|
|
@@ -0,0 +1,283 @@
|
|
|
+{
|
|
|
+ "source": "npm audit --registry=https://registry.npmjs.org --json",
|
|
|
+ "scope": "full dependency tree including build/test tooling; not an exploitability count",
|
|
|
+ "metadata": {
|
|
|
+ "vulnerabilities": {
|
|
|
+ "info": 0,
|
|
|
+ "low": 8,
|
|
|
+ "moderate": 22,
|
|
|
+ "high": 49,
|
|
|
+ "critical": 6,
|
|
|
+ "total": 85
|
|
|
+ },
|
|
|
+ "dependencies": {
|
|
|
+ "prod": 39,
|
|
|
+ "dev": 1009,
|
|
|
+ "optional": 105,
|
|
|
+ "peer": 0,
|
|
|
+ "peerOptional": 0,
|
|
|
+ "total": 1058
|
|
|
+ }
|
|
|
+ },
|
|
|
+ "direct": [
|
|
|
+ {
|
|
|
+ "name": "@angular-devkit/build-angular",
|
|
|
+ "version": "18.2.21",
|
|
|
+ "severity": "high",
|
|
|
+ "advisories": []
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "@angular/animations",
|
|
|
+ "version": "18.2.14",
|
|
|
+ "severity": "moderate",
|
|
|
+ "advisories": []
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "@angular/cli",
|
|
|
+ "version": "18.2.21",
|
|
|
+ "severity": "high",
|
|
|
+ "advisories": []
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "@angular/common",
|
|
|
+ "version": "18.2.14",
|
|
|
+ "severity": "high",
|
|
|
+ "advisories": [
|
|
|
+ {
|
|
|
+ "title": "Angular is Vulnerable to XSRF Token Leakage via Protocol-Relative URLs in Angular HTTP Client",
|
|
|
+ "url": "https://github.com/advisories/GHSA-58c5-g7wp-6w37"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "@angular/common: Denial of Service (DoS) via OOM in Date Formatting (formatDate)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-48r7-hpm6-gfxm"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "@angular/common: Weak 32-Bit Cache Key Hashing in `HttpTransferCache` Leading to Cross-Request Data Leakage and State Poisoning",
|
|
|
+ "url": "https://github.com/advisories/GHSA-39pv-4j6c-2g6v"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "@angular/common: Denial of Service (DoS) via OOM in Number Formatting (digitsInfo)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-p3vc-36g9-x9gr"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "@angular/common: Information Leak via Default Caching of Credentialed Requests in HttpTransferCache",
|
|
|
+ "url": "https://github.com/advisories/GHSA-q6f4-qqrg-jv6x"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular: Cache-Key Ambiguity in HttpTransferCache Leading to Cross-Request Response Reuse and State Poisoning",
|
|
|
+ "url": "https://github.com/advisories/GHSA-jhpw-976m-542j"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular: Information Leak via `HttpTransferCache` Bypass When Using `withRequestsMadeViaParent`",
|
|
|
+ "url": "https://github.com/advisories/GHSA-p297-fm68-3q8c"
|
|
|
+ }
|
|
|
+ ]
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "@angular/compiler",
|
|
|
+ "version": "18.2.14",
|
|
|
+ "severity": "high",
|
|
|
+ "advisories": [
|
|
|
+ {
|
|
|
+ "title": "Angular vulnerable to XSS in i18n attribute bindings",
|
|
|
+ "url": "https://github.com/advisories/GHSA-g93w-mfhg-p222"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular has XSS Vulnerability via Unsanitized SVG Script Attributes",
|
|
|
+ "url": "https://github.com/advisories/GHSA-jrmj-c5cx-3cw6"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular Stored XSS Vulnerability via SVG Animation, SVG URL and MathML Attributes",
|
|
|
+ "url": "https://github.com/advisories/GHSA-v4hv-rgfq-gp49"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "@angular/compiler: Two-Way Property Binding Sanitization Bypass (XSS)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-58w9-8g37-x9v5"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular: Template and Attribute Namespace Sanitization Bypass (XSS)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-f3m7-gqxr-g87x"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes",
|
|
|
+ "url": "https://github.com/advisories/GHSA-jj27-h5hq-8x99"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
|
|
|
+ "url": "https://github.com/advisories/GHSA-hh8m-fm6v-7cvg"
|
|
|
+ }
|
|
|
+ ]
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "@angular/compiler-cli",
|
|
|
+ "version": "18.2.14",
|
|
|
+ "severity": "moderate",
|
|
|
+ "advisories": []
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "@angular/core",
|
|
|
+ "version": "18.2.14",
|
|
|
+ "severity": "high",
|
|
|
+ "advisories": [
|
|
|
+ {
|
|
|
+ "title": "Angular i18n vulnerable to Cross-Site Scripting",
|
|
|
+ "url": "https://github.com/advisories/GHSA-prjf-86w9-mfqv"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular vulnerable to XSS in i18n attribute bindings",
|
|
|
+ "url": "https://github.com/advisories/GHSA-g93w-mfhg-p222"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular has XSS Vulnerability via Unsanitized SVG Script Attributes",
|
|
|
+ "url": "https://github.com/advisories/GHSA-jrmj-c5cx-3cw6"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular: Template and Attribute Namespace Sanitization Bypass (XSS)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-f3m7-gqxr-g87x"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "@angular/core: Angular Template and Dynamic Component Namespace Bypass leading to Cross-Site Scripting (XSS)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-692r-grfm-v8x7"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular Client Hydration DOM Clobbering & Response-Cache Poisoning",
|
|
|
+ "url": "https://github.com/advisories/GHSA-rgjc-h3x7-9mwg"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular i18n: Cross-Site Scripting (XSS) via event-handler attributes",
|
|
|
+ "url": "https://github.com/advisories/GHSA-jj27-h5hq-8x99"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "Angular: Sanitization bypass via directive host bindings on concrete host elements in @angular/core and @angular/compiler",
|
|
|
+ "url": "https://github.com/advisories/GHSA-hh8m-fm6v-7cvg"
|
|
|
+ }
|
|
|
+ ]
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "@angular/forms",
|
|
|
+ "version": "18.2.14",
|
|
|
+ "severity": "moderate",
|
|
|
+ "advisories": []
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "@angular/platform-browser",
|
|
|
+ "version": "18.2.14",
|
|
|
+ "severity": "moderate",
|
|
|
+ "advisories": []
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "@angular/platform-browser-dynamic",
|
|
|
+ "version": "18.2.14",
|
|
|
+ "severity": "moderate",
|
|
|
+ "advisories": []
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "@angular/router",
|
|
|
+ "version": "18.2.14",
|
|
|
+ "severity": "high",
|
|
|
+ "advisories": [
|
|
|
+ {
|
|
|
+ "title": "Angular Server-Side Rendering (SSR): Denial of Service via Numeric URL Matrix Parameters",
|
|
|
+ "url": "https://github.com/advisories/GHSA-ff3f-86qr-9cv3"
|
|
|
+ }
|
|
|
+ ]
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "html2pdf.js",
|
|
|
+ "version": "0.10.3",
|
|
|
+ "severity": "critical",
|
|
|
+ "advisories": [
|
|
|
+ {
|
|
|
+ "title": "html2pdf.js contains a cross-site scripting vulnerability",
|
|
|
+ "url": "https://github.com/advisories/GHSA-w8x4-x68c-m6fc"
|
|
|
+ }
|
|
|
+ ]
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "jspdf",
|
|
|
+ "version": "3.0.4",
|
|
|
+ "severity": "critical",
|
|
|
+ "advisories": [
|
|
|
+ {
|
|
|
+ "title": "jsPDF has Local File Inclusion/Path Traversal vulnerability",
|
|
|
+ "url": "https://github.com/advisories/GHSA-f8cm-6447-x5h2"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "jsPDF has PDF Injection in AcroFormChoiceField that allows Arbitrary JavaScript Execution",
|
|
|
+ "url": "https://github.com/advisories/GHSA-pqxr-3g65-p328"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "jsPDF Vulnerable to Denial of Service (DoS) via Unvalidated BMP Dimensions in BMPDecoder",
|
|
|
+ "url": "https://github.com/advisories/GHSA-95fx-jjr5-f39c"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "jsPDF Vulnerable to Stored XMP Metadata Injection (Spoofing & Integrity Violation)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-vm32-vv63-w422"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "jsPDF has Shared State Race Condition in addJS Plugin",
|
|
|
+ "url": "https://github.com/advisories/GHSA-cjw8-79x6-5cj4"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "jsPDF has a PDF Object Injection via Unsanitized Input in addJS Method",
|
|
|
+ "url": "https://github.com/advisories/GHSA-9vjf-qc39-jprp"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "jsPDF Affected by Client-Side/Server-Side Denial of Service via Malicious GIF Dimensions",
|
|
|
+ "url": "https://github.com/advisories/GHSA-67pg-wm7f-q7fj"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "jsPDF has a PDF Injection in AcroForm module allows Arbitrary JavaScript Execution (RadioButton.createOption and \"AS\" property)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-p5xg-68wr-hm3m"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "jsPDF has a PDF Object Injection via FreeText color",
|
|
|
+ "url": "https://github.com/advisories/GHSA-7x6v-j9x4-qf24"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "jsPDF has HTML Injection in New Window paths",
|
|
|
+ "url": "https://github.com/advisories/GHSA-wfv2-pwc8-crg5"
|
|
|
+ }
|
|
|
+ ]
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "karma",
|
|
|
+ "version": "6.4.4",
|
|
|
+ "severity": "high",
|
|
|
+ "advisories": []
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "karma-jasmine",
|
|
|
+ "version": "5.1.0",
|
|
|
+ "severity": "high",
|
|
|
+ "advisories": []
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "karma-jasmine-html-reporter",
|
|
|
+ "version": "2.1.0",
|
|
|
+ "severity": "high",
|
|
|
+ "advisories": []
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "lucide-angular",
|
|
|
+ "version": "0.468.0",
|
|
|
+ "severity": "moderate",
|
|
|
+ "advisories": []
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "name": "xlsx",
|
|
|
+ "version": "0.18.5",
|
|
|
+ "severity": "high",
|
|
|
+ "advisories": [
|
|
|
+ {
|
|
|
+ "title": "Prototype Pollution in sheetJS",
|
|
|
+ "url": "https://github.com/advisories/GHSA-4r6h-8v6p-xvw6"
|
|
|
+ },
|
|
|
+ {
|
|
|
+ "title": "SheetJS Regular Expression Denial of Service (ReDoS)",
|
|
|
+ "url": "https://github.com/advisories/GHSA-5pgg-2g8v-p4x9"
|
|
|
+ }
|
|
|
+ ]
|
|
|
+ }
|
|
|
+ ]
|
|
|
+}
|
彭峰
