype.org/ and request for this information using your registered account pkg:npm/express@4.17.1
CVE-2021-3807 Gitlab Gemnasium , Anchore Grype , Sonotype OSS-Index ansi-regex - Regular Expression Denial of Service (ReDoS) [CVE-2021-3807] ansi-regex - Regular Expression Denial of Service (ReDoS) [CVE-2021-3807] pkg:npm/ansi-regex@3.0.0
CVE-2022-24785 Gitlab Gemnasium , Anchore Grype , Sonotype OSS-Index Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This... pkg:npm/moment@2.29.1
CVE-2022-31129 Gitlab Gemnasium , Anchore Grype , Sonotype OSS-Index moment is a JavaScript date library for parsing, validating, manipulating, and formatting dates. Affected versions of moment were found to use an inefficient parsing algorithm. Specifically using string-to-date parsing in moment (more specifically rfc2822 parsing, which is tried by default) has... pkg:npm/moment@2.29.1
CVE-2022-21681 Gitlab Gemnasium , Anchore Grype , Sonotype OSS-Index Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `inline.reflinkSearch` may cause catastrophic backtracking against some strings and lead to a denial of service (DoS). Anyone who runs untrusted markdown through a vulnerable version of marked and does not... pkg:npm/marked@1.2.9
CVE-2021-21306 Gitlab Gemnasium , Anchore Grype , Sonotype OSS-Index Marked is an open-source markdown parser and compiler (npm package "marked"). In marked from version 1.1.1 and before version 2.0.0, there is a Regular expression Denial of Service vulnerability. This vulnerability can affect anyone who runs user generated code through marked. This vulnerability... pkg:npm/marked@1.2.9
CVE-2022-21680 Gitlab Gemnasium , Anchore Grype , Sonotype OSS-Index Marked is a markdown parser and compiler. Prior to version 4.0.10, the regular expression `block.def` may cause catastrophic backtracking against some strings and lead to a regular expression denial of service (ReDoS). Anyone who runs untrusted markdown through a vulnerable version of marked and... pkg:npm/marked@1.2.9
sonatype-2020-1579 Sonotype OSS-Index 1 non-CVE vulnerability found. To see more details, please create a free account at https://ossindex.sonatype.org/ and request for this information using your registered account pkg:npm/prismjs@1.24.1
CVE-2021-3801 Gitlab Gemnasium , Anchore Grype , Sonotype OSS-Index prism is vulnerable to Inefficient Regular Expression Complexity pkg:npm/prismjs@1.24.1
CVE-2022-0155 Gitlab Gemnasium , Anchore Grype , Sonotype OSS-Index follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor pkg:npm/follow-redirects@1.14.4
CVE-2022-25869 Sonotype OSS-Index All versions of package angular are vulnerable to Cross-site Scripting (XSS) due to insecure page caching in the Internet Explorer browser, which allows interpolation of