Skip to content

Commit 1494327

Browse files
eoftedaleoftedal
committed
Merge branch 'master' into secdec-feature/identifiers
2 parents 8c92a7f + 82154f9 commit 1494327

File tree

2 files changed

+518
-91
lines changed

2 files changed

+518
-91
lines changed

‎repository/jsrepository.json‎

Lines changed: 98 additions & 40 deletions
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,17 @@
1515
"vulnerabilities" : [
1616
{
1717
"below" : "1.6.3",
18-
"severity": "high",
18+
"severity": "medium",
1919
"identifiers": { "CVE": "CVE-2011-4969" },
2020
"info" : [ "http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2011-4969" , "http://research.insecurelabs.org/jquery/test/" ]
2121
},
2222
{
2323
"below" : "1.9.0b1",
24-
"identifiers": { "bug": "11290" },
25-
"severity": "high",
24+
"identifiers": {
25+
"bug": "11290",
26+
"summary": "Selector interpreted as HTML"
27+
},
28+
"severity": "medium",
2629
"info" : [ "http://bugs.jquery.com/ticket/11290" , "http://research.insecurelabs.org/jquery/test/" ]}
2730
],
2831
"extractors" : {
@@ -42,14 +45,20 @@
4245
"vulnerabilities" : [
4346
{
4447
"below" : "1.2.0",
45-
"severity": "high",
46-
"identifiers": {"release": "jQuery Migrate 1.2.0 Released"},
48+
"severity": "medium",
49+
"identifiers": {
50+
"release": "jQuery Migrate 1.2.0 Released",
51+
"summary": "cross-site-scripting"
52+
},
4753
"info" : [ "http://blog.jquery.com/2013/05/01/jquery-migrate-1-2-0-released/" ]
4854
},
4955
{
5056
"below" : "1.2.2",
51-
"severity": "high",
52-
"identifiers": { "bug": "11290" },
57+
"severity": "medium",
58+
"identifiers": {
59+
"bug": "11290",
60+
"summary": "Selector interpreted as HTML"
61+
},
5362
"info" : [ "http://bugs.jquery.com/ticket/11290" , "http://research.insecurelabs.org/jquery/test/" ]
5463
}
5564
],
@@ -75,14 +84,22 @@
7584
},
7685
{
7786
"below" : "1.1.2",
78-
"severity": "high",
79-
"identifiers": {"issue": "4787", "release": "http://jquerymobile.com/changelog/1.1.2/"},
87+
"severity": "medium",
88+
"identifiers": {
89+
"issue": "4787",
90+
"release": "http://jquerymobile.com/changelog/1.1.2/",
91+
"summary": "location.href cross-site scripting"
92+
},
8093
"info": [ "http://jquerymobile.com/changelog/1.1.2/", "https://github.com/jquery/jquery-mobile/issues/4787" ]
8194
},
8295
{
8396
"below" : "1.2.0",
84-
"severity": "high",
85-
"identifiers": {"issue": "4787", "release": "http://jquerymobile.com/changelog/1.2.0/"},
97+
"severity": "medium",
98+
"identifiers": {
99+
"issue": "4787",
100+
"release": "http://jquerymobile.com/changelog/1.2.0/",
101+
"summary": "location.href cross-site scripting"
102+
},
86103
"info": [ "http://jquerymobile.com/changelog/1.2.0/", "https://github.com/jquery/jquery-mobile/issues/4787" ]
87104
}
88105
],
@@ -99,8 +116,11 @@
99116
{
100117
"atOrAbove": "1.8.9",
101118
"below" : "1.10.0",
102-
"severity": "high",
103-
"identifiers": {"bug": "6016"},
119+
"severity": "medium",
120+
"identifiers": {
121+
"bug": "6016",
122+
"summary": "Title cross-site scripting vulnerability"
123+
},
104124
"info" : [ "http://bugs.jqueryui.com/ticket/6016" ]
105125
}
106126
],
@@ -132,7 +152,10 @@
132152
"atOrAbove": "1.9.2",
133153
"below" : "1.10.0",
134154
"severity": "high",
135-
"identifiers": {"bug": "8859"},
155+
"identifiers": {
156+
"bug": "8859",
157+
"summary": "Autocomplete cross-site scripting vulnerability"
158+
},
136159
"info" : [ "http://bugs.jqueryui.com/ticket/8859" ]
137160
}
138161
],
@@ -181,7 +204,10 @@
181204
{
182205
"below" : "2.2.0",
183206
"severity": "high",
184-
"identifiers": {"release": "2.2.0"},
207+
"identifiers": {
208+
"release": "2.2.0",
209+
"summary": "Flash SWF vulnerability"
210+
},
185211
"info" : [ "http://jplayer.org/latest/release-notes/" ]
186212
}
187213
],
@@ -197,7 +223,8 @@
197223
"vulnerabilities" : [
198224
{
199225
"below" : "1.01",
200-
"severity": "high",
226+
"severity": "low",
227+
"identifiers": {"summary": "Unsanitized data passed to eval()"},
201228
"info" : [ "http://www.thomasfrank.se/sessionvars.html" ]
202229
}
203230
],
@@ -259,7 +286,7 @@
259286
},
260287
{
261288
"below" : "2.9.0",
262-
"severity": "high",
289+
"severity": "medium",
263290
"identifiers": {"CVE": "CVE-2010-4710"},
264291
"info" : [ "http://www.cvedetails.com/cve/CVE-2010-4710/" ]
265292
},
@@ -320,14 +347,14 @@
320347
{
321348
"atOrAbove" : "1.3.0-*",
322349
"below" : "1.3.2",
323-
"severity": "high",
350+
"severity": "medium",
324351
"identifiers": {"CVE": "CVE-2014-0046"},
325352
"info" : [ "https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ" ]
326353
},
327354
{
328355
"atOrAbove" : "1.2.0-*",
329356
"below" : "1.2.2",
330-
"severity": "high",
357+
"severity": "medium",
331358
"identifiers": {"CVE": "CVE-2014-0046"},
332359
"info" : [ "https://groups.google.com/forum/#!topic/ember-security/1h6FRgr8lXQ" ] },
333360
{
@@ -368,42 +395,42 @@
368395
{
369396
"atOrAbove" : "1.0.0-rc.1",
370397
"below" : "1.0.0-rc.1.1",
371-
"severity": "high",
398+
"severity": "medium",
372399
"identifiers": {"CVE": "CVE-2013-4170"},
373400
"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
374401
},
375402
{
376403
"atOrAbove" : "1.0.0-rc.2",
377404
"below" : "1.0.0-rc.2.1",
378-
"severity": "high",
405+
"severity": "medium",
379406
"identifiers": {"CVE": "CVE-2013-4170"},
380407
"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
381408
},
382409
{
383410
"atOrAbove" : "1.0.0-rc.3",
384411
"below" : "1.0.0-rc.3.1",
385-
"severity": "high",
412+
"severity": "medium",
386413
"identifiers": {"CVE": "CVE-2013-4170"},
387414
"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
388415
},
389416
{
390417
"atOrAbove" : "1.0.0-rc.4",
391418
"below" : "1.0.0-rc.4.1",
392-
"severity": "high",
419+
"severity": "medium",
393420
"identifiers": {"CVE": "CVE-2013-4170"},
394421
"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
395422
},
396423
{
397424
"atOrAbove" : "1.0.0-rc.5",
398425
"below" : "1.0.0-rc.5.1",
399-
"severity": "high",
426+
"severity": "medium",
400427
"identifiers": {"CVE": "CVE-2013-4170"},
401428
"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
402429
},
403430
{
404431
"atOrAbove" : "1.0.0-rc.6",
405432
"below" : "1.0.0-rc.6.1",
406-
"severity": "high",
433+
"severity": "medium",
407434
"identifiers": {"CVE": "CVE-2013-4170"},
408435
"info" : [ "https://groups.google.com/forum/#!topic/ember-security/dokLVwwxAdM" ]
409436
},
@@ -414,7 +441,10 @@
414441
{
415442
"below" : "0.9.7",
416443
"severity": "high",
417-
"identifiers": {"bug": "699"},
444+
"identifiers": {
445+
"bug": "699",
446+
"summary": "Bound attributes aren't escaped properly"
447+
},
418448
"info" : [ "https://github.com/emberjs/ember.js/issues/699" ]
419449
}
420450
],
@@ -476,13 +506,13 @@
476506
},
477507
{
478508
"below" : "1.4.2",
479-
"severity": "high",
509+
"severity": "medium",
480510
"identifiers": {"CVE": "CVE-2010-2275"},
481511
"info" : [ "http://www.cvedetails.com/cve/CVE-2010-2275/"]
482512
},
483513
{
484514
"below" : "1.1",
485-
"severity": "high",
515+
"severity": "medium",
486516
"identifiers": {"CVE": "CVE-2008-6681"},
487517
"info" : [ "http://www.cvedetails.com/cve/CVE-2008-6681/"]
488518
}
@@ -513,32 +543,51 @@
513543
{
514544
"below" : "1.2.0",
515545
"severity": "high",
546+
"identifiers": {
547+
"summary": [
548+
"execution of arbitrary javascript",
549+
"sandboxing fails",
550+
"possible cross-site scripting vulnerabilities"
551+
]
552+
},
516553
"info" : [ "https://code.google.com/p/mustache-security/wiki/AngularJS" ]
517554
},
518555
{
519556
"below" : "1.2.19",
520-
"severity": "high",
521-
"identifiers": {"release": "1.3.0-beta.14"},
557+
"severity": "medium",
558+
"identifiers": {
559+
"release": "1.3.0-beta.14",
560+
"summary": "execution of arbitrary javascript"
561+
},
522562
"info" : [ "https://github.com/angular/angular.js/blob/b3b5015cb7919708ce179dc3d6f0d7d7f43ef621/CHANGELOG.md" ]
523563
},
524564
{
525565
"below" : "1.2.24",
526-
"severity": "high",
527-
"identifier": {"commit": "b39e1d47b9a1b39a9fe34c847a81f589fba522f8"},
566+
"severity": "medium",
567+
"identifiers": {
568+
"commit": "b39e1d47b9a1b39a9fe34c847a81f589fba522f8",
569+
"summary": "execution of arbitrary javascript"
570+
},
528571
"info" : [ "http://avlidienbrunn.se/angular.txt", "https://github.com/angular/angular.js/commit/b39e1d47b9a1b39a9fe34c847a81f589fba522f8"]
529572
},
530573
{
531574
"atOrAbove" : "1.3.0-beta.1",
532575
"below" : "1.3.0-beta.14",
533-
"severity": "high",
534-
"identifier": {"commit": "b39e1d47b9a1b39a9fe34c847a81f589fba522f8"},
576+
"severity": "medium",
577+
"identifiers": {
578+
"commit": "b39e1d47b9a1b39a9fe34c847a81f589fba522f8",
579+
"summary": "execution of arbitrary javascript"
580+
},
535581
"info" : [ "https://github.com/angular/angular.js/blob/b3b5015cb7919708ce179dc3d6f0d7d7f43ef621/CHANGELOG.md" ]
536582
},
537583
{
538584
"atOrAbove" : "1.3.0-beta.1",
539585
"below" : "1.3.0-rc.1",
540-
"severity": "high",
541-
"identifier": {"commit": "b39e1d47b9a1b39a9fe34c847a81f589fba522f8"},
586+
"severity": "medium",
587+
"identifiers": {
588+
"commit": "b39e1d47b9a1b39a9fe34c847a81f589fba522f8",
589+
"summary": "execution of arbitrary javascript"
590+
},
542591
"info" : [ "http://avlidienbrunn.se/angular.txt", "https://github.com/angular/angular.js/commit/b39e1d47b9a1b39a9fe34c847a81f589fba522f8"]
543592
}
544593

@@ -555,8 +604,11 @@
555604
"vulnerabilities" : [
556605
{
557606
"below" : "0.5.0",
558-
"severity": "high",
559-
"identifiers": {"release": "0.5.0"},
607+
"severity": "medium",
608+
"identifiers": {
609+
"release": "0.5.0",
610+
"summary": "cross-site scripting vulnerability"
611+
},
560612
"info" : [ "http://backbonejs.org/#changelog" ]
561613
}
562614
],
@@ -573,7 +625,10 @@
573625
{
574626
"below" : "0.3.1",
575627
"severity": "high",
576-
"identifiers": {"bug": "112"},
628+
"identifiers": {
629+
"bug": "112",
630+
"summary": "execution of arbitrary javascript"
631+
},
577632
"info" : [ "https://github.com/janl/mustache.js/issues/112" ] } ],
578633
"extractors" : {
579634
"func" : [ "Mustache.version" ],
@@ -590,7 +645,10 @@
590645
"vulnerabilities" : [
591646
{
592647
"below" : "1.0.0.beta.3",
593-
"severity": "high",
648+
"severity": "medium",
649+
"identifiers": {
650+
"summary": "poorly sanitized input passed to eval()"
651+
},
594652
"info" : [ "https://github.com/wycats/handlebars.js/pull/68" ] } ],
595653
"extractors" : {
596654
"func" : [ "Handlebars.VERSION" ],

0 commit comments

Comments
 (0)