| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 74 + + | + + +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +vm2: Sandbox Escape
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.9.18vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of
Proxy. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version3.9.18ofvm2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
+ + + + + +3.9.18
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2023-32314
+https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac
+https://github.com/patriksimek/vm2
+https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf
+https://github.com/patriksimek/vm2/releases/tag/3.9.18
+https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5
+https://nvd.nist.gov/vuln/detail/CVE-2023-32314
+https://www.cve.org/CVERecord?id=CVE-2023-32314
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| marsdb | + + +0.6.11 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/marsdb/package.json | +
+ + + + + + + + + + + + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Command Injection in marsdb
+Matcher: javascript-matcher
+Package URL: pkg:npm/marsdb@0.6.11
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-5mrr-rgp6-x4gr
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 94 + + | + + +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + +vm2: Promise handler sanitization can be bypassed allowing attackers to escape the sandbox and run arbitrary code
+
+Target: Node.js
+Type: node-pkg
+Fixed version:vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19,
Promisehandler sanitization can be bypassed with the@@speciesaccessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2023-37466
+https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9
+https://github.com/patriksimek/vm2
+https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
+https://nvd.nist.gov/vuln/detail/CVE-2023-37466
+https://security.netapp.com/advisory/ntap-20230831-0007
+https://www.cve.org/CVERecord?id=CVE-2023-37466
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 78 + + | + + +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + +vm2: custom inspect function allows attackers to escape the sandbox and run arbitrary code
+
+Target: Node.js
+Type: node-pkg
+Fixed version:vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2023-37903
+https://github.com/patriksimek/vm2
+https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4
+https://nvd.nist.gov/vuln/detail/CVE-2023-37903
+https://security.netapp.com/advisory/ntap-20230831-0007
+https://security.netapp.com/advisory/ntap-20230831-0007/
+https://www.cve.org/CVERecord?id=CVE-2023-37903
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Critical + + + | ++ 0.96% + / + 75.74% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| crypto-js | + + +3.3.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/crypto-js/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
+Related Vulnerability Description: crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.
+Matcher: javascript-matcher
+Package URL: pkg:npm/crypto-js@3.3.0
+ + + + + + + + + + + +Upgrade to version: 4.2.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-xwcq-pm8m-c4vf
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2023-46233
+Related Vulnerability URLs:
+- https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a
+- https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf
+- https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html
+- https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a
+- https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf
+- https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 1321 + + | + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
+ + +nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.17.12Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
+ + + + + +4.17.12
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2019:3024
+https://access.redhat.com/security/cve/CVE-2019-10744
+https://github.com/advisories/GHSA-jf85-cpcp-j695
+https://github.com/lodash/lodash/pull/4336
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-10744.yml
+https://nvd.nist.gov/vuln/detail/CVE-2019-10744
+https://security.netapp.com/advisory/ntap-20191004-0005
+https://security.netapp.com/advisory/ntap-20191004-0005/
+https://snyk.io/vuln/SNYK-JS-LODASH-450202
+https://support.f5.com/csp/article/K47105354
+https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS
+https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS
+https://www.cve.org/CVERecord?id=CVE-2019-10744
+https://www.npmjs.com/advisories/1065
+https://www.oracle.com/security-alerts/cpujan2021.html
+https://www.oracle.com/security-alerts/cpuoct2020.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Critical + + + | ++ 69.49% + / + 98.61% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: vm2 Sandbox Escape vulnerability
+Related Vulnerability Description: vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification ofProxy. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version3.9.18ofvm2. Users are advised to upgrade. There are no known workarounds for this vulnerability.
+Matcher: javascript-matcher
+Package URL: pkg:npm/vm2@3.9.17
+ + + + + + + + + + + +Upgrade to version: 3.9.18
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-whpj-8f3w-67p5
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2023-32314
+Related Vulnerability URLs:
+- https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac
+- https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf
+- https://github.com/patriksimek/vm2/releases/tag/3.9.18
+- https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5
+- https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac
+- https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf
+- https://github.com/patriksimek/vm2/releases/tag/3.9.18
+- https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Critical + + + | ++ 41.15% + / + 97.31% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Verification Bypass in jsonwebtoken
+Related Vulnerability Description: In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS family).
+Matcher: javascript-matcher
+Package URL:* pkg:npm/jsonwebtoken@0.1.0
+ + + + + + + + + + + +Upgrade to version: 4.2.2
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-c7hr-j4mj-j2w6
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2015-9235
+Related Vulnerability URLs:
+- https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+- https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+- https://nodesecurity.io/advisories/17
+- https://www.timmclean.net/2015/02/25/jwt-alg-none.html
+- https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+- https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+- https://nodesecurity.io/advisories/17
+- https://www.timmclean.net/2015/02/25/jwt-alg-none.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Critical + + + | ++ 41.15% + / + 97.31% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Verification Bypass in jsonwebtoken
+Related Vulnerability Description: In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS family).
+Matcher: javascript-matcher
+Package URL:* pkg:npm/jsonwebtoken@0.4.0
+ + + + + + + + + + + +Upgrade to version: 4.2.2
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-c7hr-j4mj-j2w6
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2015-9235
+Related Vulnerability URLs:
+- https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+- https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+- https://nodesecurity.io/advisories/17
+- https://www.timmclean.net/2015/02/25/jwt-alg-none.html
+- https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+- https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+- https://nodesecurity.io/advisories/17
+- https://www.timmclean.net/2015/02/25/jwt-alg-none.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Critical + + + | ++ 35.57% + / + 96.96% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: vm2 Sandbox Escape vulnerability
+Related Vulnerability Description: vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.
+Matcher: javascript-matcher
+Package URL: pkg:npm/vm2@3.9.17
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-g644-9gfx-q4q4
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2023-37903
+Related Vulnerability URLs:
+- https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4
+- https://security.netapp.com/advisory/ntap-20230831-0007/
+- https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4
+- https://security.netapp.com/advisory/ntap-20230831-0007/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Critical + + + | ++ 4.73% + / + 88.97% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: vm2 Sandbox Escape vulnerability
+Related Vulnerability Description: vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19,Promisehandler sanitization can be bypassed with the@@speciesaccessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox.
+Matcher: javascript-matcher
+Package URL: pkg:npm/vm2@3.9.17
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-cchq-frgv-rjh5
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2023-37466
+Related Vulnerability URLs:
+- https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
+- https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Critical + + + | ++ 3.41% + / + 86.97% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Prototype Pollution in lodash
+Related Vulnerability Description: Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.
+Matcher: javascript-matcher
+Package URL: pkg:npm/lodash@2.4.2
+ + + + + + + + + + + +Upgrade to version: 4.17.12
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-jf85-cpcp-j695
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2019-10744
+Related Vulnerability URLs:
+- https://access.redhat.com/errata/RHSA-2019:3024
+- https://security.netapp.com/advisory/ntap-20191004-0005/
+- https://snyk.io/vuln/SNYK-JS-LODASH-450202
+- https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS
+- https://www.oracle.com/security-alerts/cpujan2021.html
+- https://www.oracle.com/security-alerts/cpuoct2020.html
+- https://access.redhat.com/errata/RHSA-2019:3024
+- https://security.netapp.com/advisory/ntap-20191004-0005/
+- https://snyk.io/vuln/SNYK-JS-LODASH-450202
+- https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS
+- https://www.oracle.com/security-alerts/cpujan2021.html
+- https://www.oracle.com/security-alerts/cpuoct2020.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 328 + + | + + +
| Component | + + +Version | + + +
|---|---|
| crypto-js | + + +3.3.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/crypto-js/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
+ + +crypto-js: PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.2.0crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.
+ + + + + +4.2.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2023-46233
+https://github.com/brix/crypto-js
+https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a
+https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf
+https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html
+https://nvd.nist.gov/vuln/detail/CVE-2023-46233
+https://ubuntu.com/security/notices/USN-6753-1
+https://www.cve.org/CVERecord?id=CVE-2023-46233
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| marsdb | + + +0.6.11 | + + +
| File Path | +
|---|
| juice-shop/node_modules/marsdb/package.json | +
+ + + + + + +Command Injection in marsdb
+
+Target: Node.js
+Type: node-pkg
+Fixed version:All versions of
+marsdbare vulnerable to Command Injection. In theDocumentMatcherclass, selectors on$whereclauses are passed to a Function constructor unsanitized. This allows attackers to run arbitrary commands in the system when the function is executed.Recommendation
+No fix is currently available. Consider using an alternative package until a fix is made available.
+ + + + + + + +affected
+ + + + + + + +https://github.com/bkimminich/juice-shop/issues/1173
+https://www.npmjs.com/advisories/1122
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 119 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + +glibc: stack guard protection bypass
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2019-1010022
+https://nvd.nist.gov/vuln/detail/CVE-2019-1010022
+https://security-tracker.debian.org/tracker/CVE-2019-1010022
+https://sourceware.org/bugzilla/show_bug.cgi?id=22850
+https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3
+https://ubuntu.com/security/CVE-2019-1010022
+https://www.cve.org/CVERecord?id=CVE-2019-1010022
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 20 + + | + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +nodejs-jsonwebtoken: verification step bypass with an altered token
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.2.2In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
+ + + + + +4.2.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2015-9235
+https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
+https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+https://github.com/advisories/GHSA-c7hr-j4mj-j2w6
+https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+https://nodesecurity.io/advisories/17
+https://nvd.nist.gov/vuln/detail/CVE-2015-9235
+https://www.cve.org/CVERecord?id=CVE-2015-9235
+https://www.npmjs.com/advisories/17
+https://www.timmclean.net/2015/02/25/jwt-alg-none.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Critical + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 20 + + | + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + +nodejs-jsonwebtoken: verification step bypass with an altered token
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.2.2In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).
+ + + + + +4.2.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2015-9235
+https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
+https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+https://github.com/advisories/GHSA-c7hr-j4mj-j2w6
+https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+https://nodesecurity.io/advisories/17
+https://nvd.nist.gov/vuln/detail/CVE-2015-9235
+https://www.cve.org/CVERecord?id=CVE-2015-9235
+https://www.npmjs.com/advisories/17
+https://www.timmclean.net/2015/02/25/jwt-alg-none.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +Verification Bypass
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=4.2.2It is possible for an attacker to bypass verification when "a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family)" [1]
+ + + + + ++=4.2.2
+
+ + + + + + + +fixed
+ + + + + + + +https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+https://www.timmclean.net/2015/02/25/jwt-alg-none.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 476 + + | + + +
| Component | + + +Version | + + +
|---|---|
| ws | + + +7.4.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/engine.io/node_modules/ws/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +nodejs-ws: denial of service when handling a request with many HTTP headers
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 5.2.4, 6.2.3, 7.5.10, 8.17.1ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
+ + + + + +5.2.4, 6.2.3, 7.5.10, 8.17.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-37890
+https://github.com/websockets/ws
+https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
+https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
+https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
+https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
+https://github.com/websockets/ws/issues/2230
+https://github.com/websockets/ws/pull/2231
+https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
+https://nodejs.org/api/http.html#servermaxheaderscount
+https://nvd.nist.gov/vuln/detail/CVE-2024-37890
+https://www.cve.org/CVERecord?id=CVE-2024-37890
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Line Number | + +
|---|
| 47 | + +
| File Path | +
|---|
| /juice-shop/build/lib/insecurity.js | +
+ + + + + + + + + + + + + + + + + + +Asymmetric Private Key
+Category: AsymmetricPrivateKey
+Match: ----BEGIN RSA PRIVATE KEY-----**********************************************************************************************************************-----END RSA PRIVATE
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + + + + + +glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.
+ + + + + + + +affected
+ + + + + + + +http://www.securityfocus.com/bid/107160
+https://access.redhat.com/security/cve/CVE-2018-20796
+https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141
+https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html
+https://nvd.nist.gov/vuln/detail/CVE-2018-20796
+https://security.netapp.com/advisory/ntap-20190315-0002/
+https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS
+https://www.cve.org/CVERecord?id=CVE-2018-20796
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Line Number | + +
|---|
| 23 | + +
| File Path | +
|---|
| /juice-shop/lib/insecurity.ts | +
+ + + + + + + + + + + + + + + + + + +Asymmetric Private Key
+Category: AsymmetricPrivateKey
+Match: ----BEGIN RSA PRIVATE KEY-----**********************************************************************************************************************-----END RSA PRIVATE
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.04% + / + 10.32% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/multer/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Multer vulnerable to Denial of Service via memory leaks from unclosed streams
+Related Vulnerability Description: Multer is a node.js middleware for handlingmultipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internalbusboystream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.
+Matcher: javascript-matcher
+Package URL: pkg:npm/multer@1.4.5-lts.2
+ + + + + + + + + + + +Upgrade to version: 2.0.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-44fp-w29j-9vj5
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2025-47935
+Related Vulnerability URLs:
+- https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
+- https://github.com/expressjs/multer/pull/1120
+- https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.05% + / + 15.42% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| tar-fs | + + +2.1.3 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/tar-fs/package.json | +
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball
+Related Vulnerability Description: tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.
+Matcher: javascript-matcher
+Package URL: pkg:npm/tar-fs@2.1.3
+ + + + + + + + + + + +Upgrade to version: 2.1.4
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-vj76-c3g6-qr5v
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2025-59343
+Related Vulnerability URLs:
+- https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09
+- https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.06% + / + 17.69% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Sanitize-html Vulnerable To REDoS Attacks
+Related Vulnerability Description: The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
+Matcher: javascript-matcher
+Package URL: pkg:npm/sanitize-html@1.4.2
+ + + + + + + + + + + +Upgrade to version: 2.7.1
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-cgfm-xwp7-2cvr
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-25887
+Related Vulnerability URLs:
+- https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c
+- https://github.com/apostrophecms/sanitize-html/pull/557
+- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102
+- https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526
+- https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c
+- https://github.com/apostrophecms/sanitize-html/pull/557
+- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102
+- https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.06% + / + 18.52% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: jsonwebtoken unrestricted key type could lead to legacy keys usage
+Related Vulnerability Description: Versions<=8.5.1ofjsonwebtokenlibrary could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set theallowInvalidAsymmetricKeyTypesoption totruein thesign()and/orverify()functions.
+Matcher: javascript-matcher
+Package URL: pkg:npm/jsonwebtoken@0.4.0
+ + + + + + + + + + + +Upgrade to version: 9.0.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-8cf7-32gw-wr33
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-23539
+Related Vulnerability URLs:
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
+- https://security.netapp.com/advisory/ntap-20240621-0007/
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
+- https://security.netapp.com/advisory/ntap-20240621-0007/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.06% + / + 18.52% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: jsonwebtoken unrestricted key type could lead to legacy keys usage
+Related Vulnerability Description: Versions<=8.5.1ofjsonwebtokenlibrary could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set theallowInvalidAsymmetricKeyTypesoption totruein thesign()and/orverify()functions.
+Matcher: javascript-matcher
+Package URL: pkg:npm/jsonwebtoken@0.1.0
+ + + + + + + + + + + +Upgrade to version: 9.0.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-8cf7-32gw-wr33
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-23539
+Related Vulnerability URLs:
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
+- https://security.netapp.com/advisory/ntap-20240621-0007/
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
+- https://security.netapp.com/advisory/ntap-20240621-0007/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.06% + / + 20.09% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/multer/package.json | +
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Multer vulnerable to Denial of Service via unhandled exception
+Related Vulnerability Description: Multer is a node.js middleware for handlingmultipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to2.0.1to receive a patch. No known workarounds are available.
+Matcher: javascript-matcher
+Package URL: pkg:npm/multer@1.4.5-lts.2
+ + + + + + + + + + + +Upgrade to version: 2.0.1
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-g5hg-p3ph-g8qg
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2025-48997
+Related Vulnerability URLs:
+- https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9
+- https://github.com/expressjs/multer/issues/1233
+- https://github.com/expressjs/multer/pull/1256
+- https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jws | + + +0.2.6 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/jws/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Forgeable Public/Private Tokens in jws
+Matcher: javascript-matcher
+Package URL: pkg:npm/jws@0.2.6
+ + + + + + + + + + + +Upgrade to version: 3.0.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-gjcw-v447-2w7q
+Related Vulnerability Datasource: nvd
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.10% + / + 27.52% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| express-jwt | + + +0.1.3 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/express-jwt/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Authorization bypass in express-jwt
+Related Vulnerability Description: In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have algorithms configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the secret. You can fix this by specifying algorithms in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.
+Matcher: javascript-matcher
+Package URL: pkg:npm/express-jwt@0.1.3
+ + + + + + + + + + + +Upgrade to version: 6.0.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-6g6m-m6h5-w9gf
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2020-15084
+Related Vulnerability URLs:
+- https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef
+- https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf
+- https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef
+- https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.16% + / + 37.41% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| http-cache-semantics | + + +3.8.1 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/http-cache-semantics/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: http-cache-semantics vulnerable to Regular Expression Denial of Service
+Related Vulnerability Description: This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
+Matcher: javascript-matcher
+Package URL: pkg:npm/http-cache-semantics@3.8.1
+ + + + + + + + + + + +Upgrade to version: 4.1.1
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-rc47-6667-2j5j
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-25881
+Related Vulnerability URLs:
+- https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
+- https://security.netapp.com/advisory/ntap-20230622-0008/
+- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
+- https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
+- https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
+- https://security.netapp.com/advisory/ntap-20230622-0008/
+- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
+- https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.22% + / + 45.19% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| braces | + + +2.3.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/braces/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Uncontrolled resource consumption in braces
+Related Vulnerability Description: The NPM packagebraces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. Inlib/parse.js,if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
+Matcher: javascript-matcher
+Package URL: pkg:npm/braces@2.3.2
+ + + + + + + + + + + +Upgrade to version: 3.0.3
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-grv7-fg5c-xmjg
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2024-4068
+Related Vulnerability URLs:
+- https://devhub.checkmarx.com/cve-details/CVE-2024-4068/
+- https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
+- https://github.com/micromatch/braces/issues/35
+- https://github.com/micromatch/braces/pull/37
+- https://github.com/micromatch/braces/pull/40
+- https://devhub.checkmarx.com/cve-details/CVE-2024-4068/
+- https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
+- https://github.com/micromatch/braces/issues/35
+- https://github.com/micromatch/braces/pull/37
+- https://github.com/micromatch/braces/pull/40
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 89 + + | + + +
| Line Number | + +
|---|
| 5 | + +
| File Path | +
|---|
| /src/data/static/codefixes/dbSchemaChallenge_1.ts | +
+ + + + + + + + + + + + +Result message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.
+ + + + + + + +https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.32% + / + 54.73% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| moment | + + +2.0.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/express-jwt/node_modules/moment/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Regular Expression Denial of Service in moment
+Related Vulnerability Description: The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.
+Matcher: javascript-matcher
+Package URL: pkg:npm/moment@2.0.0
+ + + + + + + + + + + +Upgrade to version: 2.19.3
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-446m-mv8f-q348
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2017-18214
+Related Vulnerability URLs:
+- https://github.com/moment/moment/issues/4163
+- https://nodesecurity.io/advisories/532
+- https://www.tenable.com/security/tns-2019-02
+- https://github.com/moment/moment/issues/4163
+- https://nodesecurity.io/advisories/532
+- https://www.tenable.com/security/tns-2019-02
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.41% + / + 60.53% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Prototype Pollution in lodash
+Related Vulnerability Description: A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
+Matcher: javascript-matcher
+Package URL: pkg:npm/lodash@2.4.2
+ + + + + + + + + + + +Upgrade to version: 4.17.11
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-4xc9-xhrj-v574
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2018-16487
+Related Vulnerability URLs:
+- https://hackerone.com/reports/380873
+- https://security.netapp.com/advisory/ntap-20190919-0004/
+- https://hackerone.com/reports/380873
+- https://security.netapp.com/advisory/ntap-20190919-0004/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.54% + / + 66.73% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| ws | + + +7.4.6 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/engine.io/node_modules/ws/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: ws affected by a DoS when handling a request with many HTTP headers
+Related Vulnerability Description: ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.
+Matcher: javascript-matcher
+Package URL: pkg:npm/ws@7.4.6
+ + + + + + + + + + + +Upgrade to version: 7.5.10
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-3h5v-q93c-6h6q
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2024-37890
+Related Vulnerability URLs:
+- https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
+- https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
+- https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
+- https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
+- https://github.com/websockets/ws/issues/2230
+- https://github.com/websockets/ws/pull/2231
+- https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
+- https://nodejs.org/api/http.html#servermaxheaderscount
+- https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f
+- https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e
+- https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c
+- https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63
+- https://github.com/websockets/ws/issues/2230
+- https://github.com/websockets/ws/pull/2231
+- https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q
+- https://nodejs.org/api/http.html#servermaxheaderscount
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.61% + / + 68.93% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| moment | + + +2.0.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/express-jwt/node_modules/moment/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Path Traversal: 'dir/../../filename' in moment.locale
+Related Vulnerability Description: Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
+Matcher: javascript-matcher
+Package URL: pkg:npm/moment@2.0.0
+ + + + + + + + + + + +Upgrade to version: 2.29.2
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-8hfj-j24r-96c4
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-24785
+Related Vulnerability URLs:
+- https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5
+- https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4
+- https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/
+- https://security.netapp.com/advisory/ntap-20220513-0006/
+- https://www.tenable.com/security/tns-2022-09
+- https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5
+- https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4
+- https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/
+- https://security.netapp.com/advisory/ntap-20220513-0006/
+- https://www.tenable.com/security/tns-2022-09
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.86% + / + 74.26% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Command Injection in lodash
+Related Vulnerability Description: Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
+Matcher: javascript-matcher
+Package URL: pkg:npm/lodash@2.4.2
+ + + + + + + + + + + +Upgrade to version: 4.17.21
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-35jh-r3h4-6jhm
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2021-23337
+Related Vulnerability URLs:
+- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
+- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851
+- https://security.netapp.com/advisory/ntap-20210312-0006/
+- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
+- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
+- https://www.oracle.com//security-alerts/cpujul2021.html
+- https://www.oracle.com/security-alerts/cpujan2022.html
+- https://www.oracle.com/security-alerts/cpujul2022.html
+- https://www.oracle.com/security-alerts/cpuoct2021.html
+- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
+- https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851
+- https://security.netapp.com/advisory/ntap-20210312-0006/
+- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
+- https://snyk.io/vuln/SNYK-JS-LODASH-1040724
+- https://www.oracle.com//security-alerts/cpujul2021.html
+- https://www.oracle.com/security-alerts/cpujan2022.html
+- https://www.oracle.com/security-alerts/cpujul2022.html
+- https://www.oracle.com/security-alerts/cpuoct2021.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 2.92% + / + 85.90% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| ip | + + +2.0.1 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/ip/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: ip SSRF improper categorization in isPublic
+Related Vulnerability Description: The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
+Matcher: javascript-matcher
+Package URL: pkg:npm/ip@2.0.1
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-2p57-rm9w-gvfp
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2024-29415
+Related Vulnerability URLs:
+- https://github.com/indutny/node-ip/issues/150
+- https://github.com/indutny/node-ip/pull/143
+- https://github.com/indutny/node-ip/pull/144
+- https://github.com/indutny/node-ip/issues/150
+- https://github.com/indutny/node-ip/pull/143
+- https://github.com/indutny/node-ip/pull/144
+- https://security.netapp.com/advisory/ntap-20250117-0010/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 2.44% + / + 84.63% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| lodash.set | + + +4.3.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/lodash.set/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Prototype Pollution in lodash
+Related Vulnerability Description: Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
+Matcher: javascript-matcher
+Package URL: pkg:npm/lodash.set@4.3.2
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-p6mc-m468-83gw
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2020-8203
+Related Vulnerability URLs:
+- https://github.com/lodash/lodash/issues/4874
+- https://hackerone.com/reports/712065
+- https://security.netapp.com/advisory/ntap-20200724-0006/
+- https://www.oracle.com//security-alerts/cpujul2021.html
+- https://www.oracle.com/security-alerts/cpuApr2021.html
+- https://www.oracle.com/security-alerts/cpuapr2022.html
+- https://www.oracle.com/security-alerts/cpujan2022.html
+- https://www.oracle.com/security-alerts/cpuoct2021.html
+- https://github.com/lodash/lodash/issues/4874
+- https://hackerone.com/reports/712065
+- https://security.netapp.com/advisory/ntap-20200724-0006/
+- https://www.oracle.com//security-alerts/cpujul2021.html
+- https://www.oracle.com/security-alerts/cpuApr2021.html
+- https://www.oracle.com/security-alerts/cpuapr2022.html
+- https://www.oracle.com/security-alerts/cpujan2022.html
+- https://www.oracle.com/security-alerts/cpuoct2021.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 327 + + | + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
+ + +jsonwebtoken: Unrestricted key type could lead to legacy keys usagen
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0Versions
<=8.5.1ofjsonwebtokenlibrary could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set theallowInvalidAsymmetricKeyTypesoption totruein thesign()and/orverify()functions.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23539
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
+https://nvd.nist.gov/vuln/detail/CVE-2022-23539
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23539
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +Verification Bypass
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=4.2.2It is possible for an attacker to bypass verification when "a token digitally signed with an asymetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family)" [1]
+ + + + + ++=4.2.2
+
+ + + + + + + +fixed
+ + + + + + + +https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687
+https://www.timmclean.net/2015/02/25/jwt-alg-none.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 89 + + | + + +
| Line Number | + +
|---|
| 23 | + +
| File Path | +
|---|
| /src/routes/search.ts | +
+ + + + + + + + + + + + +Result message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.
+ + + + + + + +https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 95 + + | + + +
| Line Number | + +
|---|
| 62 | + +
| File Path | +
|---|
| /src/routes/userProfile.ts | +
+ + + + + + + + + + + + +Result message: Found data from an Express or Next web request flowing to
eval. If this data is user-controllable this can lead to execution of arbitrary system commands in the context of your application process. Avoidevalwhenever possible.
+ + + + + + + +https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Global_Objects/eval
+https://nodejs.org/api/child_process.html#child_processexeccommand-options-callback
+https://www.stackhawk.com/blog/nodejs-command-injection-examples-and-prevention/
+https://ckarande.gitbooks.io/owasp-nodegoat-tutorial/content/tutorial/a1_-_server_side_js_injection.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jws | + + +0.2.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jws/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N
+ + +Forgeable Public/Private Tokens
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=3.0.0Since "algorithm" isn't enforced in
+jws.verify(), a malicious user could choose what algorithm is sent to the server. If the server is expecting RSA but is sent HMAC-SHA with RSA's public key, the server will think the public key is actually an HMAC private key. This could be used to forge any data an attacker wants.In addition, there is the
+nonealgorithm to be concerned about. In versions prior to 3.0.0, verification of the token could be bypassed when thealgfield is set tonone.Edit ( 7/29/16 ): A previous version of this advisory incorrectly stated that the vulnerability was patched in version 2.0.0 instead of 3.0.0. The advisory has been updated to reflect this new information. Thanks to Fabien Catteau for reporting the error.
+ + + + + ++=3.0.0
+
+ + + + + + + +fixed
+ + + + + + + +https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries
+https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/
+https://github.com/brianloveswords/node-jws
+https://github.com/brianloveswords/node-jws/commit/585d0e1e97b6747c10cf5b7689ccc5618a89b299#diff-4ac32a78649ca5bdd8e0ba38b7006a1e
+https://nvd.nist.gov/vuln/detail/CVE-2016-1000223
+https://snyk.io/vuln/npm:jws:20160726
+https://www.npmjs.com/advisories/88
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + + + + + +glibc: uncontrolled recursion in function check_dst_limits_calc_pos_1 in posix/regexec.c
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2019-9192
+https://nvd.nist.gov/vuln/detail/CVE-2019-9192
+https://sourceware.org/bugzilla/show_bug.cgi?id=24269
+https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS
+https://www.cve.org/CVERecord?id=CVE-2019-9192
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 94 + + | + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
+ + +nodejs-lodash: command injection via template
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.17.21Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.
+ + + + + +4.17.21
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2021-23337
+https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
+https://github.com/advisories/GHSA-35jh-r3h4-6jhm
+https://github.com/lodash/lodash
+https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js
+https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851
+https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851
+https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml
+https://nvd.nist.gov/vuln/detail/CVE-2021-23337
+https://security.netapp.com/advisory/ntap-20210312-0006
+https://security.netapp.com/advisory/ntap-20210312-0006/
+https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929
+https://snyk.io/vuln/SNYK-JS-LODASH-1040724
+https://www.cve.org/CVERecord?id=CVE-2021-23337
+https://www.oracle.com//security-alerts/cpujul2021.html
+https://www.oracle.com/security-alerts/cpujan2022.html
+https://www.oracle.com/security-alerts/cpujul2022.html
+https://www.oracle.com/security-alerts/cpuoct2021.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.04% + / + 10.32% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/multer/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Multer vulnerable to Denial of Service from maliciously crafted requests
+Related Vulnerability Description: Multer is a node.js middleware for handlingmultipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.
+Matcher: javascript-matcher
+Package URL: pkg:npm/multer@1.4.5-lts.2
+ + + + + + + + + + + +Upgrade to version: 2.0.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-4pg4-qvpc-4q3h
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2025-47944
+Related Vulnerability URLs:
+- https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
+- https://github.com/expressjs/multer/issues/1176
+- https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 89 + + | + + +
| Line Number | + +
|---|
| 34 | + +
| File Path | +
|---|
| /src/routes/login.ts | +
+ + + + + + + + + + + + +Result message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.
+ + + + + + + +https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 89 + + | + + +
| Line Number | + +
|---|
| 10 | + +
| File Path | +
|---|
| /src/data/static/codefixes/unionSqlInjectionChallenge_3.ts | +
+ + + + + + + + + + + + +Result message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.
+ + + + + + + +https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.01% + / + 0.91% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libc6 | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+ + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=arm64&distro=debian-12&upstream=glibc
+ + + + + + + + + + + +Upgrade to version: 2.36-9+deb12u11
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2025-4802
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2025-4802
+Related Vulnerability URLs:
+- https://sourceware.org/bugzilla/show_bug.cgi?id=32976
+- https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e
+- http://www.openwall.com/lists/oss-security/2025/05/16/7
+- http://www.openwall.com/lists/oss-security/2025/05/17/2
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 770 + + | + + +
| Component | + + +Version | + + +
|---|---|
| lodash.set | + + +4.3.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/lodash.set/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H
+ + + + + + +nodejs-lodash: prototype pollution in zipObjectDeep function
+
+Target: Node.js
+Type: node-pkg
+Fixed version:Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2020-8203
+https://github.com/advisories/GHSA-p6mc-m468-83gw
+https://github.com/github/advisory-database/pull/2884
+https://github.com/lodash/lodash
+https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12
+https://github.com/lodash/lodash/issues/4744
+https://github.com/lodash/lodash/issues/4874
+https://github.com/lodash/lodash/wiki/Changelog#v41719
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml
+https://hackerone.com/reports/712065
+https://hackerone.com/reports/864701
+https://nvd.nist.gov/vuln/detail/CVE-2020-8203
+https://security.netapp.com/advisory/ntap-20200724-0006
+https://security.netapp.com/advisory/ntap-20200724-0006/
+https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744
+https://www.cve.org/CVERecord?id=CVE-2020-8203
+https://www.npmjs.com/advisories/1523
+https://www.oracle.com//security-alerts/cpujul2021.html
+https://www.oracle.com/security-alerts/cpuApr2021.html
+https://www.oracle.com/security-alerts/cpuapr2022.html
+https://www.oracle.com/security-alerts/cpujan2022.html
+https://www.oracle.com/security-alerts/cpuoct2021.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+ + + + + + +glibc: running ldd on malicious ELF leads to code execution because of wrong size computation
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
+ + + + + + + +affected
+ + + + + + + +http://www.securityfocus.com/bid/109167
+https://access.redhat.com/security/cve/CVE-2019-1010023
+https://nvd.nist.gov/vuln/detail/CVE-2019-1010023
+https://security-tracker.debian.org/tracker/CVE-2019-1010023
+https://sourceware.org/bugzilla/show_bug.cgi?id=22851
+https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS
+https://ubuntu.com/security/CVE-2019-1010023
+https://www.cve.org/CVERecord?id=CVE-2019-1010023
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| base64url | + + +0.0.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/base64url/package.json | +
+ + +Out-of-bounds Read
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=3.0.0
base64urlallocates uninitialized Buffers when number is passed in input on Node.js 4.x and below
+ + + + + ++=3.0.0
+
+ + + + + + + +fixed
+ + + + + + + +https://github.com/brianloveswords/base64url/pull/25
+https://hackerone.com/reports/321687
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + + +
| Component | + + +Version | + + +
|---|---|
| moment | + + +2.0.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/moment/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
+ + +Moment.js: Path traversal in moment.locale
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.29.2Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.
+ + + + + +2.29.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-24785
+https://github.com/moment/moment
+https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5
+https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4
+https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5
+https://nvd.nist.gov/vuln/detail/CVE-2022-24785
+https://security.netapp.com/advisory/ntap-20220513-0006
+https://security.netapp.com/advisory/ntap-20220513-0006/
+https://ubuntu.com/security/notices/USN-5559-1
+https://www.cve.org/CVERecord?id=CVE-2022-24785
+https://www.tenable.com/security/tns-2022-09
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 400 + + | + + +
| Component | + + +Version | + + +
|---|---|
| moment | + + +2.0.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/moment/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +nodejs-moment: Regular expression denial of service
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.19.3The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.
+ + + + + +2.19.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2017-18214
+https://github.com/advisories/GHSA-446m-mv8f-q348
+https://github.com/moment/moment
+https://github.com/moment/moment/commit/69ed9d44957fa6ab12b73d2ae29d286a857b80eb
+https://github.com/moment/moment/issues/4163
+https://github.com/moment/moment/pull/4326
+https://nodesecurity.io/advisories/532
+https://nvd.nist.gov/vuln/detail/CVE-2017-18214
+https://ubuntu.com/security/notices/USN-4786-1
+https://www.cve.org/CVERecord?id=CVE-2017-18214
+https://www.npmjs.com/advisories/532
+https://www.tenable.com/security/tns-2019-02
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 426 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
+ + +glibc: static setuid binary dlopen may incorrectly search LD_LIBRARY_PATH
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 2.36-9+deb12u11Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).
+ + + + + +2.36-9+deb12u11
+ + + + + + + +fixed
+ + + + + + + +http://www.openwall.com/lists/oss-security/2025/05/16/7
+http://www.openwall.com/lists/oss-security/2025/05/17/2
+https://access.redhat.com/errata/RHSA-2025:8655
+https://access.redhat.com/security/cve/CVE-2025-4802
+https://bugzilla.redhat.com/2367468
+https://bugzilla.redhat.com/show_bug.cgi?id=2367468
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-4802
+https://errata.almalinux.org/9/ALSA-2025-8655.html
+https://errata.rockylinux.org/RLSA-2025:8686
+https://linux.oracle.com/cve/CVE-2025-4802.html
+https://linux.oracle.com/errata/ELSA-2025-8686.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-4802
+https://sourceware.org/bugzilla/show_bug.cgi?id=32976
+https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e
+https://sourceware.org/cgit/glibc/commit/?id=5451fa962cd0a90a0e2ec1d8910a559ace02bba0
+https://ubuntu.com/security/notices/USN-7541-1
+https://www.cve.org/CVERecord?id=CVE-2025-4802
+https://www.openwall.com/lists/oss-security/2025/05/16/7
+https://www.openwall.com/lists/oss-security/2025/05/17/2
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 401 + + | + + +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/multer/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Multer vulnerable to Denial of Service via memory leaks from unclosed streams
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.0.0Multer is a node.js middleware for handling
multipart/form-data. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internalbusboystream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.
+ + + + + +2.0.0
+ + + + + + + +fixed
+ + + + + + + +https://github.com/expressjs/multer
+https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
+https://github.com/expressjs/multer/pull/1120
+https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5
+https://nvd.nist.gov/vuln/detail/CVE-2025-47935
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 1050 + + | + + +
| Component | + + +Version | + + +
|---|---|
| braces | + + +2.3.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/braces/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +braces: fails to limit the number of characters it can handle
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.0.3The NPM package
braces, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. Inlib/parse.js,if a malicious user sends "imbalanced braces" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.
+ + + + + +3.0.3
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-4068
+https://devhub.checkmarx.com/cve-details/CVE-2024-4068
+https://devhub.checkmarx.com/cve-details/CVE-2024-4068/
+https://github.com/micromatch/braces
+https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308
+https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff
+https://github.com/micromatch/braces/issues/35
+https://github.com/micromatch/braces/pull/37
+https://github.com/micromatch/braces/pull/40
+https://nvd.nist.gov/vuln/detail/CVE-2024-4068
+https://www.cve.org/CVERecord?id=CVE-2024-4068
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 248 + + | + + +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/multer/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Multer vulnerable to Denial of Service from maliciously crafted requests
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.0.0Multer is a node.js middleware for handling
multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.
+ + + + + +2.0.0
+ + + + + + + +fixed
+ + + + + + + +https://github.com/expressjs/multer
+https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665
+https://github.com/expressjs/multer/issues/1176
+https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h
+https://nvd.nist.gov/vuln/detail/CVE-2025-47944
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + High + + + | ++ 0.02% + / + 3.19% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/multer/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Multer vulnerable to Denial of Service via unhandled exception from malformed request
+Related Vulnerability Description: Multer is a node.js middleware for handlingmultipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.2 to receive a patch. No known workarounds are available.
+Matcher: javascript-matcher
+Package URL: pkg:npm/multer@1.4.5-lts.2
+ + + + + + + + + + + +Upgrade to version: 2.0.2
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-fjgf-rc76-4x9p
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2025-7338
+Related Vulnerability URLs:
+- https://cna.openjsf.org/security-advisories.html
+- https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b
+- https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 248 + + | + + +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/multer/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +multer: Multer Denial of Service
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.0.2Multer is a node.js middleware for handling
multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.2 to receive a patch. No known workarounds are available.
+ + + + + +2.0.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2025-7338
+https://cna.openjsf.org/security-advisories.html
+https://github.com/expressjs/multer
+https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b
+https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p
+https://nvd.nist.gov/vuln/detail/CVE-2025-7338
+https://www.cve.org/CVERecord?id=CVE-2025-7338
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +sanitize-html: insecure global regular expression replacement logic may lead to ReDoS
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.7.1The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.
+ + + + + +2.7.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-25887
+https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c
+https://github.com/apostrophecms/sanitize-html/pull/557
+https://nvd.nist.gov/vuln/detail/CVE-2022-25887
+https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102
+https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526
+https://ubuntu.com/security/notices/USN-7464-1
+https://www.cve.org/CVERecord?id=CVE-2022-25887
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 89 + + | + + +
| Line Number | + +
|---|
| 11 | + +
| File Path | +
|---|
| /src/data/static/codefixes/dbSchemaChallenge_3.ts | +
+ + + + + + + + + + + + +Result message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.
+ + + + + + + +https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 285 + + | + + +
| Component | + + +Version | + + +
|---|---|
| express-jwt | + + +0.1.3 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N
+ + +Authorization bypass in express-jwt
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 6.0.0In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have algorithms configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the secret. You can fix this by specifying algorithms in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.
+ + + + + +6.0.0
+ + + + + + + +fixed
+ + + + + + + +https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef
+https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf
+https://nvd.nist.gov/vuln/detail/CVE-2020-15084
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 89 + + | + + +
| Line Number | + +
|---|
| 6 | + +
| File Path | +
|---|
| /src/data/static/codefixes/unionSqlInjectionChallenge_1.ts | +
+ + + + + + + + + + + + +Result message: Detected a sequelize statement that is tainted by user-input. This could lead to SQL injection if the variable is user-controlled and is not properly sanitized. In order to prevent SQL injection, it is recommended to use parameterized queries or prepared statements.
+ + + + + + + +https://sequelize.org/docs/v6/core-concepts/raw-queries/#replacements
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + + +
| Component | + + +Version | + + +
|---|---|
| http-cache-semantics | + + +3.8.1 | + + +
| File Path | +
|---|
| juice-shop/node_modules/http-cache-semantics/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + +http-cache-semantics: Regular Expression Denial of Service (ReDoS) vulnerability
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.1.1This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.
+ + + + + +4.1.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2023:2655
+https://access.redhat.com/security/cve/CVE-2022-25881
+https://bugzilla.redhat.com/2165824
+https://bugzilla.redhat.com/2168631
+https://bugzilla.redhat.com/2171935
+https://bugzilla.redhat.com/2172190
+https://bugzilla.redhat.com/2172204
+https://bugzilla.redhat.com/2172217
+https://bugzilla.redhat.com/show_bug.cgi?id=2165824
+https://bugzilla.redhat.com/show_bug.cgi?id=2168631
+https://bugzilla.redhat.com/show_bug.cgi?id=2171935
+https://bugzilla.redhat.com/show_bug.cgi?id=2172190
+https://bugzilla.redhat.com/show_bug.cgi?id=2172204
+https://bugzilla.redhat.com/show_bug.cgi?id=2172217
+https://bugzilla.redhat.com/show_bug.cgi?id=2178076
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25881
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-4904
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23918
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23920
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23936
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-24807
+https://errata.almalinux.org/9/ALSA-2023-2655.html
+https://errata.rockylinux.org/RLSA-2023:2655
+https://github.com/kornelski/http-cache-semantics
+https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83
+https://github.com/kornelski/http-cache-semantics/commit/560b2d8ef452bbba20ffed69dc155d63ac757b74
+https://linux.oracle.com/cve/CVE-2022-25881.html
+https://linux.oracle.com/errata/ELSA-2023-2655.html
+https://nvd.nist.gov/vuln/detail/CVE-2022-25881
+https://security.netapp.com/advisory/ntap-20230622-0008
+https://security.netapp.com/advisory/ntap-20230622-0008/
+https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332
+https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783
+https://www.cve.org/CVERecord?id=CVE-2022-25881
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 918 + + | + + +
| Component | + + +Version | + + +
|---|---|
| ip | + + +2.0.1 | + + +
| File Path | +
|---|
| juice-shop/node_modules/ip/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + +node-ip: Incomplete fix for CVE-2023-42282
+
+Target: Node.js
+Type: node-pkg
+Fixed version:The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-29415
+https://cosmosofcyberspace.github.io/npm_ip_cve/npm_ip_cve.html
+https://github.com/indutny/node-ip
+https://github.com/indutny/node-ip/issues/150
+https://github.com/indutny/node-ip/pull/143
+https://github.com/indutny/node-ip/pull/144
+https://nvd.nist.gov/vuln/detail/CVE-2024-29415
+https://security.netapp.com/advisory/ntap-20250117-0010
+https://security.netapp.com/advisory/ntap-20250117-0010/
+https://www.cve.org/CVERecord?id=CVE-2024-29415
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 20 + + | + + +
| Component | + + +Version | + + +
|---|---|
| socket.io | + + +3.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/socket.io/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
+ + +socket.io: Unhandled 'error' event
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.5.1, 4.6.2Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit
15af22fc22which has been included insocket.io@4.6.2(released in May 2023). The fix was backported in the 2.x branch as well with commitd30630ba10. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
+ + + + + +2.5.1, 4.6.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-38355
+https://github.com/socketio/socket.io
+https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115
+https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c
+https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj
+https://nvd.nist.gov/vuln/detail/CVE-2024-38355
+https://www.cve.org/CVERecord?id=CVE-2024-38355
+https://www.vicarius.io/vsociety/posts/unhandled-exception-in-socketio-cve-2024-38355
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 20 + + | + + +
| Component | + + +Version | + + +
|---|---|
| socket.io-parser | + + +4.0.5 | + + +
| File Path | +
|---|
| juice-shop/node_modules/socket.io-parser/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
+ + +socket.io parser is a socket.io encoder and decoder written in JavaScr ...
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.2.3, 3.4.3, 3.3.4socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.
+ + + + + +4.2.3, 3.4.3, 3.3.4
+ + + + + + + +fixed
+ + + + + + + +https://github.com/socketio/socket.io-parser
+https://github.com/socketio/socket.io-parser/commit/1c220ddbf45ea4b44bc8dbf6f9ae245f672ba1b9
+https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced
+https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3
+https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4
+https://github.com/socketio/socket.io-parser/releases/tag/4.2.3
+https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9
+https://nvd.nist.gov/vuln/detail/CVE-2023-32695
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 327 + + | + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
+ + +jsonwebtoken: Unrestricted key type could lead to legacy keys usagen
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0Versions
<=8.5.1ofjsonwebtokenlibrary could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set theallowInvalidAsymmetricKeyTypesoption totruein thesign()and/orverify()functions.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23539
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33
+https://nvd.nist.gov/vuln/detail/CVE-2022-23539
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23539
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + High + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 22 + + | + + +
| Component | + + +Version | + + +
|---|---|
| tar-fs | + + +2.1.3 | + + +
| File Path | +
|---|
| juice-shop/node_modules/tar-fs/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
+ + +tar-fs: tar-fs symlink validation bypass
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.1.1, 2.1.4, 1.16.6tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.
+ + + + + +3.1.1, 2.1.4, 1.16.6
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2025-59343
+https://github.com/mafintosh/tar-fs
+https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09
+https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v
+https://nvd.nist.gov/vuln/detail/CVE-2025-59343
+https://www.cve.org/CVERecord?id=CVE-2025-59343
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.33% + / + 55.21% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Cross-Site Scripting in sanitize-html
+Related Vulnerability Description: sanitize-html before 1.4.3 has XSS.
+Matcher: javascript-matcher
+Package URL: pkg:npm/sanitize-html@1.4.2
+ + + + + + + + + + + +Upgrade to version: 1.4.3
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-3j7m-hmh3-9jmp
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2016-1000237
+Related Vulnerability URLs:
+- https://nodesecurity.io/advisories/135
+- https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json
+- https://nodesecurity.io/advisories/135
+- https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + + +
| Line Number | + +
|---|
| 17 | + +
| File Path | +
|---|
| /src/frontend/src/app/navbar/navbar.component.html | +
+ + + + + + + + + + + + +Result message: Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}".
+ + + + + + + +https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + + +
| Line Number | + +
|---|
| 15 | + +
| File Path | +
|---|
| /src/frontend/src/app/purchase-basket/purchase-basket.component.html | +
+ + + + + + + + + + + + +Result message: Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}".
+ + + + + + + +https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + + +
| Line Number | + +
|---|
| 40 | + +
| File Path | +
|---|
| /src/frontend/src/app/search-result/search-result.component.html | +
+ + + + + + + + + + + + +Result message: Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}".
+ + + + + + + +https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 798 + + | + + +
| Line Number | + +
|---|
| 56 | + +
| File Path | +
|---|
| /src/lib/insecurity.ts | +
+ + + + + + + + + + + + +Result message: A hard-coded credential was detected. It is not recommended to store credentials in source-code, as this risks secrets being leaked and used by either an internal or external malicious adversary. It is recommended to use environment variables to securely provide credentials or retrieve credentials from a secure vault or HSM (Hardware Security Module).
+ + + + + + + +https://cheatsheetseries.owasp.org/cheatsheets/Secrets_Management_Cheat_Sheet.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + + +
| Line Number | + +
|---|
| 197 | + +
| File Path | +
|---|
| /src/routes/chatbot.ts | +
+ + + + + + + + + + + + +Result message: User data flows into the host portion of this manually-constructed HTML. This can introduce a Cross-Site-Scripting (XSS) vulnerability if this comes from user-provided input. Consider using a sanitization library such as DOMPurify to sanitize the HTML within.
+ + + + + + + +https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 73 + + | + + +
| Line Number | + +
|---|
| 33 | + +
| File Path | +
|---|
| /src/routes/fileServer.ts | +
+ + + + + + + + + + + + +Result message: The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing.
+ + + + + + + +https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 73 + + | + + +
| Line Number | + +
|---|
| 14 | + +
| File Path | +
|---|
| /src/routes/keyServer.ts | +
+ + + + + + + + + + + + +Result message: The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing.
+ + + + + + + +https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 73 + + | + + +
| Line Number | + +
|---|
| 14 | + +
| File Path | +
|---|
| /src/routes/logfileServer.ts | +
+ + + + + + + + + + + + +Result message: The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing.
+ + + + + + + +https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 73 + + | + + +
| Line Number | + +
|---|
| 14 | + +
| File Path | +
|---|
| /src/routes/quarantineServer.ts | +
+ + + + + + + + + + + + +Result message: The application processes user-input, this is passed to res.sendFile which can allow an attacker to arbitrarily read files on the system through path traversal. It is recommended to perform input validation in addition to canonicalizing the path. This allows you to validate the path against the intended directory it should be accessing.
+ + + + + + + +https://cheatsheetseries.owasp.org/cheatsheets/Input_Validation_Cheat_Sheet.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 601 + + | + + +
| Line Number | + +
|---|
| 19 | + +
| File Path | +
|---|
| /src/routes/redirect.ts | +
+ + + + + + + + + + + + +Result message: It looks like 'toUrl' is read from user input and it is used to as a redirect. Ensure 'toUrl' is not externally controlled, otherwise this is an open redirect.
+ + + + + + + +https://owasp.org/Top10/A01_2021-Broken_Access_Control
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 601 + + | + + +
| Line Number | + +
|---|
| 19 | + +
| File Path | +
|---|
| /src/routes/redirect.ts | +
+ + + + + + + + + + + + +Result message: The application redirects to a URL specified by user-supplied input
querythat is not validated. This could redirect users to malicious locations. Consider using an allow-list approach to validate URLs, or warn users they are being redirected to a third-party website.
+ + + + + + + +https://cheatsheetseries.owasp.org/cheatsheets/Unvalidated_Redirects_and_Forwards_Cheat_Sheet.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + + +
| Line Number | + +
|---|
| 58 | + +
| File Path | +
|---|
| /src/routes/videoHandler.ts | +
+ + + + + + + + + + + + +Result message: Cannot determine what 'subs' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'subs' is not externally controlled, or sanitize this data.
+ + + + + + + +https://www.developsec.com/2017/11/09/xss-in-a-script-tag/
+https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + + +
| Line Number | + +
|---|
| 71 | + +
| File Path | +
|---|
| /src/routes/videoHandler.ts | +
+ + + + + + + + + + + + +Result message: Cannot determine what 'subs' is and it is used with a '<script>' tag. This could be susceptible to cross-site scripting (XSS). Ensure 'subs' is not externally controlled, or sanitize this data.
+ + + + + + + +https://www.developsec.com/2017/11/09/xss-in-a-script-tag/
+https://github.com/juice-shop/juice-shop/blob/1ceb8751e986dacd3214a618c37e7411be6bc11a/routes/videoHandler.ts#L68
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 548 + + | + + +
| Line Number | + +
|---|
| 269 | + +
| File Path | +
|---|
| /src/server.ts | +
+ + + + + + + + + + + + +Result message: Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource.
+ + + + + + + +https://www.npmjs.com/package/serve-index
+https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 548 + + | + + +
| Line Number | + +
|---|
| 273 | + +
| File Path | +
|---|
| /src/server.ts | +
+ + + + + + + + + + + + +Result message: Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource.
+ + + + + + + +https://www.npmjs.com/package/serve-index
+https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 548 + + | + + +
| Line Number | + +
|---|
| 277 | + +
| File Path | +
|---|
| /src/server.ts | +
+ + + + + + + + + + + + +Result message: Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource.
+ + + + + + + +https://www.npmjs.com/package/serve-index
+https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 548 + + | + + +
| Line Number | + +
|---|
| 281 | + +
| File Path | +
|---|
| /src/server.ts | +
+ + + + + + + + + + + + +Result message: Directory listing/indexing is enabled, which may lead to disclosure of sensitive directories and files. It is recommended to disable directory listing unless it is a public resource. If you need directory listing, ensure that sensitive files are inaccessible when querying the resource.
+ + + + + + + +https://www.npmjs.com/package/serve-index
+https://www.acunetix.com/blog/articles/directory-listing-information-disclosure/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + + +
| Line Number | + +
|---|
| 21 | + +
| File Path | +
|---|
| /src/views/dataErasureForm.hbs | +
+ + + + + + + + + + + + +Result message: Detected a unquoted template variable as an attribute. If unquoted, a malicious actor could inject custom JavaScript handlers. To fix this, add quotes around the template expression, like this: "{{ expr }}".
+ + + + + + + +https://flask.palletsprojects.com/en/1.1.x/security/#cross-site-scripting-xss
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + + +
| Component | + + +Version | + + +
|---|---|
| gcc-12-base | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + +binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-27943
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead
+https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+https://www.cve.org/CVERecord?id=CVE-2022-27943
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 415 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:L
+ + +glibc: Double free in glibc
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version: 2.36-9+deb12u13The regcomp function in the GNU C library version from 2.4 to 2.41 is
+subject to a double free if some previous allocation fails. It can be
+accomplished either by a malloc failure or by using an interposed malloc
+ that injects random malloc failures. The double free can allow buffer
+manipulation depending of how the regex is constructed. This issue
+affects all architectures and ABIs supported by the GNU C library.
+ + + + + +2.36-9+deb12u13
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2025:12980
+https://access.redhat.com/security/cve/CVE-2025-8058
+https://bugzilla.redhat.com/2383146
+https://bugzilla.redhat.com/show_bug.cgi?id=2383146
+https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8058
+https://errata.almalinux.org/8/ALSA-2025-12980.html
+https://errata.rockylinux.org/RLSA-2025:12980
+https://linux.oracle.com/cve/CVE-2025-8058.html
+https://linux.oracle.com/errata/ELSA-2025-20595.html
+https://nvd.nist.gov/vuln/detail/CVE-2025-8058
+https://sourceware.org/bugzilla/show_bug.cgi?id=33185
+https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2025-0005
+https://sourceware.org/git/?p=glibc.git;a=commit;h=3ff17af18c38727b88d9115e536c069e6b5d601f
+https://ubuntu.com/security/notices/USN-7760-1
+https://www.cve.org/CVERecord?id=CVE-2025-8058
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 399 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + + + + + +glibc: glob implementation can cause excessive CPU and memory consumption due to crafted glob expressions
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.
+ + + + + + + +affected
+ + + + + + + +http://cxib.net/stuff/glob-0day.c
+http://securityreason.com/achievement_securityalert/89
+http://securityreason.com/exploitalert/9223
+https://access.redhat.com/security/cve/CVE-2010-4756
+https://bugzilla.redhat.com/show_bug.cgi?id=681681
+https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756
+https://nvd.nist.gov/vuln/detail/CVE-2010-4756
+https://www.cve.org/CVERecord?id=CVE-2010-4756
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 200 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ + + + + + +glibc: ASLR bypass using cache of thread stack and heap
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
+ + + + + + + +affected
+ + + + + + + +http://www.securityfocus.com/bid/109162
+https://access.redhat.com/security/cve/CVE-2019-1010024
+https://nvd.nist.gov/vuln/detail/CVE-2019-1010024
+https://security-tracker.debian.org/tracker/CVE-2019-1010024
+https://sourceware.org/bugzilla/show_bug.cgi?id=22852
+https://support.f5.com/csp/article/K06046097
+https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS
+https://ubuntu.com/security/CVE-2019-1010024
+https://www.cve.org/CVERecord?id=CVE-2019-1010024
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 330 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ + + + + + +glibc: information disclosure of heap addresses of pthread_created thread
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2019-1010025
+https://nvd.nist.gov/vuln/detail/CVE-2019-1010025
+https://security-tracker.debian.org/tracker/CVE-2019-1010025
+https://sourceware.org/bugzilla/show_bug.cgi?id=22853
+https://support.f5.com/csp/article/K06046097
+https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS
+https://ubuntu.com/security/CVE-2019-1010025
+https://www.cve.org/CVERecord?id=CVE-2019-1010025
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libgcc-s1 | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + +binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-27943
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead
+https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+https://www.cve.org/CVERecord?id=CVE-2022-27943
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libgomp1 | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + +binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-27943
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead
+https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+https://www.cve.org/CVERecord?id=CVE-2022-27943
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 674 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libstdc++6 | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + +binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+ + + + + + + +affected
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-27943
+https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=1a770b01ef415e114164b6151d1e55acdee09371
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=9234cdca6ee88badfc00297e72f13dac4e540c79
+https://gcc.gnu.org/git/gitweb.cgi?p=gcc.git;h=fc968115a742d9e4674d9725ce9c2106b91b6ead
+https://gcc.gnu.org/pipermail/gcc-patches/2022-March/592244.html
+https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+https://www.cve.org/CVERecord?id=CVE-2022-27943
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| base64url | + + +0.0.6 | + + +
| File Path | +
|---|
| juice-shop/node_modules/base64url/package.json | +
+ + +Out-of-bounds Read in base64url
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.0.0Versions of
+base64urlbefore 3.0.0 are vulnerable to to out-of-bounds reads as it allocates uninitialized Buffers when number is passed in input on Node.js 4.x and below.Recommendation
+Update to version 3.0.0 or later.
+ + + + + +3.0.0
+ + + + + + + +fixed
+ + + + + + + +https://github.com/brianloveswords/base64url
+https://github.com/brianloveswords/base64url/commit/4fbd954a0a69e9d898de2146557cc6e893e79542
+https://github.com/brianloveswords/base64url/pull/25
+https://hackerone.com/reports/321687
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 248 + + | + + +
| Component | + + +Version | + + +
|---|---|
| engine.io | + + +4.1.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/engine.io/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
+ + +engine.io: Specially crafted HTTP request can trigger an uncaught exception
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.6.1, 6.2.1Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
+ + + + + +3.6.1, 6.2.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-41940
+https://github.com/socketio/engine.io
+https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6
+https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085
+https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w
+https://nvd.nist.gov/vuln/detail/CVE-2022-41940
+https://www.cve.org/CVERecord?id=CVE-2022-41940
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| got | + + +8.3.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/got/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +nodejs-got: missing verification of requested URLs allows redirects to UNIX sockets
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 12.1.0, 11.8.5The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
+ + + + + +12.1.0, 11.8.5
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2022:6595
+https://access.redhat.com/security/cve/CVE-2022-33987
+https://bugzilla.redhat.com/1907444
+https://bugzilla.redhat.com/1945459
+https://bugzilla.redhat.com/1964461
+https://bugzilla.redhat.com/2007557
+https://bugzilla.redhat.com/2098556
+https://bugzilla.redhat.com/2102001
+https://bugzilla.redhat.com/2105422
+https://bugzilla.redhat.com/2105426
+https://bugzilla.redhat.com/2105428
+https://bugzilla.redhat.com/2105430
+https://errata.almalinux.org/9/ALSA-2022-6595.html
+https://github.com/sindresorhus/got
+https://github.com/sindresorhus/got/commit/861ccd9ac2237df762a9e2beed7edd88c60782dc
+https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0
+https://github.com/sindresorhus/got/pull/2047
+https://github.com/sindresorhus/got/releases/tag/v11.8.5
+https://github.com/sindresorhus/got/releases/tag/v12.1.0
+https://linux.oracle.com/cve/CVE-2022-33987.html
+https://linux.oracle.com/errata/ELSA-2022-6595.html
+https://nvd.nist.gov/vuln/detail/CVE-2022-33987
+https://www.cve.org/CVERecord?id=CVE-2022-33987
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 287 + + | + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
+ + +jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0In versions
<=8.5.1ofjsonwebtokenlibrary, lack of algorithm definition in thejwt.verify()function can lead to signature validation bypass due to defaulting to thenonealgorithm for signature verification. Users are affected if you do not specify algorithms in thejwt.verify()function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in thejwt.verify()method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for thenonealgorithm. If you need 'none' algorithm, you have to explicitly specify that injwt.verify()options.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23540
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
+https://nvd.nist.gov/vuln/detail/CVE-2022-23540
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23540
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 287 + + | + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
+ + +jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0jsonwebtoken is an implementation of JSON Web Tokens. Versions
<= 8.5.1ofjsonwebtokenlibrary can be misconfigured so that passing a poorly implemented key retrieval function referring to thesecretOrPublicKeyargument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23541
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
+https://nvd.nist.gov/vuln/detail/CVE-2022-23541
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23541
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 287 + + | + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
+ + +jsonwebtoken: Insecure default algorithm in jwt.verify() could lead to signature validation bypass
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0In versions
<=8.5.1ofjsonwebtokenlibrary, lack of algorithm definition in thejwt.verify()function can lead to signature validation bypass due to defaulting to thenonealgorithm for signature verification. Users are affected if you do not specify algorithms in thejwt.verify()function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in thejwt.verify()method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for thenonealgorithm. If you need 'none' algorithm, you have to explicitly specify that injwt.verify()options.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23540
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
+https://nvd.nist.gov/vuln/detail/CVE-2022-23540
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23540
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 287 + + | + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
+ + +jsonwebtoken: Insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 9.0.0jsonwebtoken is an implementation of JSON Web Tokens. Versions
<= 8.5.1ofjsonwebtokenlibrary can be misconfigured so that passing a poorly implemented key retrieval function referring to thesecretOrPublicKeyargument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
+ + + + + +9.0.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2022-23541
+https://github.com/auth0/node-jsonwebtoken
+https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
+https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
+https://nvd.nist.gov/vuln/detail/CVE-2022-23541
+https://security.netapp.com/advisory/ntap-20240621-0007
+https://security.netapp.com/advisory/ntap-20240621-0007/
+https://www.cve.org/CVERecord?id=CVE-2022-23541
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 400 + + | + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
+ + +lodash: Prototype pollution in utilities function
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=4.17.11A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.
+ + + + + ++=4.17.11
+
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2018-16487
+https://github.com/advisories/GHSA-4xc9-xhrj-v574
+https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-16487.yml
+https://hackerone.com/reports/380873
+https://nvd.nist.gov/vuln/detail/CVE-2018-16487
+https://security.netapp.com/advisory/ntap-20190919-0004
+https://security.netapp.com/advisory/ntap-20190919-0004/
+https://www.cve.org/CVERecord?id=CVE-2018-16487
+https://www.npmjs.com/advisories/782
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 400 + + | + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
+ + +lodash: uncontrolled resource consumption in Data handler causing denial of service
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.17.11lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
+ + + + + +4.17.11
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2019-1010266
+https://github.com/advisories/GHSA-x5rq-j2xg-h7qm
+https://github.com/lodash/lodash/commit/5c08f18d365b64063bfbfa686cbb97cdd6267347
+https://github.com/lodash/lodash/issues/3359
+https://github.com/lodash/lodash/wiki/Changelog
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-1010266.yml
+https://nvd.nist.gov/vuln/detail/CVE-2019-1010266
+https://security.netapp.com/advisory/ntap-20190919-0004
+https://security.netapp.com/advisory/ntap-20190919-0004/
+https://snyk.io/vuln/SNYK-JS-LODASH-73639
+https://www.cve.org/CVERecord?id=CVE-2019-1010266
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
+ + +nodejs-lodash: ReDoS via the toNumber, trim and trimEnd functions
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.17.21Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
+ + + + + +4.17.21
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2020-28500
+https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
+https://github.com/advisories/GHSA-29mw-wpgm-hmr9
+https://github.com/lodash/lodash
+https://github.com/lodash/lodash/blob/npm/trimEnd.js
+https://github.com/lodash/lodash/blob/npm/trimEnd.js#L8
+https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8
+https://github.com/lodash/lodash/commit/c4847ebe7d14540bb28a8b932a9ce1b9ecbfee1a
+https://github.com/lodash/lodash/pull/5065
+https://github.com/lodash/lodash/pull/5065/commits/02906b8191d3c100c193fe6f7b27d1c40f200bb7
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-28500.yml
+https://nvd.nist.gov/vuln/detail/CVE-2020-28500
+https://security.netapp.com/advisory/ntap-20210312-0006
+https://security.netapp.com/advisory/ntap-20210312-0006/
+https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
+https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
+https://snyk.io/vuln/SNYK-JS-LODASH-1018905
+https://www.cve.org/CVERecord?id=CVE-2020-28500
+https://www.oracle.com//security-alerts/cpujul2021.html
+https://www.oracle.com/security-alerts/cpujan2022.html
+https://www.oracle.com/security-alerts/cpujul2022.html
+https://www.oracle.com/security-alerts/cpuoct2021.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 471 + + | + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
+ + +lodash: Prototype pollution in utilities function
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=4.17.5lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
+ + + + + ++=4.17.5
+
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2018-3721
+https://github.com/advisories/GHSA-fvqr-27wr-82fm
+https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
+https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-3721.yml
+https://hackerone.com/reports/310443
+https://nvd.nist.gov/vuln/detail/CVE-2018-3721
+https://security.netapp.com/advisory/ntap-20190919-0004
+https://security.netapp.com/advisory/ntap-20190919-0004/
+https://snyk.io/vuln/npm:lodash:20180130
+https://www.cve.org/CVERecord?id=CVE-2018-3721
+https://www.npmjs.com/advisories/577
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +Cross Site Scripting
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=1.11.4Sanitize-html is a library for scrubbing html input of malicious values.
+Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios:
+If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
+
+PoC:var sanitizeHtml = require('sanitize-html'); + +var dirty = '!<textarea></textarea><svg/onload=prompt`xs`></textarea>!'; +var clean = sanitizeHtml(dirty, { + allowedTags: [ 'textarea' ] +}); + +console.log(clean); + +// !<textarea></textarea><svg/onload=prompt`xs`></textarea>! +
+ + + + + ++=1.11.4
+
+ + + + + + + +fixed
+ + + + + + + +https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403
+https://github.com/punkave/sanitize-html/issues/100
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 1333 + + | + + +
| Component | + + +Version | + + +
|---|---|
| micromatch | + + +3.1.10 | + + +
| File Path | +
|---|
| juice-shop/node_modules/micromatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
+ + +micromatch: vulnerable to Regular Expression Denial of Service
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 4.0.8The NPM package
micromatchprior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs inmicromatch.braces()inindex.jsbecause the pattern.*will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
+ + + + + +4.0.8
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-4067
+https://advisory.checkmarx.net/advisory/CVE-2024-4067
+https://advisory.checkmarx.net/advisory/CVE-2024-4067/
+https://devhub.checkmarx.com/cve-details/CVE-2024-4067
+https://devhub.checkmarx.com/cve-details/CVE-2024-4067/
+https://github.com/micromatch/micromatch
+https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448
+https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade
+https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0
+https://github.com/micromatch/micromatch/issues/243
+https://github.com/micromatch/micromatch/pull/247
+https://github.com/micromatch/micromatch/pull/266
+https://github.com/micromatch/micromatch/releases/tag/4.0.8
+https://nvd.nist.gov/vuln/detail/CVE-2024-4067
+https://www.cve.org/CVERecord?id=CVE-2024-4067
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 400 + + | + + +
| Component | + + +Version | + + +
|---|---|
| moment | + + +2.0.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/express-jwt/node_modules/moment/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
+ + +moment.js: regular expression denial of service
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=2.11.2The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
+ + + + + ++=2.11.2
+
+ + + + + + + +fixed
+ + + + + + + +http://www.openwall.com/lists/oss-security/2016/04/20/11
+http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
+http://www.securityfocus.com/bid/95849
+https://access.redhat.com/security/cve/CVE-2016-4055
+https://github.com/advisories/GHSA-87vv-r9j6-g5qv
+https://github.com/moment/moment
+https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E
+https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E
+https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E
+https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E
+https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E
+https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E
+https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E
+https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E
+https://nodesecurity.io/advisories/55
+https://nvd.nist.gov/vuln/detail/CVE-2016-4055
+https://ubuntu.com/security/notices/USN-4786-1
+https://www.cve.org/CVERecord?id=CVE-2016-4055
+https://www.npmjs.com/advisories/55
+https://www.owasp.org/index.php/Regular_expression_Denial_of_Service_-_ReDoS
+https://www.tenable.com/security/tns-2019-02
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Line Number | + +
|---|
| 61 | + +
| File Path | +
|---|
| /juice-shop/frontend/src/app/last-login-ip/last-login-ip.component.spec.ts | +
+ + + + + + + + + + + + + + + + + + +JWT token
+Category: JWT
+Match: ocalStorage.setItem('token', '*******************')
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 248 + + | + + +
| Component | + + +Version | + + +
|---|---|
| multer | + + +1.4.5-lts.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/multer/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
+ + +multer: Multer vulnerable to Denial of Service via unhandled exception
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.0.1Multer is a node.js middleware for handling
multipart/form-data. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to2.0.1to receive a patch. No known workarounds are available.
+ + + + + +2.0.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2025-48997
+https://github.com/expressjs/multer
+https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9
+https://github.com/expressjs/multer/issues/1233
+https://github.com/expressjs/multer/pull/1256
+https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg
+https://nvd.nist.gov/vuln/detail/CVE-2025-48997
+https://www.cve.org/CVERecord?id=CVE-2025-48997
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 1321 + + | + + +
| Component | + + +Version | + + +
|---|---|
| notevil | + + +1.3.3 | + + +
| File Path | +
|---|
| juice-shop/node_modules/notevil/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
+ + + + + + +Sandbox escape in notevil and argencoders-notevil
+
+Target: Node.js
+Type: node-pkg
+Fixed version:This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. Note: This vulnerability derives from an incomplete fix in SNYK-JS-NOTEVIL-608878.
+ + + + + + + +affected
+ + + + + + + +https://github.com/mmckegg/notevil
+https://nvd.nist.gov/vuln/detail/CVE-2021-23771
+https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587
+https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ + +XSS - Sanitization not applied recursively
+
+Target: Node.js
+Type: node-pkg
+Fixed version: >=1.4.3sanitize-html before 1.4.3 has XSS.
+ + + + + ++=1.4.3
+
+ + + + + + + +fixed
+ + + + + + + +https://github.com/apostrophecms/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf
+https://github.com/apostrophecms/sanitize-html/issues/29
+https://github.com/punkave/sanitize-html/issues/29
+https://nodesecurity.io/advisories/135
+https://nvd.nist.gov/vuln/detail/CVE-2016-1000237
+https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json
+https://www.npmjs.com/advisories/135
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ + +Cross-Site Scripting in sanitize-html
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 1.11.4Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
+ + + + + +1.11.4
+ + + + + + + +fixed
+ + + + + + + +https://github.com/advisories/GHSA-xc6g-ggrc-qq4r
+https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403
+https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403)))
+https://github.com/punkave/sanitize-html/issues/100
+https://nodesecurity.io/advisories/154
+https://npmjs.com/package/sanitize-html#discarding-the-entire-contents-of-a-disallowed-tag
+https://nvd.nist.gov/vuln/detail/CVE-2017-16016
+https://www.npmjs.com/advisories/154
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 79 + + | + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ + +sanitize-html: sanitize-html cross site scripting
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.0.0-beta
sanitize-htmlprior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). ThesanitizeHtml()function inindex.jsdoes not sanitize content when using the customtransformTagsoption, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
+ + + + + +2.0.0-beta
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2019-25225
+https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225
+https://github.com/apostrophecms/sanitize-html
+https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3
+https://github.com/apostrophecms/sanitize-html/issues/293
+https://github.com/apostrophecms/sanitize-html/pull/156
+https://nvd.nist.gov/vuln/detail/CVE-2019-25225
+https://www.cve.org/CVERecord?id=CVE-2019-25225
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +sanitize-html: improper handling of internationalized domain name (IDN) can lead to bypass hostname whitelist validation
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.3.1Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
+ + + + + +2.3.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2021-26539
+https://advisory.checkmarx.net/advisory/CX-2021-4308
+https://github.com/apostrophecms/sanitize-html
+https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22
+https://github.com/apostrophecms/sanitize-html/commit/bdf7836ef8f0e5b21f9a1aab0623ae8fcd09c1da
+https://github.com/apostrophecms/sanitize-html/pull/458
+https://nvd.nist.gov/vuln/detail/CVE-2021-26539
+https://www.cve.org/CVERecord?id=CVE-2021-26539
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +sanitize-html: improper validation of hostnames set by the "allowedIframeHostnames" option can lead to bypass hostname whitelist for iframe element
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.3.2Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\example.com".
+ + + + + +2.3.2
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2021-26540
+https://advisory.checkmarx.net/advisory/CX-2021-4309
+https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26
+https://github.com/apostrophecms/sanitize-html/pull/460
+https://nvd.nist.gov/vuln/detail/CVE-2021-26540
+https://www.cve.org/CVERecord?id=CVE-2021-26540
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 200 + + | + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ + +sanitize-html: Information Exposure when used on the backend
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 2.12.1Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
+ + + + + +2.12.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-21501
+https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf
+https://github.com/apostrophecms/apostrophe/discussions/4436
+https://github.com/apostrophecms/sanitize-html
+https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
+https://github.com/apostrophecms/sanitize-html/pull/650
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S
+https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/
+https://nvd.nist.gov/vuln/detail/CVE-2024-21501
+https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557
+https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
+https://www.cve.org/CVERecord?id=CVE-2024-21501
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 400 + + | + + +
| Component | + + +Version | + + +
|---|---|
| tar | + + +4.4.19 | + + +
| File Path | +
|---|
| juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + +node-tar: denial of service while parsing a tar file due to lack of folders depth validation
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 6.2.1node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
+ + + + + +6.2.1
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/errata/RHSA-2024:6147
+https://access.redhat.com/security/cve/CVE-2024-28863
+https://bugzilla.redhat.com/2293200
+https://bugzilla.redhat.com/2296417
+https://errata.almalinux.org/9/ALSA-2024-6147.html
+https://github.com/isaacs/node-tar
+https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7
+https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7 (v6.2.1)
+https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36
+https://linux.oracle.com/cve/CVE-2024-28863.html
+https://linux.oracle.com/errata/ELSA-2024-6148.html
+https://nvd.nist.gov/vuln/detail/CVE-2024-28863
+https://security.netapp.com/advisory/ntap-20240524-0005
+https://security.netapp.com/advisory/ntap-20240524-0005/
+https://www.cve.org/CVERecord?id=CVE-2024-28863
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 74 + + | + + +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +vm2: Inspect Manipulation
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.9.18vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node
inspectmethod and edit options forconsole.log. As a result a threat actor can edit options for theconsole.logcommand. This vulnerability was patched in the release of version3.9.18ofvm2. Users are advised to upgrade. Users unable to upgrade may make theinspectmethod readonly withvm.readonly(inspect)after creating a vm.
+ + + + + +3.9.18
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2023-32313
+https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550
+https://github.com/patriksimek/vm2
+https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238
+https://github.com/patriksimek/vm2/releases/tag/3.9.18
+https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v
+https://nvd.nist.gov/vuln/detail/CVE-2023-32313
+https://www.cve.org/CVERecord?id=CVE-2023-32313
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Line Number | + +
|---|
| 38 | + +
| File Path | +
|---|
| /juice-shop/frontend/src/app/app.guard.spec.ts | +
+ + + + + + + + + + + + + + + + + + +JWT token
+Category: JWT
+Match: ocalStorage.setItem('token', '***********************')
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 3.85% + / + 87.74% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| moment | + + +2.0.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/express-jwt/node_modules/moment/package.json | +
+ + +CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Regular Expression Denial of Service in moment
+Related Vulnerability Description: The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a "regular expression Denial of Service (ReDoS)."
+Matcher: javascript-matcher
+Package URL: pkg:npm/moment@2.0.0
+ + + + + + + + + + + +Upgrade to version: 2.11.2
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-87vv-r9j6-g5qv
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2016-4055
+Related Vulnerability URLs:
+- http://www.openwall.com/lists/oss-security/2016/04/20/11
+- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
+- http://www.securityfocus.com/bid/95849
+- https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E
+- https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E
+- https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E
+- https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E
+- https://nodesecurity.io/advisories/55
+- https://www.tenable.com/security/tns-2019-02
+- http://www.openwall.com/lists/oss-security/2016/04/20/11
+- http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
+- http://www.securityfocus.com/bid/95849
+- https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E
+- https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E
+- https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E
+- https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E
+- https://nodesecurity.io/advisories/55
+- https://www.tenable.com/security/tns-2019-02
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 3.33% + / + 86.80% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| engine.io | + + +4.1.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/engine.io/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Uncaught exception in engine.io
+Related Vulnerability Description: Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.
+Matcher: javascript-matcher
+Package URL: pkg:npm/engine.io@4.1.2
+ + + + + + + + + + + +Upgrade to version: 6.2.1
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-r7qp-cfhv-p84w
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-41940
+Related Vulnerability URLs:
+- https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6
+- https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085
+- https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w
+- https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6
+- https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085
+- https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 1.34% + / + 79.35% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: sanitize-html Information Exposure vulnerability
+Related Vulnerability Description: Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.
+Matcher: javascript-matcher
+Package URL: pkg:npm/sanitize-html@1.4.2
+ + + + + + + + + + + +Upgrade to version: 2.12.1
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-rm97-x556-q36h
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2024-21501
+Related Vulnerability URLs:
+- https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf
+- https://github.com/apostrophecms/apostrophe/discussions/4436
+- https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
+- https://github.com/apostrophecms/sanitize-html/pull/650
+- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/
+- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/
+- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557
+- https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
+- https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf
+- https://github.com/apostrophecms/apostrophe/discussions/4436
+- https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4
+- https://github.com/apostrophecms/sanitize-html/pull/650
+- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/
+- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/
+- https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557
+- https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.79% + / + 73.04% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| got | + + +8.3.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/got/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Got allows a redirect to a UNIX socket
+Related Vulnerability Description: The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.
+Matcher: javascript-matcher
+Package URL: pkg:npm/got@8.3.2
+ + + + + + + + + + + +Upgrade to version: 11.8.5
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-pfrx-2q88-qq97
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-33987
+Related Vulnerability URLs:
+- https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0
+- https://github.com/sindresorhus/got/pull/2047
+- https://github.com/sindresorhus/got/releases/tag/v11.8.5
+- https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0
+- https://github.com/sindresorhus/got/pull/2047
+- https://github.com/sindresorhus/got/releases/tag/v11.8.5
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.22% + / + 44.79% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Prototype Pollution in lodash
+Related Vulnerability Description: lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of "Object" via proto, causing the addition or modification of an existing property that will exist on all objects.
+Matcher: javascript-matcher
+Package URL: pkg:npm/lodash@2.4.2
+ + + + + + + + + + + +Upgrade to version: 4.17.5
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-fvqr-27wr-82fm
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2018-3721
+Related Vulnerability URLs:
+- https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
+- https://hackerone.com/reports/310443
+- https://security.netapp.com/advisory/ntap-20190919-0004/
+- https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a
+- https://hackerone.com/reports/310443
+- https://security.netapp.com/advisory/ntap-20190919-0004/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.65% + / + 70.05% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| vm2 | + + +3.9.17 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/vm2/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: vm2 vulnerable to Inspect Manipulation
+Related Vulnerability Description: vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the nodeinspectmethod and edit options forconsole.log. As a result a threat actor can edit options for theconsole.logcommand. This vulnerability was patched in the release of version3.9.18ofvm2. Users are advised to upgrade. Users unable to upgrade may make theinspectmethod readonly withvm.readonly(inspect)after creating a vm.
+Matcher: javascript-matcher
+Package URL: pkg:npm/vm2@3.9.17
+ + + + + + + + + + + +Upgrade to version: 3.9.18
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-p5gc-c584-jj6v
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2023-32313
+Related Vulnerability URLs:
+- https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550
+- https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238
+- https://github.com/patriksimek/vm2/releases/tag/3.9.18
+- https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v
+- https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550
+- https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238
+- https://github.com/patriksimek/vm2/releases/tag/3.9.18
+- https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.30% + / + 53.23% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| notevil | + + +1.3.3 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/notevil/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
+ + + + + + + + + + + + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Sandbox escape in notevil and argencoders-notevil
+Related Vulnerability Description: This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. Note: This vulnerability derives from an incomplete fix in SNYK-JS-NOTEVIL-608878.
+Matcher: javascript-matcher
+Package URL: pkg:npm/notevil@1.3.3
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-8g4m-cjm2-96wq
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2021-23771
+Related Vulnerability URLs:
+- https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587
+- https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946
+- https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587
+- https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.29% + / + 51.97% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Improper Input Validation in sanitize-html
+Related Vulnerability Description: Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the "allowedIframeHostnames" option when the "allowIframeRelativeUrls" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with "/\example.com".
+Matcher: javascript-matcher
+Package URL: pkg:npm/sanitize-html@1.4.2
+ + + + + + + + + + + +Upgrade to version: 2.3.2
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-mjxr-4v3x-q3m4
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2021-26540
+Related Vulnerability URLs:
+- https://advisory.checkmarx.net/advisory/CX-2021-4309
+- https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26
+- https://github.com/apostrophecms/sanitize-html/pull/460
+- https://advisory.checkmarx.net/advisory/CX-2021-4309
+- https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26
+- https://github.com/apostrophecms/sanitize-html/pull/460
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.29% + / + 51.97% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Improper Input Validation in sanitize-html
+Related Vulnerability Description: Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the "allowedIframeHostnames" option.
+Matcher: javascript-matcher
+Package URL: pkg:npm/sanitize-html@1.4.2
+ + + + + + + + + + + +Upgrade to version: 2.3.1
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-rjqq-98f6-6j3r
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2021-26539
+Related Vulnerability URLs:
+- https://advisory.checkmarx.net/advisory/CX-2021-4308
+- https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22
+- https://github.com/apostrophecms/sanitize-html/pull/458
+- https://advisory.checkmarx.net/advisory/CX-2021-4308
+- https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22
+- https://github.com/apostrophecms/sanitize-html/pull/458
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.29% + / + 51.75% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Cross-Site Scripting in sanitize-html
+Related Vulnerability Description: Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.
+Matcher: javascript-matcher
+Package URL: pkg:npm/sanitize-html@1.4.2
+ + + + + + + + + + + +Upgrade to version: 1.11.4
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-xc6g-ggrc-qq4r
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2017-16016
+Related Vulnerability URLs:
+- https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403
+- https://github.com/punkave/sanitize-html/issues/100
+- https://nodesecurity.io/advisories/154
+- https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403
+- https://github.com/punkave/sanitize-html/issues/100
+- https://nodesecurity.io/advisories/154
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.21% + / + 42.89% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| tar | + + +4.4.19 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Denial of service while parsing a tar file due to lack of folders count validation
+Related Vulnerability Description: node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.
+Matcher: javascript-matcher
+Package URL: pkg:npm/tar@4.4.19
+ + + + + + + + + + + +Upgrade to version: 6.2.1
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-f5x3-32g6-xq36
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2024-28863
+Related Vulnerability URLs:
+- https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7
+- https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36
+- https://security.netapp.com/advisory/ntap-20240524-0005/
+- https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7
+- https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36
+- https://security.netapp.com/advisory/ntap-20240524-0005/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.20% + / + 42.67% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Regular Expression Denial of Service (ReDoS) in lodash
+Related Vulnerability Description: Lodash versions prior to 4.17.21 are vulnerable to Regular Expression Denial of Service (ReDoS) via the toNumber, trim and trimEnd functions.
+Matcher: javascript-matcher
+Package URL: pkg:npm/lodash@2.4.2
+ + + + + + + + + + + +Upgrade to version: 4.17.21
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-29mw-wpgm-hmr9
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2020-28500
+Related Vulnerability URLs:
+- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
+- https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8
+- https://github.com/lodash/lodash/pull/5065
+- https://security.netapp.com/advisory/ntap-20210312-0006/
+- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
+- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
+- https://www.oracle.com//security-alerts/cpujul2021.html
+- https://www.oracle.com/security-alerts/cpujan2022.html
+- https://www.oracle.com/security-alerts/cpujul2022.html
+- https://www.oracle.com/security-alerts/cpuoct2021.html
+- https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf
+- https://github.com/lodash/lodash/blob/npm/trimEnd.js%23L8
+- https://github.com/lodash/lodash/pull/5065
+- https://security.netapp.com/advisory/ntap-20210312-0006/
+- https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074896
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074894
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074892
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074895
+- https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074893
+- https://snyk.io/vuln/SNYK-JS-LODASH-1018905
+- https://www.oracle.com//security-alerts/cpujul2021.html
+- https://www.oracle.com/security-alerts/cpujan2022.html
+- https://www.oracle.com/security-alerts/cpujul2022.html
+- https://www.oracle.com/security-alerts/cpuoct2021.html
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.16% + / + 37.82% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| socket.io-parser | + + +4.0.5 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/socket.io-parser/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Insufficient validation when decoding a Socket.IO packet
+Related Vulnerability Description: socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.
+Matcher: javascript-matcher
+Package URL: pkg:npm/socket.io-parser@4.0.5
+ + + + + + + + + + + +Upgrade to version: 4.2.3
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-cqmj-92xf-r6r9
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2023-32695
+Related Vulnerability URLs:
+- https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced
+- https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3
+- https://github.com/socketio/socket.io-parser/releases/tag/4.2.3
+- https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9
+- https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced
+- https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3
+- https://github.com/socketio/socket.io-parser/releases/tag/4.2.3
+- https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.20% + / + 41.91% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| lodash | + + +2.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Regular Expression Denial of Service (ReDoS) in lodash
+Related Vulnerability Description: lodash prior to 4.17.11 is affected by: CWE-400: Uncontrolled Resource Consumption. The impact is: Denial of service. The component is: Date handler. The attack vector is: Attacker provides very long strings, which the library attempts to match using a regular expression. The fixed version is: 4.17.11.
+Matcher: javascript-matcher
+Package URL: pkg:npm/lodash@2.4.2
+ + + + + + + + + + + +Upgrade to version: 4.17.11
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-x5rq-j2xg-h7qm
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2019-1010266
+Related Vulnerability URLs:
+- https://github.com/lodash/lodash/issues/3359
+- https://github.com/lodash/lodash/wiki/Changelog
+- https://security.netapp.com/advisory/ntap-20190919-0004/
+- https://snyk.io/vuln/SNYK-JS-LODASH-73639
+- https://github.com/lodash/lodash/issues/3359
+- https://github.com/lodash/lodash/wiki/Changelog
+- https://security.netapp.com/advisory/ntap-20190919-0004/
+- https://snyk.io/vuln/SNYK-JS-LODASH-73639
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.13% + / + 32.79% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| micromatch | + + +3.1.10 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/micromatch/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Regular Expression Denial of Service (ReDoS) in micromatch
+Related Vulnerability Description: The NPM packagemicromatchprior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs inmicromatch.braces()inindex.jsbecause the pattern.*will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.
+Matcher: javascript-matcher
+Package URL: pkg:npm/micromatch@3.1.10
+ + + + + + + + + + + +Upgrade to version: 4.0.8
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-952p-6rrq-rcjv
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2024-4067
+Related Vulnerability URLs:
+- https://advisory.checkmarx.net/advisory/CVE-2024-4067/
+- https://devhub.checkmarx.com/cve-details/CVE-2024-4067/
+- https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade
+- https://github.com/micromatch/micromatch/pull/266
+- https://github.com/micromatch/micromatch/releases/tag/4.0.8
+- https://devhub.checkmarx.com/cve-details/CVE-2024-4067/
+- https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448
+- https://github.com/micromatch/micromatch/issues/243
+- https://github.com/micromatch/micromatch/pull/247
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.10% + / + 28.41% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| socket.io | + + +3.1.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/socket.io/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: socket.io has an unhandled 'error' event
+Related Vulnerability Description: Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit15af22fc22which has been included insocket.io@4.6.2(released in May 2023). The fix was backported in the 2.x branch as well with commitd30630ba10. Users are advised to upgrade. Users unable to upgrade may attach a listener for the "error" event to catch these errors.
+Matcher: javascript-matcher
+Package URL: pkg:npm/socket.io@3.1.2
+ + + + + + + + + + + +Upgrade to version: 4.6.2
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-25hc-qcg6-38wj
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2024-38355
+Related Vulnerability URLs:
+- https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115
+- https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c
+- https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj
+- https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115
+- https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c
+- https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj
+- https://www.vicarius.io/vsociety/posts/unhandled-exception-in-socketio-cve-2024-38355
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ N.A. + / + N.A. + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| base64url | + + +0.0.6 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/base64url/package.json | +
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: Out-of-bounds Read in base64url
+Matcher: javascript-matcher
+Package URL: pkg:npm/base64url@0.0.6
+ + + + + + + + + + + +Upgrade to version: 3.0.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-rvg8-pwq2-xj7q
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.05% + / + 14.92% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
+Related Vulnerability Description: jsonwebtoken is an implementation of JSON Web Tokens. Versions<= 8.5.1ofjsonwebtokenlibrary can be misconfigured so that passing a poorly implemented key retrieval function referring to thesecretOrPublicKeyargument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
+Matcher: javascript-matcher
+Package URL: pkg:npm/jsonwebtoken@0.1.0
+ + + + + + + + + + + +Upgrade to version: 9.0.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-hjrf-2m68-5959
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-23541
+Related Vulnerability URLs:
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
+- https://security.netapp.com/advisory/ntap-20240621-0007/
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
+- https://security.netapp.com/advisory/ntap-20240621-0007/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.05% + / + 14.92% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC
+Related Vulnerability Description: jsonwebtoken is an implementation of JSON Web Tokens. Versions<= 8.5.1ofjsonwebtokenlibrary can be misconfigured so that passing a poorly implemented key retrieval function referring to thesecretOrPublicKeyargument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.
+Matcher: javascript-matcher
+Package URL: pkg:npm/jsonwebtoken@0.4.0
+ + + + + + + + + + + +Upgrade to version: 9.0.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-hjrf-2m68-5959
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-23541
+Related Vulnerability URLs:
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
+- https://security.netapp.com/advisory/ntap-20240621-0007/
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959
+- https://security.netapp.com/advisory/ntap-20240621-0007/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.03% + / + 7.37% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| sanitize-html | + + +1.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/sanitize-html/package.json | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: sanitize-html is vulnerable to XSS through incomprehensive sanitization
+Related Vulnerability Description:sanitize-htmlprior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). ThesanitizeHtml()function inindex.jsdoes not sanitize content when using the customtransformTagsoption, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.
+Matcher: javascript-matcher
+Package URL: pkg:npm/sanitize-html@1.4.2
+ + + + + + + + + + + +Upgrade to version: 2.0.0-beta
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-qhxp-v273-g94h
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2019-25225
+Related Vulnerability URLs:
+- https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225
+- https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3
+- https://github.com/apostrophecms/sanitize-html/issues/293
+- https://github.com/apostrophecms/sanitize-html/pull/156
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.02% + / + 2.55% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.1.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()
+Related Vulnerability Description: In versions<=8.5.1ofjsonwebtokenlibrary, lack of algorithm definition in thejwt.verify()function can lead to signature validation bypass due to defaulting to thenonealgorithm for signature verification. Users are affected if you do not specify algorithms in thejwt.verify()function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in thejwt.verify()method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for thenonealgorithm. If you need 'none' algorithm, you have to explicitly specify that injwt.verify()options.
+Matcher: javascript-matcher
+Package URL: pkg:npm/jsonwebtoken@0.1.0
+ + + + + + + + + + + +Upgrade to version: 9.0.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-qwph-4952-7xr6
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-23540
+Related Vulnerability URLs:
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
+- https://security.netapp.com/advisory/ntap-20240621-0007/
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
+- https://security.netapp.com/advisory/ntap-20240621-0007/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.02% + / + 2.55% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| jsonwebtoken | + + +0.4.0 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/jsonwebtoken/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()
+Related Vulnerability Description: In versions<=8.5.1ofjsonwebtokenlibrary, lack of algorithm definition in thejwt.verify()function can lead to signature validation bypass due to defaulting to thenonealgorithm for signature verification. Users are affected if you do not specify algorithms in thejwt.verify()function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in thejwt.verify()method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for thenonealgorithm. If you need 'none' algorithm, you have to explicitly specify that injwt.verify()options.
+Matcher: javascript-matcher
+Package URL: pkg:npm/jsonwebtoken@0.4.0
+ + + + + + + + + + + +Upgrade to version: 9.0.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-qwph-4952-7xr6
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-23540
+Related Vulnerability URLs:
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
+- https://security.netapp.com/advisory/ntap-20240621-0007/
+- https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3
+- https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6
+- https://security.netapp.com/advisory/ntap-20240621-0007/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Medium + + + | ++ 0.01% + / + 0.51% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libc6 | +
+ + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.
+Related Vulnerability Description: The regcomp function in the GNU C library version from 2.4 to 2.41 is
+subject to a double free if some previous allocation fails. It can be
+accomplished either by a malloc failure or by using an interposed malloc
+ that injects random malloc failures. The double free can allow buffer
+manipulation depending of how the regex is constructed. This issue
+affects all architectures and ABIs supported by the GNU C library.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=arm64&distro=debian-12&upstream=glibc
+ + + + + + + + + + + +Upgrade to version: 2.36-9+deb12u13
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2025-8058
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2025-8058
+Related Vulnerability URLs:
+- https://sourceware.org/bugzilla/show_bug.cgi?id=33185
+- https://sourceware.org/git/?p=glibc.git;a=commit;h=3ff17af18c38727b88d9115e536c069e6b5d601f
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 74 + + | + + +
| Component | + + +Version | + + +
|---|---|
| cookie | + + +0.4.2 | + + +
| File Path | +
|---|
| juice-shop/node_modules/engine.io/node_modules/cookie/package.json | +
+ + +CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
+ + +cookie: cookie accepts cookie name, path, and domain with out of bounds characters
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 0.7.0cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
+ + + + + +0.7.0
+ + + + + + + +fixed
+ + + + + + + +https://access.redhat.com/security/cve/CVE-2024-47764
+https://github.com/jshttp/cookie
+https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c
+https://github.com/jshttp/cookie/pull/167
+https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x
+https://nvd.nist.gov/vuln/detail/CVE-2024-47764
+https://www.cve.org/CVERecord?id=CVE-2024-47764
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| localhost | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +Detects DNS Rebinding attacks by checking if the DNS response contains a private IPv4 or IPv6 address.
+Results:
+127.0.0.1
;; opcode: QUERY, status: NOERROR, id: 1202 +;; flags: rd; QUERY: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1 + +;; OPT PSEUDOSECTION: +; EDNS: version 0; flags:; udp: 4096 + +;; QUESTION SECTION: +;localhost. IN A ++ +
;; opcode: QUERY, status: NOERROR, id: 1202 +;; flags: qr aa rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1 +;; OPT PSEUDOSECTION: +; EDNS: version 0; flags:; udp: 4096 +;; QUESTION SECTION: +;localhost. IN A +;; ANSWER SECTION: +localhost. 10800 IN A 127.0.0.1 ++ + + + + + + + + + + +
+ + + + + + + +https://capec.mitre.org/data/definitions/275.html
+https://payatu.com/blog/dns-rebinding/
+https://heimdalsecurity.com/blog/dns-rebinding/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + ++ + 385 + + | + + +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| bkimminich/juice-shop:v19.0.0 (debian 12.11) | +
+ + + + + + +OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable ...
+
+Target: bkimminich/juice-shop:v19.0.0 (debian 12.11)
+Type: debian
+Fixed version:OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.
+ + + + + + + +affected
+ + + + + + + +https://github.com/openssl/openssl/issues/24253
+https://minerva.crocs.fi.muni.cz
+https://www.cve.org/CVERecord?id=CVE-2025-27587
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Low + + + | ++ N.A. + / + N.A. + | +Active, Verified | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| messageformat | + + +2.3.0 | + + +
| File Path | +
|---|
| juice-shop/node_modules/messageformat/package.json | +
+ + +messageformat has a prototype pollution vulnerability
+
+Target: Node.js
+Type: node-pkg
+Fixed version: 3.0.0-beta.0The messageformat package, an implementation of the Unicode MessageFormat 2 specification for JavaScript, is vulnerable to prototype pollution due to improper handling of message key paths in versions prior to 2.3.0. The flaw arises when processing nested message keys containing special characters (e.g., proto ), which can lead to unintended modification of the JavaScript Object prototype. This vulnerability may allow a remote attacker to inject properties into the global object prototype via specially crafted message input, potentially causing denial of service or other undefined behaviors in applications using the affected component.
+ + + + + +3.0.0-beta.0
+ + + + + + + +fixed
+ + + + + + + +https://github.com/messageformat/messageformat
+https://github.com/messageformat/messageformat/issues/452
+https://nvd.nist.gov/vuln/detail/CVE-2025-57349
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Low + + + | ++ 0.07% + / + 21.73% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| cookie | + + +0.4.2 | + + +
| File Path | +
|---|
| /juice-shop/node_modules/engine.io/node_modules/cookie/package.json | +
+ + +Vulnerability Namespace: github:language:javascript
+Vulnerability Description: cookie accepts cookie name, path, and domain with out of bounds characters
+Related Vulnerability Description: cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.
+Matcher: javascript-matcher
+Package URL: pkg:npm/cookie@0.4.2
+ + + + + + + + + + + +Upgrade to version: 0.7.0
+ + + + + + + +Vulnerability Datasource: https://github.com/advisories/GHSA-pxg6-pf52-xh8x
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2024-47764
+Related Vulnerability URLs:
+- https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c
+- https://github.com/jshttp/cookie/pull/167
+- https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000/robots.txt | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +Results:
+/ftp
GET /robots.txt HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK +Connection: close +Content-Length: 28 +Access-Control-Allow-Origin: * +Content-Type: text/plain; charset=utf-8 +Date: Mon, 29 Sep 2025 15:21:33 GMT +Etag: W/"1c-8HgF6mNyhsSFK0pascC9uB0wjX0" +Feature-Policy: payment 'self' +Vary: Accept-Encoding +X-Content-Type-Options: nosniff +X-Frame-Options: SAMEORIGIN +X-Recruiting: /#/jobs +User-agent: * +Disallow: /ftp+ + + + + + + +
+ + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Knoppix; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/135.0.0.0 Safari/537.36' 'http://localhost:3000/robots.txt'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 0.05% + / + 15.84% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libgcc-s1 | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libgcc-s1 | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=arm64&distro=debian-12&upstream=gcc-12
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2022-27943
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+Related Vulnerability URLs:
+- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+- https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+- https://sourceware.org/bugzilla/show_bug.cgi?id=28995
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
None+ + + + +
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:38 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15' 'http://localhost:3000'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +This template searches for missing HTTP security headers. The impact of these missing headers can vary.
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:37 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3' 'http://localhost:3000'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +This template searches for missing HTTP security headers. The impact of these missing headers can vary.
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:37 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3' 'http://localhost:3000'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + ++ + 79 + + | + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
+ + + + +Identifies the use of JavaScript addEventListener calls in the DOM.
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:38 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Macintosh, Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.3 Safari/605.1.15' 'http://localhost:3000'
+ + + + + + + +https://portswigger.net/web-security/dom-based/controlling-the-web-message-source
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000/robots.txt | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
None+ + + + +
GET /robots.txt HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK +Connection: close +Content-Length: 28 +Access-Control-Allow-Origin: * +Content-Type: text/plain; charset=utf-8 +Date: Mon, 29 Sep 2025 15:21:38 GMT +Etag: W/"1c-8HgF6mNyhsSFK0pascC9uB0wjX0" +Feature-Policy: payment 'self' +Vary: Accept-Encoding +X-Content-Type-Options: nosniff +X-Frame-Options: SAMEORIGIN +X-Recruiting: /#/jobs +User-agent: * +Disallow: /ftp+ + + + + + + +
+ + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.4 Mobile/15E148 Safari/604.1' 'http://localhost:3000/robots.txt'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 0.72% + / + 71.74% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libc6 | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=arm64&distro=debian-12&upstream=glibc
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2019-1010023
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2019-1010023
+Related Vulnerability URLs:
+- http://www.securityfocus.com/bid/109167
+- https://sourceware.org/bugzilla/show_bug.cgi?id=22851
+- https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS
+- https://ubuntu.com/security/CVE-2019-1010023
+- http://www.securityfocus.com/bid/109167
+- https://sourceware.org/bugzilla/show_bug.cgi?id=22851
+- https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS
+- https://ubuntu.com/security/CVE-2019-1010023
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +Websites that advertise jobs via HTTP headers
+Results:
+/#/jobs
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (SS; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:42 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (SS; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0' 'http://localhost:3000'
+ + + + + + + +https://webtechsurvey.com/response-header/x-recruiting
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +This template searches for missing HTTP security headers. The impact of these missing headers can vary.
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:37 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3' 'http://localhost:3000'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000/.well-known/security.txt | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +File similar to robots.txt but intended to be read by humans wishing to contact a website’s owner about security issues. Often defines a security policy and contact details.
+Results:
+ mailto:donotreply@owasp-juice.shop
GET /.well-known/security.txt HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Windows NT 11.0) AppleWebKit/537.36 (KHTML, like Gecko) Safari/112.0 Safari/537.36 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK +Connection: close +Content-Length: 475 +Access-Control-Allow-Origin: * +Content-Type: text/plain; charset=utf-8 +Date: Mon, 29 Sep 2025 15:21:42 GMT +Etag: W/"1db-m6wdxkp5B5Fswl9G9jg6cVHAu64" +Feature-Policy: payment 'self' +Vary: Accept-Encoding +X-Content-Type-Options: nosniff +X-Frame-Options: SAMEORIGIN +X-Recruiting: /#/jobs +Contact: mailto:donotreply@owasp-juice.shop +Encryption: https://keybase.io/bkimminich/pgp_keys.asc?fingerprint=19c01cb7157e4645e9e2c863062a85a8cbfbdcda +Acknowledgements: /#/score-board +Preferred-languages: en, ar, az, bg, bn, ca, cs, da, de, ga, el, es, et, fi, fr, ka, he, hi, hu, id, it, ja, ko, lv, my, nl, no, pl, pt, ro, ru, si, sv, th, tr, uk, zh +Hiring: /#/jobs +Csaf: http://localhost:3000/.well-known/csaf/provider-metadata.json +Expires: Tue…+ + + + + + + +
+ + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 11.0) AppleWebKit/537.36 (KHTML, like Gecko) Safari/112.0 Safari/537.36' 'http://localhost:3000/.well-known/security.txt'
+ + + + + + + +https://securitytxt.org/
+https://community.turgensec.com/security-txt-progress-in-ethical-security-research/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +This template searches for missing HTTP security headers. The impact of these missing headers can vary.
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:37 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3' 'http://localhost:3000'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 0.36% + / + 57.70% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libc6 | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\1\1)' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern
+Matcher: dpkg-matcher
+Package URL:* pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=arm64&distro=debian-12&upstream=glibc
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2019-9192
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2019-9192
+Related Vulnerability URLs:
+- https://sourceware.org/bugzilla/show_bug.cgi?id=24269
+- https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS
+- https://sourceware.org/bugzilla/show_bug.cgi?id=24269
+- https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +This template searches for missing HTTP security headers. The impact of these missing headers can vary.
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:37 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3' 'http://localhost:3000'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 0.06% + / + 18.34% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libssl3 | + + +3.0.17-1~deb12u2 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libssl3 | +
+ + +CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=arm64&distro=debian-12&upstream=openssl
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2025-27587
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2025-27587
+Related Vulnerability URLs:
+- https://github.com/openssl/openssl/issues/24253
+- https://minerva.crocs.fi.muni.cz
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 0.14% + / + 35.58% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libc6 | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=arm64&distro=debian-12&upstream=glibc
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2019-1010022
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2019-1010022
+Related Vulnerability URLs:
+- https://sourceware.org/bugzilla/show_bug.cgi?id=22850
+- https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3
+- https://ubuntu.com/security/CVE-2019-1010022
+- https://sourceware.org/bugzilla/show_bug.cgi?id=22850
+- https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3
+- https://ubuntu.com/security/CVE-2019-1010022
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +This template searches for missing HTTP security headers. The impact of these missing headers can vary.
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:37 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3' 'http://localhost:3000'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +This template searches for missing HTTP security headers. The impact of these missing headers can vary.
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:37 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3' 'http://localhost:3000'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +This template searches for missing HTTP security headers. The impact of these missing headers can vary.
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:37 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3' 'http://localhost:3000'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 0.05% + / + 15.84% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libgomp1 | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libgomp1 | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libgomp1@12.2.0-14%2Bdeb12u1?arch=arm64&distro=debian-12&upstream=gcc-12
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2022-27943
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+Related Vulnerability URLs:
+- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+- https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+- https://sourceware.org/bugzilla/show_bug.cgi?id=28995
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +This template searches for missing HTTP security headers. The impact of these missing headers can vary.
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3 +Connection: close +Accept: */* +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:37 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + + + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: */*' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3' 'http://localhost:3000'
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000 | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + + + +Checks if external script and stylesheet tags in the HTML response are missing the Subresource Integrity (SRI) attribute.
+Results:
+//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js
+//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js
+//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css
GET / HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36 +Connection: close +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Accept-Ranges: bytes
+Access-Control-Allow-Origin: *
+Cache-Control: public, max-age=0
+Content-Type: text/html; charset=UTF-8
+Date: Mon, 29 Sep 2025 15:21:00 GMT
+Etag: W/"124fa-19995cb3457"
+Feature-Policy: payment 'self'
+Last-Modified: Mon, 29 Sep 2025 14:05:46 GMT
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en" data-beasties-container>
+<head>
+ <meta charset="utf-8">
+ <title>OWASP Juice Shop</title>
+ <meta name="description" content="Probably the most modern and sophisticated insecure web application">
+ <meta name="viewport" content="width=device-width, initial-scale=1">
+ <link id="favicon" rel="icon" type="image/x-icon" href="assets/public/favicon_js.ico">
+ <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.css">
+ <script src="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.1.0/cookieconsent.min.js"></script>
+ <script src="//cdnjs.cloudflare.com/ajax/libs/jquery/2.2.4/jquery.min.js"></script>
+ <script>
+ window.addEventListener("load", function(){
+ window.cookieconsent.initialise({
+ "palette": {
+ "popup": { "background": "var(--theme-primary)", "text": "var(--theme-text)" },
+ "button": { "background": "var(--theme-accent)", "text": "var(--theme-text)" }
+ },
+ "…</script></head></html>
+
+
+
+
+
+
+
+ + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Host: localhost:3000' -H 'User-Agent: Mozilla/5.0 (Fedora; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/129.0.0.0 Safari/537.36' 'http://localhost:3000'
+ + + + + + + +https://cheatsheetseries.owasp.org/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.html#subresource-integrity
+https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 0.38% + / + 58.43% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libc6 | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate "this is being treated as a non-security bug and no real threat.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=arm64&distro=debian-12&upstream=glibc
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2019-1010024
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2019-1010024
+Related Vulnerability URLs:
+- http://www.securityfocus.com/bid/109162
+- https://sourceware.org/bugzilla/show_bug.cgi?id=22852
+- https://support.f5.com/csp/article/K06046097
+- https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS
+- https://ubuntu.com/security/CVE-2019-1010024
+- http://www.securityfocus.com/bid/109162
+- https://sourceware.org/bugzilla/show_bug.cgi?id=22852
+- https://support.f5.com/csp/article/K06046097
+- https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS
+- https://ubuntu.com/security/CVE-2019-1010024
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 0.37% + / + 58.32% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libc6 | +
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=arm64&distro=debian-12&upstream=glibc
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2010-4756
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2010-4756
+Related Vulnerability URLs:
+- http://cxib.net/stuff/glob-0day.c
+- http://securityreason.com/achievement_securityalert/89
+- http://securityreason.com/exploitalert/9223
+- https://bugzilla.redhat.com/show_bug.cgi?id=681681
+- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756
+- http://cxib.net/stuff/glob-0day.c
+- http://securityreason.com/achievement_securityalert/89
+- http://securityreason.com/exploitalert/9223
+- https://bugzilla.redhat.com/show_bug.cgi?id=681681
+- https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 0.05% + / + 15.84% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libstdc++6 | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libstdc++6 | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=arm64&distro=debian-12&upstream=gcc-12
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2022-27943
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+Related Vulnerability URLs:
+- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+- https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+- https://sourceware.org/bugzilla/show_bug.cgi?id=28995
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 0.23% + / + 45.66% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libc6 | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is "ASLR bypass itself is not a vulnerability.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=arm64&distro=debian-12&upstream=glibc
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2019-1010025
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2019-1010025
+Related Vulnerability URLs:
+- https://sourceware.org/bugzilla/show_bug.cgi?id=22853
+- https://support.f5.com/csp/article/K06046097
+- https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS
+- https://ubuntu.com/security/CVE-2019-1010025
+- https://sourceware.org/bugzilla/show_bug.cgi?id=22853
+- https://support.f5.com/csp/article/K06046097
+- https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS
+- https://ubuntu.com/security/CVE-2019-1010025
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 1.84% + / + 82.29% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| libc6 | + + +2.36-9+deb12u10 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/libc6 | +
+ + +CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\1\1|t1|\\2537)+' in grep.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=arm64&distro=debian-12&upstream=glibc
+ + + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2018-20796
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2018-20796
+Related Vulnerability URLs:
+- http://www.securityfocus.com/bid/107160
+- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141
+- https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html
+- https://security.netapp.com/advisory/ntap-20190315-0002/
+- https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS
+- http://www.securityfocus.com/bid/107160
+- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141
+- https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html
+- https://security.netapp.com/advisory/ntap-20190315-0002/
+- https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + +CWE | + + +
|---|---|---|---|---|---|---|
| + + + Info + + + | ++ N.A. + / + N.A. + | +Active | + +Sept. 29, 2025 | +35 days | +Admin User (admin) | + + ++ + 200 + + | + + +
| Endpoint | +Status | +Date Discovered | +Last Modified | + + + +
|---|---|---|---|
| http://localhost:3000/api-docs/swagger.json | +Active | +Sept. 29, 2025 | +Nov. 3, 2025 | +
+ + +CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:N
+ + + + +Public Swagger API was detected.
GET /api-docs/swagger.json HTTP/1.1 +Host: localhost:3000 +User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6,2 Mobile/15E148 Safari/604.1 +Accept: text/html +Accept-Language: en +Accept-Encoding: gzip + ++ +
HTTP/1.1 200 OK
+Connection: close
+Transfer-Encoding: chunked
+Access-Control-Allow-Origin: *
+Content-Type: text/html; charset=utf-8
+Date: Mon, 29 Sep 2025 15:20:53 GMT
+Etag: W/"c22-H8FH9nKD8DeX/nvIRrte6ZjP2a4"
+Feature-Policy: payment 'self'
+Vary: Accept-Encoding
+X-Content-Type-Options: nosniff
+X-Frame-Options: SAMEORIGIN
+X-Recruiting: /#/jobs
+
+
+<html lang="en">
+<head>
+ <meta charset="UTF-8">
+ <title>Swagger UI</title>
+ <link rel="stylesheet" type="text/css" href="./swagger-ui.css" >
+ <link rel="icon" type="image/png" href="./favicon-32x32.png" sizes="32x32" /><link rel="icon" type="image/png" href="./favicon-16x16.png" sizes="16x16" />
+ <style>
+ html
+ {
+ box-sizing: border-box;
+ overflow: -moz-scrollbars-vertical;
+ overflow-y: scroll;
+ }
+ *,
+ *:before,
+ *:after
+ {
+ box-sizing: inherit;
+ }
+ body {
+ margin:0;
+ background: #fafafa;
+ }
+ </style>
+</head>
+<body>
+<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" style="position:absolute;width:0;height:0">
+ <defs>
+ <symbol viewBox="0 0 20 20" id="unlocked">
+ <path d="M15.8 8H14V5.6C14 2.703 12.665 1 10 1 7.334 1 6 2.703 6 5.6V6h2v-.801C8 3.754 8.797 3 10 3c1.203 0 2 .754 2 2.199V8H4c-.553 0-1 .646-1 1.199V17c0 .549.428 1.139.951 1.307l1.197.387C5.672 18.861 6.55 19 7.1 19h5.8c.549 0 1.428-.139 1.951-.307l1.196-.387c.524-.167.953-.757.953-1.306V9.199C17 8.646 16.352 8 15.8 8z"></path>
+ </symbol>
+ <symbol viewBox="0 0 20 20" id="locked">
+ <path d="M15.8 8H14V5.6C14 2.703 12.665 1 10 1 7.334 1 6 2.703 6 5.6V8H4c-.553 0-1 .646-1 1.199V17c0 .549.428 1.139.951 1.307l1.197.387C5.672 18.861 6.55 19 7.1 19h5.8c.549 0 1.428-.139 1.951-.307l1.196-.387c.524-.167.953-.757.953-1.306V9.199C17 8.646 16.352 8 15.8 8zM12 8H8V5.199C8 3.754 8.797 3 10 3c1.203 0 2 .754 2 2.199V8z"/></path>
+ </symbol>
+ <symbol viewBox="0 0 20 20" id="close">
+ <path d="M14.348 14.849c-.469.469-1.229.469-1.697 0L10 11.819l-2.651 3.029c-.469.469-1.229.469-1.697 0-.469-.469-.469-1.229 0-1.697l2.758-3.15-2.759-3.152c-.469-.469-.469-1.228 0-1.697.469-.469 1.228-.469 1.697 0L10 8.183l2.651-3.031c.469-.469 1.228-.469 1.697 0 .469.469.469 1.229 0 1.697l-2.758 3.152 2.758 3.15c.469.469.469 1.229 0 1.698z"/></path>
+ </symbol>
+ <symbol viewBox="0 0 20 20" id="large-arrow">
+ <path d="M13.25 10L6.109 2.58c-.268-.27-.268-.707 0-.979.268-.27.701-.27.969 0l7.83 7.908c.268.271.268.709 0 .979l-7.83 7.908c-.268.271-.701.27-.969 0-.268-.269-.268-.707 0-.979L13.25 10z"/></path>
+ </symbol>
+ <symbol viewBox="0 0 20 20" id="large-arrow-down">
+ <path d="M17.418 6.109c.272-.268.709-.268.979 0s.271.701 0 .969l-7.908 7.83c-.27.268-.707.268-.979 0l-7.908-7.83c-.27-.268-.27-.701 0-.969.271-.268.709-.268.979 0L10 13.25l7.418-7.141z"/></path>
+ </symbol>
+ <symbol viewBox="0 0 24 24" id="jump-to">
+ <path d="M19 7v4H5.83l3.58-3.59L8 6l-6 6 6 6 1.41-1.41L5.83 13H21V7z"/></path>
+ </symbol>
+ <symbol viewBox="0 0 24 24" id="expand">
+ <path d="M10 18h4v-2h-4v2zM3 6v2h18V6H3zm3 7h12v-2H6v2z"/></path>
+ </symbol>
+ </defs>
+</svg>
+<div id="swagger-ui"></div>
+<script src="./swagger-ui-bundle.js"> </script>
+<script src="./swagger-ui-standalone-preset.js"> </script>
+<script src="./swagger-ui-init.js"> </script>
+<style>
+ .swagger-ui .topbar .…</style></body></html>
+
+
+
+
+
+
+
+ + + + + + +curl command to reproduce the request:
+curl -X 'GET' -d '' -H 'Accept: text/html' -H 'Accept-Language: en' -H 'User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.6,2 Mobile/15E148 Safari/604.1' 'http://localhost:3000/api-docs/swagger.json'
+ + + + + + + +https://swagger.io/
| Severity | +EPSS Score / Percentile | +Status | + +Date discovered | +Age | +Reporter | + + + +
|---|---|---|---|---|---|
| + + + Info + + + | ++ 0.05% + / + 15.84% + | +Active | + +Nov. 3, 2025 | +0 days | +Admin User (admin) | + + + +
| Component | + + +Version | + + +
|---|---|
| gcc-12-base | + + +12.2.0-14+deb12u1 | + + +
| File Path | +
|---|
| /var/lib/dpkg/status.d/gcc-12-base | +
+ + +CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H
+ + + + + + + + + + + + +Vulnerability Namespace: debian:distro:debian:12
+Vulnerability Description: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.
+Matcher: dpkg-matcher
+Package URL: pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=arm64&distro=debian-12&upstream=gcc-12
+ + + + + + +Vulnerability Datasource: https://security-tracker.debian.org/tracker/CVE-2022-27943
+Related Vulnerability Datasource: https://nvd.nist.gov/vuln/detail/CVE-2022-27943
+Related Vulnerability URLs:
+- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+- https://sourceware.org/bugzilla/show_bug.cgi?id=28995
+- https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039
+- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/
+- https://sourceware.org/bugzilla/show_bug.cgi?id=28995
Ensure JavaScript source files are loaded from only trusted sources, and the sources can't be controlled by end users of the application.
", + "otherinfo": "", + "reference": "", + "cweid": "829", + "wascid": "15", + "sourceid": "10" + }, + { + "pluginid": "10110", + "alertRef": "10110", + "alert": "Dangerous JS Functions", + "name": "Dangerous JS Functions", + "riskcode": "1", + "confidence": "1", + "riskdesc": "Low (Low)", + "desc": "A dangerous JS function seems to be in use that would leave the site vulnerable.
", + "instances":[ + { + "id": "63", + "uri": "http://localhost:3000/main.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "bypassSecurityTrustHtml(", + "otherinfo": "" + }, + { + "id": "68", + "uri": "http://localhost:3000/vendor.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "bypassSecurityTrustHtml(", + "otherinfo": "" + } + ], + "count": "2", + "solution": "See the references for security advice on the use of these functions.
", + "otherinfo": "", + "reference": "https://v17.angular.io/guide/security
", + "cweid": "749", + "wascid": "-1", + "sourceid": "21" + }, + { + "pluginid": "10063", + "alertRef": "10063-2", + "alert": "Deprecated Feature Policy Header Set", + "name": "Deprecated Feature Policy Header Set", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "The header has now been renamed to Permissions-Policy.
", + "instances":[ + { + "id": "54", + "uri": "http://localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "9", + "uri": "http://localhost:3000/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "82", + "uri": "http://localhost:3000/ftp/coupons_2013.md.bak", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "85", + "uri": "http://localhost:3000/ftp/eastere.gg", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "84", + "uri": "http://localhost:3000/ftp/encrypt.pyc", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "83", + "uri": "http://localhost:3000/ftp/package.json.bak", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "64", + "uri": "http://localhost:3000/main.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "32", + "uri": "http://localhost:3000/polyfills.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "19", + "uri": "http://localhost:3000/runtime.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "51", + "uri": "http://localhost:3000/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + }, + { + "id": "69", + "uri": "http://localhost:3000/vendor.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Feature-Policy", + "otherinfo": "" + } + ], + "count": "11", + "solution": "Ensure that your web server, application server, load balancer, etc. is configured to set the Permissions-Policy header instead of the Feature-Policy header.
", + "otherinfo": "", + "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Permissions-Policy
https://scotthelme.co.uk/goodbye-feature-policy-and-hello-permissions-policy/
", + "cweid": "16", + "wascid": "15", + "sourceid": "10" + }, + { + "pluginid": "90004", + "alertRef": "90004-2", + "alert": "Insufficient Site Isolation Against Spectre Vulnerability", + "name": "Insufficient Site Isolation Against Spectre Vulnerability", + "riskcode": "1", + "confidence": "2", + "riskdesc": "Low (Medium)", + "desc": "Cross-Origin-Embedder-Policy header is a response header that prevents a document from loading any cross-origin resources that don't explicitly grant the document permission (using CORP or CORS).
", + "instances":[ + { + "id": "55", + "uri": "http://localhost:3000", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "10", + "uri": "http://localhost:3000/", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "86", + "uri": "http://localhost:3000/ftp", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "100", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:365:14", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "56", + "uri": "http://localhost:3000/sitemap.xml", + "method": "GET", + "param": "Cross-Origin-Embedder-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "58", + "uri": "http://localhost:3000", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "11", + "uri": "http://localhost:3000/", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "87", + "uri": "http://localhost:3000/ftp", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "101", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:365:14", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + }, + { + "id": "57", + "uri": "http://localhost:3000/sitemap.xml", + "method": "GET", + "param": "Cross-Origin-Opener-Policy", + "attack": "", + "evidence": "", + "otherinfo": "" + } + ], + "count": "10", + "solution": "Ensure that the application/web server sets the Cross-Origin-Embedder-Policy header appropriately, and that it sets the Cross-Origin-Embedder-Policy header to 'require-corp' for documents.
If possible, ensure that the end user uses a standards-compliant and modern web browser that supports the Cross-Origin-Embedder-Policy header (https://caniuse.com/mdn-http_headers_cross-origin-embedder-policy).
", + "otherinfo": "", + "reference": "https://developer.mozilla.org/en-US/docs/Web/HTTP/Reference/Headers/Cross-Origin-Embedder-Policy
", + "cweid": "693", + "wascid": "14", + "sourceid": "10" + }, + { + "pluginid": "10096", + "alertRef": "10096", + "alert": "Timestamp Disclosure - Unix", + "name": "Timestamp Disclosure - Unix", + "riskcode": "1", + "confidence": "1", + "riskdesc": "Low (Low)", + "desc": "A timestamp was disclosed by the application/web server. - Unix
", + "instances":[ + { + "id": "38", + "uri": "http://localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1650485437", + "otherinfo": "1650485437, which evaluates to: 2022-04-20 20:10:37." + }, + { + "id": "42", + "uri": "http://localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1981395349", + "otherinfo": "1981395349, which evaluates to: 2032-10-14 19:35:49." + }, + { + "id": "40", + "uri": "http://localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "2038834951", + "otherinfo": "2038834951, which evaluates to: 2034-08-10 15:02:31." + }, + { + "id": "5", + "uri": "http://localhost:3000/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1650485437", + "otherinfo": "1650485437, which evaluates to: 2022-04-20 20:10:37." + }, + { + "id": "7", + "uri": "http://localhost:3000/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1981395349", + "otherinfo": "1981395349, which evaluates to: 2032-10-14 19:35:49." + }, + { + "id": "6", + "uri": "http://localhost:3000/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "2038834951", + "otherinfo": "2038834951, which evaluates to: 2034-08-10 15:02:31." + }, + { + "id": "44", + "uri": "http://localhost:3000/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1650485437", + "otherinfo": "1650485437, which evaluates to: 2022-04-20 20:10:37." + }, + { + "id": "46", + "uri": "http://localhost:3000/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "1981395349", + "otherinfo": "1981395349, which evaluates to: 2032-10-14 19:35:49." + }, + { + "id": "45", + "uri": "http://localhost:3000/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "2038834951", + "otherinfo": "2038834951, which evaluates to: 2034-08-10 15:02:31." + } + ], + "count": "9", + "solution": "Manually confirm that the timestamp data is not sensitive, and that the data cannot be aggregated to disclose exploitable patterns.
", + "otherinfo": "1650485437, which evaluates to: 2022-04-20 20:10:37.
", + "reference": "https://cwe.mitre.org/data/definitions/200.html
", + "cweid": "497", + "wascid": "13", + "sourceid": "10" + }, + { + "pluginid": "10027", + "alertRef": "10027", + "alert": "Information Disclosure - Suspicious Comments", + "name": "Information Disclosure - Suspicious Comments", + "riskcode": "0", + "confidence": "1", + "riskdesc": "Informational (Low)", + "desc": "The response appears to contain suspicious comments which may help an attacker.
", + "instances":[ + { + "id": "61", + "uri": "http://localhost:3000/main.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "query", + "otherinfo": "The following pattern was used: \\bQUERY\\b and was detected in likely comment: \"//owasp.org' target='_blank'>Open Worldwide Application Security Project (OWASP) and is developed and maintained by voluntee\", see evidence field for the suspicious comment/snippet." + }, + { + "id": "66", + "uri": "http://localhost:3000/vendor.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "Query", + "otherinfo": "The following pattern was used: \\bQUERY\\b and was detected in likely comment: \"//www.w3.org/2000/svg\" viewBox=\"0 0 512 512\">The following pattern was used: \\bQUERY\\b and was detected in likely comment: \"//owasp.org' target='_blank'>Open Worldwide Application Security Project (OWASP) and is developed and maintained by voluntee\", see evidence field for the suspicious comment/snippet.
", + "reference": "", + "cweid": "615", + "wascid": "13", + "sourceid": "21" + }, + { + "pluginid": "10109", + "alertRef": "10109", + "alert": "Modern Web Application", + "name": "Modern Web Application", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "The application appears to be a modern web application. If you need to explore it automatically then the Ajax Spider may well be more effective than the standard one.
", + "instances":[ + { + "id": "36", + "uri": "http://localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "4", + "uri": "http://localhost:3000/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "105", + "uri": "http://localhost:3000/juice-shop/build/routes/fileServer.js:43:13", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "104", + "uri": "http://localhost:3000/juice-shop/build/routes/fileServer.js:59:18", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "99", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:280:10", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "106", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:286:9", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "102", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:328:13", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "98", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:365:14", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "103", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:376:14", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "107", + "uri": "http://localhost:3000/juice-shop/node_modules/express/lib/router/index.js:421:3", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + }, + { + "id": "37", + "uri": "http://localhost:3000/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application." + } + ], + "count": "11", + "solution": "This is an informational alert and so no changes are required.
", + "otherinfo": "No links have been found while there are scripts, which is an indication that this is a modern web application.
", + "reference": "", + "cweid": "-1", + "wascid": "-1", + "sourceid": "10" + }, + { + "pluginid": "10049", + "alertRef": "10049-3", + "alert": "Storable and Cacheable Content", + "name": "Storable and Cacheable Content", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "The response contents are storable by caching components such as proxy servers, and may be retrieved directly from the cache, rather than from the origin server by the caching servers, in response to similar requests from other users. If the response data is sensitive, personal or user-specific, this may result in sensitive information being leaked. In some cases, this may even result in a user gaining complete control of the session of another user, depending on the configuration of the caching components in use in their environment. This is primarily an issue where \"shared\" caching servers such as \"proxy\" caches are configured on the local network. This configuration is typically found in corporate or educational environments, for instance.
", + "instances":[ + { + "id": "13", + "uri": "http://localhost:3000/robots.txt", + "method": "GET", + "param": "", + "attack": "", + "evidence": "", + "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234." + } + ], + "count": "1", + "solution": "Validate that the response does not contain sensitive, personal or user-specific information. If it does, consider the use of the following HTTP response headers, to limit, or prevent the content being stored and retrieved from the cache by another user:
Cache-Control: no-cache, no-store, must-revalidate, private
Pragma: no-cache
Expires: 0
This configuration directs both HTTP 1.0 and HTTP 1.1 compliant caching servers to not store the response, and to not retrieve the response (without validation) from the cache, in response to a similar request.
", + "otherinfo": "In the absence of an explicitly specified caching lifetime directive in the response, a liberal lifetime heuristic of 1 year was assumed. This is permitted by rfc7234.
", + "reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
", + "cweid": "524", + "wascid": "13", + "sourceid": "7" + }, + { + "pluginid": "10049", + "alertRef": "10049-2", + "alert": "Storable but Non-Cacheable Content", + "name": "Storable but Non-Cacheable Content", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "The response contents are storable by caching components such as proxy servers, but will not be retrieved directly from the cache, without validating the request upstream, in response to similar requests from other users.
", + "instances":[ + { + "id": "47", + "uri": "http://localhost:3000", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "8", + "uri": "http://localhost:3000/", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "17", + "uri": "http://localhost:3000/assets/public/favicon_js.ico", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "76", + "uri": "http://localhost:3000/ftp/acquisitions.md", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "80", + "uri": "http://localhost:3000/ftp/incident-support.kdbx", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "62", + "uri": "http://localhost:3000/main.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "22", + "uri": "http://localhost:3000/polyfills.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "18", + "uri": "http://localhost:3000/runtime.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "49", + "uri": "http://localhost:3000/sitemap.xml", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "59", + "uri": "http://localhost:3000/styles.css", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + }, + { + "id": "67", + "uri": "http://localhost:3000/vendor.js", + "method": "GET", + "param": "", + "attack": "", + "evidence": "max-age=0", + "otherinfo": "" + } + ], + "count": "11", + "solution": "", + "otherinfo": "", + "reference": "https://datatracker.ietf.org/doc/html/rfc7234
https://datatracker.ietf.org/doc/html/rfc7231
https://www.w3.org/Protocols/rfc2616/rfc2616-sec13.html
", + "cweid": "524", + "wascid": "13", + "sourceid": "10" + }, + { + "pluginid": "10104", + "alertRef": "10104", + "alert": "User Agent Fuzzer", + "name": "User Agent Fuzzer", + "riskcode": "0", + "confidence": "2", + "riskdesc": "Informational (Medium)", + "desc": "Check for differences in response based on fuzzed User Agent (eg. mobile sites, access as a Search Engine Crawler). Compares the response statuscode and the hashcode of the response body with the original response.
", + "instances":[ + { + "id": "112", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "110", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "108", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "114", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko", + "evidence": "", + "otherinfo": "" + }, + { + "id": "116", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0", + "evidence": "", + "otherinfo": "" + }, + { + "id": "130", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", + "evidence": "", + "otherinfo": "" + }, + { + "id": "128", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0", + "evidence": "", + "otherinfo": "" + }, + { + "id": "118", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "122", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "126", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4", + "evidence": "", + "otherinfo": "" + }, + { + "id": "124", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16", + "evidence": "", + "otherinfo": "" + }, + { + "id": "120", + "uri": "http://localhost:3000/assets", + "method": "GET", + "param": "Header User-Agent", + "attack": "msnbot/1.1 (+http://search.msn.com/msnbot.htm)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "113", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "111", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.0)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "109", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "115", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko", + "evidence": "", + "otherinfo": "" + }, + { + "id": "117", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/75.0.3739.0 Safari/537.36 Edg/75.0.109.0", + "evidence": "", + "otherinfo": "" + }, + { + "id": "131", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.124 Safari/537.36", + "evidence": "", + "otherinfo": "" + }, + { + "id": "129", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:93.0) Gecko/20100101 Firefox/91.0", + "evidence": "", + "otherinfo": "" + }, + { + "id": "119", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (compatible; Googlebot/2.1; +http://www.google.com/bot.html)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "123", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (compatible; Yahoo! Slurp; http://help.yahoo.com/help/us/ysearch/slurp)", + "evidence": "", + "otherinfo": "" + }, + { + "id": "127", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (iPhone; CPU iPhone OS 8_0_2 like Mac OS X) AppleWebKit/600.1.4 (KHTML, like Gecko) Version/8.0 Mobile/12A366 Safari/600.1.4", + "evidence": "", + "otherinfo": "" + }, + { + "id": "125", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "Mozilla/5.0 (iPhone; U; CPU iPhone OS 3_0 like Mac OS X; en-us) AppleWebKit/528.18 (KHTML, like Gecko) Version/4.0 Mobile/7A341 Safari/528.16", + "evidence": "", + "otherinfo": "" + }, + { + "id": "121", + "uri": "http://localhost:3000/assets/public", + "method": "GET", + "param": "Header User-Agent", + "attack": "msnbot/1.1 (+http://search.msn.com/msnbot.htm)", + "evidence": "", + "otherinfo": "" + } + ], + "count": "24", + "solution": "", + "otherinfo": "", + "reference": "https://owasp.org/wstg
", + "cweid": "0", + "wascid": "0", + "sourceid": "1880" + } + ] + } + ], + "sequences":[ + ] + +} diff --git a/labs/lab5/zap/zap-report-noauth.xml b/labs/lab5/zap/zap-report-noauth.xml new file mode 100644 index 00000000..e0a8f2c9 --- /dev/null +++ b/labs/lab5/zap/zap-report-noauth.xml @@ -0,0 +1,2004 @@ + +