diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 00000000..3b434101
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,24 @@
+## Goal
+
+
+## Changes
+
+-
+-
+-
+
+## Testing
+
+-
+-
+
+## Artifacts & Screenshots
+
+
+
+---
+
+## Checklist
+- [ ] PR title is clear and descriptive
+- [ ] Documentation updated if needed
+- [ ] No secrets or large temporary files committed
\ No newline at end of file
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 00000000..df93e5fe
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1,4 @@
+
+labs/lab5/semgrep/juice-shop/
+
+labs/lab5/semgrep/juice-shop/
diff --git a/labs/lab2/analyze-risks.ps1 b/labs/lab2/analyze-risks.ps1
new file mode 100644
index 00000000..480c5f61
--- /dev/null
+++ b/labs/lab2/analyze-risks.ps1
@@ -0,0 +1,88 @@
+# Risk Analysis Script for Threagile
+param(
+ [string]$JsonPath = "labs/lab2/baseline/risks.json",
+ [string]$Label = "BASELINE"
+)
+
+Write-Host "`n========================================" -ForegroundColor Cyan
+Write-Host " $Label RISK ANALYSIS" -ForegroundColor Cyan
+Write-Host "========================================`n" -ForegroundColor Cyan
+
+$risks = Get-Content $JsonPath | ConvertFrom-Json
+Write-Host "Total Risks Found: $($risks.Count)" -ForegroundColor Yellow
+
+# Define scoring
+$severityScores = @{
+ 'critical' = 5
+ 'elevated' = 4
+ 'high' = 3
+ 'medium' = 2
+ 'low' = 1
+}
+
+$likelihoodScores = @{
+ 'very-likely' = 4
+ 'likely' = 3
+ 'possible' = 2
+ 'unlikely' = 1
+}
+
+$impactScores = @{
+ 'high' = 3
+ 'medium' = 2
+ 'low' = 1
+}
+
+# Calculate composite scores with null handling
+$scoredRisks = $risks | ForEach-Object {
+ $severity = if ($_.severity) { $severityScores[$_.severity] } else { 1 }
+ $likelihood = if ($_.likelihood) { $likelihoodScores[$_.likelihood] } else { 2 }
+ $impact = if ($_.impact) { $impactScores[$_.impact] } else { 2 }
+
+ # Use exploitation fields as fallback
+ if (-not $_.likelihood -and $_.exploitation_likelihood) {
+ $likelihood = $likelihoodScores[$_.exploitation_likelihood]
+ }
+ if (-not $_.impact -and $_.exploitation_impact) {
+ $impact = $impactScores[$_.exploitation_impact]
+ }
+
+ $compositeScore = ($severity * 100) + ($likelihood * 10) + $impact
+
+ # Clean up title (remove HTML tags)
+ $cleanTitle = $_.title -replace '|', ''
+
+ [PSCustomObject]@{
+ Title = $cleanTitle
+ Severity = $_.severity
+ Category = $_.category
+ Asset = $_.most_relevant_technical_asset
+ Likelihood = if ($_.likelihood) { $_.likelihood } else { $_.exploitation_likelihood }
+ Impact = if ($_.impact) { $_.impact } else { $_.exploitation_impact }
+ CompositeScore = $compositeScore
+ }
+}
+
+# Sort and get top 5
+$topRisks = $scoredRisks | Sort-Object -Property CompositeScore -Descending | Select-Object -First 5
+
+Write-Host "`n=== TOP 5 RISKS BY COMPOSITE SCORE ===" -ForegroundColor Green
+$topRisks | Format-Table -AutoSize
+
+Write-Host "`n=== MARKDOWN TABLE (Copy this) ===" -ForegroundColor Green
+Write-Host "| Rank | Risk Title | Severity | Category | Asset | Likelihood | Impact | Composite Score |"
+Write-Host "|------|-----------|----------|----------|-------|------------|--------|-----------------|"
+
+$rank = 1
+foreach ($risk in $topRisks) {
+ $title = $risk.Title
+ if ($title.Length -gt 60) { $title = $title.Substring(0, 57) + "..." }
+ Write-Host "| $rank | $title | $($risk.Severity) | $($risk.Category) | $($risk.Asset) | $($risk.Likelihood) | $($risk.Impact) | $($risk.CompositeScore) |"
+ $rank++
+}
+
+Write-Host "`n=== CATEGORY SUMMARY ===" -ForegroundColor Green
+$risks | Group-Object -Property category | Sort-Object -Property Count -Descending | Format-Table Name, Count -AutoSize
+
+Write-Host "`n=== SEVERITY BREAKDOWN ===" -ForegroundColor Green
+$risks | Group-Object -Property severity | Sort-Object -Property Count -Descending | Format-Table Name, Count -AutoSize
\ No newline at end of file
diff --git a/labs/lab2/baseline-analysis.txt b/labs/lab2/baseline-analysis.txt
new file mode 100644
index 00000000..65148083
Binary files /dev/null and b/labs/lab2/baseline-analysis.txt differ
diff --git a/labs/lab2/baseline/data-asset-diagram.png b/labs/lab2/baseline/data-asset-diagram.png
new file mode 100644
index 00000000..4457d768
Binary files /dev/null and b/labs/lab2/baseline/data-asset-diagram.png differ
diff --git a/labs/lab2/baseline/data-flow-diagram.png b/labs/lab2/baseline/data-flow-diagram.png
new file mode 100644
index 00000000..a8803816
Binary files /dev/null and b/labs/lab2/baseline/data-flow-diagram.png differ
diff --git a/labs/lab2/baseline/report.pdf b/labs/lab2/baseline/report.pdf
new file mode 100644
index 00000000..c538f371
Binary files /dev/null and b/labs/lab2/baseline/report.pdf differ
diff --git a/labs/lab2/baseline/risks.json b/labs/lab2/baseline/risks.json
new file mode 100644
index 00000000..8087842c
--- /dev/null
+++ b/labs/lab2/baseline/risks.json
@@ -0,0 +1 @@
+[{"category":"missing-authentication","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Authentication\u003c/b\u003e covering communication link \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eReverse Proxy\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"unnecessary-data-transfer","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Transfer\u003c/b\u003e of \u003cb\u003eTokens \u0026 Sessions\u003c/b\u003e data at \u003cb\u003eUser Browser\u003c/b\u003e from/to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unnecessary-data-transfer@tokens-sessions@user-browser@juice-shop","most_relevant_data_asset":"tokens-sessions","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"unnecessary-data-transfer","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Transfer\u003c/b\u003e of \u003cb\u003eTokens \u0026 Sessions\u003c/b\u003e data at \u003cb\u003eUser Browser\u003c/b\u003e from/to \u003cb\u003eReverse Proxy\u003c/b\u003e","synthetic_id":"unnecessary-data-transfer@tokens-sessions@user-browser@reverse-proxy","most_relevant_data_asset":"tokens-sessions","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"container-baseimage-backdooring","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eContainer Base Image Backdooring\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"container-baseimage-backdooring@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"probable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-vault","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Vault (Secret Storage)\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eJuice Shop Application\u003c/b\u003e as an example)","synthetic_id":"missing-vault@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"missing-waf","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eMissing Web Application Firewall (WAF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-waf@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-identity-store","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Identity Store\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eReverse Proxy\u003c/b\u003e as an example)","synthetic_id":"missing-identity-store@reverse-proxy","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"missing-authentication-second-factor","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Two-Factor Authentication\u003c/b\u003e covering communication link \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication-second-factor@user-browser\u003edirect-to-app-no-proxy@user-browser@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"missing-authentication-second-factor","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Two-Factor Authentication\u003c/b\u003e covering communication link \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e forwarded via \u003cb\u003eReverse Proxy\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication-second-factor@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"server-side-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eServer-Side Request Forgery (SSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e server-side web-requesting the target \u003cb\u003eWebhook Endpoint\u003c/b\u003e via \u003cb\u003eTo Challenge WebHook\u003c/b\u003e","synthetic_id":"server-side-request-forgery@juice-shop@webhook-endpoint@juice-shop\u003eto-challenge-webhook","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"juice-shop\u003eto-challenge-webhook","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"server-side-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eServer-Side Request Forgery (SSRF)\u003c/b\u003e risk at \u003cb\u003eReverse Proxy\u003c/b\u003e server-side web-requesting the target \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eTo App\u003c/b\u003e","synthetic_id":"server-side-request-forgery@reverse-proxy@juice-shop@reverse-proxy\u003eto-app","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["reverse-proxy"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-hardening@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"missing-hardening@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]},{"category":"missing-build-infrastructure","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Build Infrastructure\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eJuice Shop Application\u003c/b\u003e as an example)","synthetic_id":"missing-build-infrastructure@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unencrypted-asset@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"unencrypted-asset@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]},{"category":"cross-site-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"very-likely","exploitation_impact":"low","title":"\u003cb\u003eCross-Site Request Forgery (CSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e","synthetic_id":"cross-site-request-forgery@juice-shop@user-browser\u003edirect-to-app-no-proxy","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"cross-site-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"very-likely","exploitation_impact":"low","title":"\u003cb\u003eCross-Site Request Forgery (CSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eReverse Proxy\u003c/b\u003e","synthetic_id":"cross-site-request-forgery@juice-shop@reverse-proxy\u003eto-app","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"unencrypted-communication","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"high","title":"\u003cb\u003eUnencrypted Communication\u003c/b\u003e named \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e between \u003cb\u003eUser Browser\u003c/b\u003e and \u003cb\u003eJuice Shop Application\u003c/b\u003e transferring authentication data (like credentials, token, session-id, etc.)","synthetic_id":"unencrypted-communication@user-browser\u003edirect-to-app-no-proxy@user-browser@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"unencrypted-communication","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Communication\u003c/b\u003e named \u003cb\u003eTo App\u003c/b\u003e between \u003cb\u003eReverse Proxy\u003c/b\u003e and \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unencrypted-communication@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003eUser Browser\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@user-browser","most_relevant_data_asset":"","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"cross-site-scripting","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"cross-site-scripting@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]}]
\ No newline at end of file
diff --git a/labs/lab2/baseline/stats.json b/labs/lab2/baseline/stats.json
new file mode 100644
index 00000000..88cd78be
--- /dev/null
+++ b/labs/lab2/baseline/stats.json
@@ -0,0 +1 @@
+{"risks":{"critical":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"elevated":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":4},"high":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"low":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":5},"medium":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":14}}}
\ No newline at end of file
diff --git a/labs/lab2/baseline/technical-assets.json b/labs/lab2/baseline/technical-assets.json
new file mode 100644
index 00000000..45457f1e
--- /dev/null
+++ b/labs/lab2/baseline/technical-assets.json
@@ -0,0 +1 @@
+{"juice-shop":{"Id":"juice-shop","Title":"Juice Shop Application","Description":"OWASP Juice Shop server (Node.js/Express, v19.0.0).","Usage":0,"Type":1,"Size":2,"Technology":6,"Machine":2,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":true,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"In-scope web application (contains all business logic and vulnerabilities by design).","Tags":["app","nodejs"],"DataAssetsProcessed":["user-accounts","orders","product-catalog","tokens-sessions"],"DataAssetsStored":["logs"],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"juice-shop\u003eto-challenge-webhook","SourceId":"juice-shop","TargetId":"webhook-endpoint","Title":"To Challenge WebHook","Description":"Optional outbound callback (HTTP POST) to external WebHook when a challenge is solved.","Protocol":2,"Tags":["egress"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["orders"],"DataAssetsReceived":null,"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":70.02881844380403},"persistent-storage":{"Id":"persistent-storage","Title":"Persistent Storage","Description":"Host-mounted volume for database, file uploads, and logs.","Usage":1,"Type":2,"Size":3,"Technology":10,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Local disk storage for the container – not directly exposed, but if compromised it contains sensitive data (database and logs).","Tags":["storage","volume"],"DataAssetsProcessed":[],"DataAssetsStored":["logs","user-accounts","orders","product-catalog"],"DataFormatsAccepted":[3],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":100},"reverse-proxy":{"Id":"reverse-proxy","Title":"Reverse Proxy","Description":"Optional reverse proxy (e.g., Nginx) for TLS termination and adding security headers.","Usage":0,"Type":1,"Size":2,"Technology":20,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":1,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Not exposed to internet directly; improves security of inbound traffic.","Tags":["optional","proxy"],"DataAssetsProcessed":["product-catalog","tokens-sessions"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"reverse-proxy\u003eto-app","SourceId":"reverse-proxy","TargetId":"juice-shop","Title":"To App","Description":"Proxy forwarding to app (HTTP on 3000 internally).","Protocol":1,"Tags":[],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":9.623538157950035},"user-browser":{"Id":"user-browser","Title":"User Browser","Description":"End-user web browser (client).","Usage":0,"Type":0,"Size":0,"Technology":2,"Machine":1,"Internet":true,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":true,"Encryption":0,"JustificationOutOfScope":"","Owner":"External User","Confidentiality":0,"Integrity":1,"Availability":1,"JustificationCiaRating":"Client controlled by end user (potentially an attacker).","Tags":["actor","user"],"DataAssetsProcessed":[],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"user-browser\u003eto-reverse-proxy-preferred","SourceId":"user-browser","TargetId":"reverse-proxy","Title":"To Reverse Proxy (preferred)","Description":"User browser to reverse proxy (HTTPS on 443).","Protocol":2,"Tags":["primary"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true},{"Id":"user-browser\u003edirect-to-app-no-proxy","SourceId":"user-browser","TargetId":"juice-shop","Title":"Direct to App (no proxy)","Description":"Direct browser access to app (HTTP on 3000).","Protocol":1,"Tags":["direct"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":25.859639506459924},"webhook-endpoint":{"Id":"webhook-endpoint","Title":"Webhook Endpoint","Description":"External WebHook service (3rd-party, if configured for integrations).","Usage":0,"Type":0,"Size":0,"Technology":14,"Machine":1,"Internet":true,"MultiTenant":true,"Redundant":true,"CustomDevelopedParts":false,"OutOfScope":true,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"Third-party service to receive notifications (not under our control).","Owner":"Third-Party","Confidentiality":1,"Integrity":1,"Availability":1,"JustificationCiaRating":"External service that receives data (like order or challenge info). Treated as a trusted integration point but could be abused if misconfigured.","Tags":["saas","webhook"],"DataAssetsProcessed":["orders"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":1}}
\ No newline at end of file
diff --git a/labs/lab2/compare-risks.ps1 b/labs/lab2/compare-risks.ps1
new file mode 100644
index 00000000..011aa624
--- /dev/null
+++ b/labs/lab2/compare-risks.ps1
@@ -0,0 +1,61 @@
+Write-Host "`n========================================" -ForegroundColor Cyan
+Write-Host " BASELINE vs SECURE COMPARISON" -ForegroundColor Cyan
+Write-Host "========================================`n" -ForegroundColor Cyan
+
+$baselineRisks = Get-Content labs/lab2/baseline/risks.json | ConvertFrom-Json
+$secureRisks = Get-Content labs/lab2/secure/risks.json | ConvertFrom-Json
+
+$baselineGroups = $baselineRisks | Group-Object -Property category
+$secureGroups = $secureRisks | Group-Object -Property category
+
+$allCategories = ($baselineGroups.Name + $secureGroups.Name) | Select-Object -Unique | Sort-Object
+
+$comparison = @()
+foreach ($cat in $allCategories) {
+ $baselineCount = ($baselineGroups | Where-Object { $_.Name -eq $cat }).Count
+ $secureCount = ($secureGroups | Where-Object { $_.Name -eq $cat }).Count
+
+ if ($null -eq $baselineCount) { $baselineCount = 0 }
+ if ($null -eq $secureCount) { $secureCount = 0 }
+
+ $delta = $secureCount - $baselineCount
+
+ $comparison += [PSCustomObject]@{
+ Category = $cat
+ Baseline = $baselineCount
+ Secure = $secureCount
+ Delta = $delta
+ }
+}
+
+Write-Host "=== RISK CATEGORY COMPARISON ===" -ForegroundColor Green
+$comparison | Format-Table -AutoSize
+
+$totalBaseline = ($baselineRisks | Measure-Object).Count
+$totalSecure = ($secureRisks | Measure-Object).Count
+$totalDelta = $totalSecure - $totalBaseline
+$percentChange = if ($totalBaseline -gt 0) { [math]::Round(($totalDelta / $totalBaseline) * 100, 1) } else { 0 }
+
+Write-Host "`n=== SUMMARY ===" -ForegroundColor Yellow
+Write-Host "Total Baseline: $totalBaseline"
+Write-Host "Total Secure: $totalSecure"
+Write-Host "Delta: $totalDelta ($percentChange percent)"
+
+if ($totalDelta -lt 0) {
+ $absChange = [math]::Abs($percentChange)
+ Write-Host "SUCCESS: Security controls reduced risks by $([math]::Abs($totalDelta)) ($absChange percent)" -ForegroundColor Green
+} elseif ($totalDelta -gt 0) {
+ Write-Host "WARNING: Risk count increased by $totalDelta" -ForegroundColor Yellow
+} else {
+ Write-Host "No change in total risk count" -ForegroundColor Gray
+}
+
+Write-Host "`n=== MARKDOWN TABLE FOR SUBMISSION ===" -ForegroundColor Green
+Write-Host "| Category | Baseline | Secure | Delta |"
+Write-Host "|----------|----------|--------|-------|"
+foreach ($row in $comparison) {
+ Write-Host "| $($row.Category) | $($row.Baseline) | $($row.Secure) | $($row.Delta) |"
+}
+
+Write-Host ""
+Write-Host "**Total:** Baseline: $totalBaseline | Secure: $totalSecure | Delta: $totalDelta ($percentChange percent)"
\ No newline at end of file
diff --git a/labs/lab2/comparison.txt b/labs/lab2/comparison.txt
new file mode 100644
index 00000000..3b5e4b13
Binary files /dev/null and b/labs/lab2/comparison.txt differ
diff --git a/labs/lab2/jq-comparison.txt b/labs/lab2/jq-comparison.txt
new file mode 100644
index 00000000..35ea1ee2
--- /dev/null
+++ b/labs/lab2/jq-comparison.txt
@@ -0,0 +1,17 @@
+| Category | Baseline | Secure | Δ |
+|---|---:|---:|---:|
+| container-baseimage-backdooring | 1 | 1 | 0 |
+| cross-site-request-forgery | 2 | 2 | 0 |
+| cross-site-scripting | 1 | 1 | 0 |
+| missing-authentication | 1 | 1 | 0 |
+| missing-authentication-second-factor | 2 | 2 | 0 |
+| missing-build-infrastructure | 1 | 1 | 0 |
+| missing-hardening | 2 | 2 | 0 |
+| missing-identity-store | 1 | 1 | 0 |
+| missing-vault | 1 | 1 | 0 |
+| missing-waf | 1 | 1 | 0 |
+| server-side-request-forgery | 2 | 2 | 0 |
+| unencrypted-asset | 2 | 1 | -1 |
+| unencrypted-communication | 2 | 0 | -2 |
+| unnecessary-data-transfer | 2 | 2 | 0 |
+| unnecessary-technical-asset | 2 | 2 | 0 |
diff --git a/labs/lab2/secure-analysis.txt b/labs/lab2/secure-analysis.txt
new file mode 100644
index 00000000..d4495c4f
Binary files /dev/null and b/labs/lab2/secure-analysis.txt differ
diff --git a/labs/lab2/secure/data-asset-diagram.png b/labs/lab2/secure/data-asset-diagram.png
new file mode 100644
index 00000000..aacf4016
Binary files /dev/null and b/labs/lab2/secure/data-asset-diagram.png differ
diff --git a/labs/lab2/secure/data-flow-diagram.png b/labs/lab2/secure/data-flow-diagram.png
new file mode 100644
index 00000000..5ead09e2
Binary files /dev/null and b/labs/lab2/secure/data-flow-diagram.png differ
diff --git a/labs/lab2/secure/report.pdf b/labs/lab2/secure/report.pdf
new file mode 100644
index 00000000..3d8b963d
Binary files /dev/null and b/labs/lab2/secure/report.pdf differ
diff --git a/labs/lab2/secure/risks.json b/labs/lab2/secure/risks.json
new file mode 100644
index 00000000..2a36e6b3
--- /dev/null
+++ b/labs/lab2/secure/risks.json
@@ -0,0 +1 @@
+[{"category":"missing-authentication","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Authentication\u003c/b\u003e covering communication link \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eReverse Proxy\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"cross-site-scripting","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"cross-site-scripting@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-hardening@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"missing-hardening@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]},{"category":"container-baseimage-backdooring","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eContainer Base Image Backdooring\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"container-baseimage-backdooring@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"probable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-waf","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eMissing Web Application Firewall (WAF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-waf@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-identity-store","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Identity Store\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eReverse Proxy\u003c/b\u003e as an example)","synthetic_id":"missing-identity-store@reverse-proxy","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003eUser Browser\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@user-browser","most_relevant_data_asset":"","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"cross-site-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"very-likely","exploitation_impact":"low","title":"\u003cb\u003eCross-Site Request Forgery (CSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e","synthetic_id":"cross-site-request-forgery@juice-shop@user-browser\u003edirect-to-app-no-proxy","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"cross-site-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"very-likely","exploitation_impact":"low","title":"\u003cb\u003eCross-Site Request Forgery (CSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eReverse Proxy\u003c/b\u003e","synthetic_id":"cross-site-request-forgery@juice-shop@reverse-proxy\u003eto-app","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"server-side-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eServer-Side Request Forgery (SSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e server-side web-requesting the target \u003cb\u003eWebhook Endpoint\u003c/b\u003e via \u003cb\u003eTo Challenge WebHook\u003c/b\u003e","synthetic_id":"server-side-request-forgery@juice-shop@webhook-endpoint@juice-shop\u003eto-challenge-webhook","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"juice-shop\u003eto-challenge-webhook","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"server-side-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eServer-Side Request Forgery (SSRF)\u003c/b\u003e risk at \u003cb\u003eReverse Proxy\u003c/b\u003e server-side web-requesting the target \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eTo App\u003c/b\u003e","synthetic_id":"server-side-request-forgery@reverse-proxy@juice-shop@reverse-proxy\u003eto-app","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["reverse-proxy"]},{"category":"missing-vault","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Vault (Secret Storage)\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eJuice Shop Application\u003c/b\u003e as an example)","synthetic_id":"missing-vault@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unencrypted-asset@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"unnecessary-data-transfer","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Transfer\u003c/b\u003e of \u003cb\u003eTokens \u0026 Sessions\u003c/b\u003e data at \u003cb\u003eUser Browser\u003c/b\u003e from/to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unnecessary-data-transfer@tokens-sessions@user-browser@juice-shop","most_relevant_data_asset":"tokens-sessions","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"unnecessary-data-transfer","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Transfer\u003c/b\u003e of \u003cb\u003eTokens \u0026 Sessions\u003c/b\u003e data at \u003cb\u003eUser Browser\u003c/b\u003e from/to \u003cb\u003eReverse Proxy\u003c/b\u003e","synthetic_id":"unnecessary-data-transfer@tokens-sessions@user-browser@reverse-proxy","most_relevant_data_asset":"tokens-sessions","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"missing-authentication-second-factor","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Two-Factor Authentication\u003c/b\u003e covering communication link \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication-second-factor@user-browser\u003edirect-to-app-no-proxy@user-browser@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"missing-authentication-second-factor","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Two-Factor Authentication\u003c/b\u003e covering communication link \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e forwarded via \u003cb\u003eReverse Proxy\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication-second-factor@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"missing-build-infrastructure","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Build Infrastructure\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eJuice Shop Application\u003c/b\u003e as an example)","synthetic_id":"missing-build-infrastructure@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]}]
\ No newline at end of file
diff --git a/labs/lab2/secure/stats.json b/labs/lab2/secure/stats.json
new file mode 100644
index 00000000..c19a18a6
--- /dev/null
+++ b/labs/lab2/secure/stats.json
@@ -0,0 +1 @@
+{"risks":{"critical":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"elevated":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":2},"high":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"low":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":5},"medium":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":13}}}
\ No newline at end of file
diff --git a/labs/lab2/secure/technical-assets.json b/labs/lab2/secure/technical-assets.json
new file mode 100644
index 00000000..a082acb4
--- /dev/null
+++ b/labs/lab2/secure/technical-assets.json
@@ -0,0 +1 @@
+{"juice-shop":{"Id":"juice-shop","Title":"Juice Shop Application","Description":"OWASP Juice Shop server (Node.js/Express, v19.0.0).","Usage":0,"Type":1,"Size":2,"Technology":6,"Machine":2,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":true,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"In-scope web application (contains all business logic and vulnerabilities by design).","Tags":["app","nodejs"],"DataAssetsProcessed":["user-accounts","orders","product-catalog","tokens-sessions"],"DataAssetsStored":["logs"],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"juice-shop\u003eto-challenge-webhook","SourceId":"juice-shop","TargetId":"webhook-endpoint","Title":"To Challenge WebHook","Description":"Optional outbound callback (HTTP POST) to external WebHook when a challenge is solved.","Protocol":2,"Tags":["egress"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["orders"],"DataAssetsReceived":null,"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":70.02881844380403},"persistent-storage":{"Id":"persistent-storage","Title":"Persistent Storage","Description":"Host-mounted volume for database, file uploads, and logs.","Usage":1,"Type":2,"Size":3,"Technology":10,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":1,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Local disk storage for the container – not directly exposed, but if compromised it contains sensitive data (database and logs).","Tags":["storage","volume"],"DataAssetsProcessed":[],"DataAssetsStored":["logs","user-accounts","orders","product-catalog"],"DataFormatsAccepted":[3],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":100},"reverse-proxy":{"Id":"reverse-proxy","Title":"Reverse Proxy","Description":"Optional reverse proxy (e.g., Nginx) for TLS termination and adding security headers.","Usage":0,"Type":1,"Size":2,"Technology":20,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":1,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Not exposed to internet directly; improves security of inbound traffic.","Tags":["optional","proxy"],"DataAssetsProcessed":["product-catalog","tokens-sessions"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"reverse-proxy\u003eto-app","SourceId":"reverse-proxy","TargetId":"juice-shop","Title":"To App","Description":"Proxy forwarding to app (HTTP on 3000 internally).","Protocol":2,"Tags":[],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":9.623538157950035},"user-browser":{"Id":"user-browser","Title":"User Browser","Description":"End-user web browser (client).","Usage":0,"Type":0,"Size":0,"Technology":2,"Machine":1,"Internet":true,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":true,"Encryption":0,"JustificationOutOfScope":"","Owner":"External User","Confidentiality":0,"Integrity":1,"Availability":1,"JustificationCiaRating":"Client controlled by end user (potentially an attacker).","Tags":["actor","user"],"DataAssetsProcessed":[],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"user-browser\u003eto-reverse-proxy-preferred","SourceId":"user-browser","TargetId":"reverse-proxy","Title":"To Reverse Proxy (preferred)","Description":"User browser to reverse proxy (HTTPS on 443).","Protocol":2,"Tags":["primary"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true},{"Id":"user-browser\u003edirect-to-app-no-proxy","SourceId":"user-browser","TargetId":"juice-shop","Title":"Direct to App (no proxy)","Description":"Direct browser access to app (HTTP on 3000).","Protocol":2,"Tags":["direct"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":25.859639506459924},"webhook-endpoint":{"Id":"webhook-endpoint","Title":"Webhook Endpoint","Description":"External WebHook service (3rd-party, if configured for integrations).","Usage":0,"Type":0,"Size":0,"Technology":14,"Machine":1,"Internet":true,"MultiTenant":true,"Redundant":true,"CustomDevelopedParts":false,"OutOfScope":true,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"Third-party service to receive notifications (not under our control).","Owner":"Third-Party","Confidentiality":1,"Integrity":1,"Availability":1,"JustificationCiaRating":"External service that receives data (like order or challenge info). Treated as a trusted integration point but could be abused if misconfigured.","Tags":["saas","webhook"],"DataAssetsProcessed":["orders"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":1}}
\ No newline at end of file
diff --git a/labs/lab2/threagile-model.secure.yaml b/labs/lab2/threagile-model.secure.yaml
new file mode 100644
index 00000000..9073eef4
--- /dev/null
+++ b/labs/lab2/threagile-model.secure.yaml
@@ -0,0 +1,429 @@
+threagile_version: 1.0.0
+
+title: OWASP Juice Shop — Local Lab Threat Model (Secure Variant)
+date: 2025-09-18
+
+author:
+ name: Student Name
+ homepage: https://example.edu
+
+management_summary_comment: >
+ Threat model for a local OWASP Juice Shop setup. Users access the app
+ either directly via HTTP on port 3000 or through an optional reverse proxy that
+ terminates TLS and adds security headers. The app runs in a container
+ and writes data to a host-mounted volume (for database, uploads, logs).
+ Optional outbound notifications (e.g., a challenge-solution WebHook) can be configured for integrations.
+
+business_criticality: important # archive, operational, important, critical, mission-critical
+
+business_overview:
+ description: >
+ Training environment for DevSecOps. This model covers a deliberately vulnerable
+ web application (OWASP Juice Shop) running locally in a Docker container. The focus is on a minimal architecture, STRIDE threat analysis, and actionable mitigations for the identified risks.
+
+ images:
+ # - dfd.png: Data Flow Diagram (if exported from the tool)
+
+technical_overview:
+ description: >
+ A user’s web browser connects to the Juice Shop application (Node.js/Express server) either directly on **localhost:3000** (HTTP) or via a **reverse proxy** on ports 80/443 (with HTTPS). The Juice Shop server may issue outbound requests to external services (e.g., a configured **WebHook** for solved challenge notifications). All application data (the SQLite database, file uploads, logs) is stored on the host’s filesystem via a mounted volume. Key trust boundaries include the **Internet** (user & external services) → **Host** (local machine/VM) → **Container Network** (isolated app container).
+ images: []
+
+questions:
+ Do you expose port 3000 beyond localhost?: ""
+ Do you use a reverse proxy with TLS and security headers?: ""
+ Are any outbound integrations (webhooks) configured?: ""
+ Is any sensitive data stored in logs or files?: ""
+
+abuse_cases:
+ Credential Stuffing / Brute Force: >
+ Attackers attempt repeated login attempts to guess credentials or exhaust system resources.
+ Stored XSS via Product Reviews: >
+ Malicious scripts are inserted into product reviews, getting stored and executed in other users’ browsers.
+ SSRF via Outbound Requests: >
+ Server-side requests (e.g. profile image URL fetch or WebHook callback) are abused to access internal network resources.
+
+security_requirements:
+ TLS in transit: Enforce HTTPS for user traffic via a TLS-terminating reverse proxy with strong ciphers and certificate management.
+ AuthZ on sensitive routes: Implement strict server-side authorization checks (role/permission) on admin or sensitive functionalities.
+ Rate limiting & lockouts: Apply rate limiting and account lockout policies to mitigate brute-force and automated attacks on authentication and expensive operations.
+ Secure headers: Add security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, etc.) at the proxy or app to mitigate client-side attacks.
+ Secrets management: Protect secret keys and credentials (JWT signing keys, OAuth client secrets) – keep them out of code repos and avoid logging them.
+
+tags_available:
+ # Relevant technologies and environment tags
+ - docker
+ - nodejs
+ # Data and asset tags
+ - pii
+ - auth
+ - tokens
+ - logs
+ - public
+ - actor
+ - user
+ - optional
+ - proxy
+ - app
+ - storage
+ - volume
+ - saas
+ - webhook
+ # Communication tags
+ - primary
+ - direct
+ - egress
+
+# =========================
+# DATA ASSETS
+# =========================
+data_assets:
+
+ User Accounts:
+ id: user-accounts
+ description: "User profile data, credential hashes, emails."
+ usage: business
+ tags: ["pii", "auth"]
+ origin: user-supplied
+ owner: Lab Owner
+ quantity: many
+ confidentiality: confidential
+ integrity: critical
+ availability: important
+ justification_cia_rating: >
+ Contains personal identifiers and authentication data. High confidentiality is required to protect user privacy, and integrity is critical to prevent account takeovers.
+
+ Orders:
+ id: orders
+ description: "Order history, addresses, and payment metadata (no raw card numbers)."
+ usage: business
+ tags: ["pii"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: confidential
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ Contains users’ personal data and business transaction records. Integrity and confidentiality are important to prevent fraud or privacy breaches.
+
+ Product Catalog:
+ id: product-catalog
+ description: "Product information (names, descriptions, prices) available to all users."
+ usage: business
+ tags: ["public"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: public
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ Product data is intended to be public, but its integrity is important (to avoid defacement or price manipulation that could mislead users).
+
+ Tokens & Sessions:
+ id: tokens-sessions
+ description: "Session identifiers, JWTs for authenticated sessions, CSRF tokens."
+ usage: business
+ tags: ["auth", "tokens"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: confidential
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ If session tokens are compromised, attackers can hijack user sessions. They must be kept confidential and intact; availability is less critical (tokens can be reissued).
+
+ Logs:
+ id: logs
+ description: "Application and access logs (may inadvertently contain PII or secrets)."
+ usage: devops
+ tags: ["logs"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ Logs are for internal use (troubleshooting, monitoring). They should not be exposed publicly, and sensitive data should be sanitized to protect confidentiality.
+
+# =========================
+# TECHNICAL ASSETS
+# =========================
+technical_assets:
+
+ User Browser:
+ id: user-browser
+ description: "End-user web browser (client)."
+ type: external-entity
+ usage: business
+ used_as_client_by_human: true
+ out_of_scope: false
+ justification_out_of_scope:
+ size: system
+ technology: browser
+ tags: ["actor", "user"]
+ internet: true
+ machine: virtual
+ encryption: none
+ owner: External User
+ confidentiality: public
+ integrity: operational
+ availability: operational
+ justification_cia_rating: "Client controlled by end user (potentially an attacker)."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: false
+ data_assets_processed: []
+ data_assets_stored: []
+ data_formats_accepted:
+ - json
+ communication_links:
+ To Reverse Proxy (preferred):
+ target: reverse-proxy
+ description: "User browser to reverse proxy (HTTPS on 443)."
+ protocol: https
+ authentication: session-id
+ authorization: enduser-identity-propagation
+ tags: ["primary"]
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - tokens-sessions
+ data_assets_received:
+ - product-catalog
+ Direct to App (no proxy):
+ target: juice-shop
+ description: "Direct browser access to app (HTTP on 3000)."
+ protocol: https
+ authentication: session-id
+ authorization: enduser-identity-propagation
+ tags: ["direct"]
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - tokens-sessions
+ data_assets_received:
+ - product-catalog
+
+ Reverse Proxy:
+ id: reverse-proxy
+ description: "Optional reverse proxy (e.g., Nginx) for TLS termination and adding security headers."
+ type: process
+ usage: business
+ used_as_client_by_human: false
+ out_of_scope: false
+ justification_out_of_scope:
+ size: application
+ technology: reverse-proxy
+ tags: ["optional", "proxy"]
+ internet: false
+ machine: virtual
+ encryption: transparent
+ owner: Lab Owner
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: "Not exposed to internet directly; improves security of inbound traffic."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: false
+ data_assets_processed:
+ - product-catalog
+ - tokens-sessions
+ data_assets_stored: []
+ data_formats_accepted:
+ - json
+ communication_links:
+ To App:
+ target: juice-shop
+ description: "Proxy forwarding to app (HTTP on 3000 internally)."
+ protocol: https
+ authentication: none
+ authorization: none
+ tags: []
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - tokens-sessions
+ data_assets_received:
+ - product-catalog
+
+ Juice Shop Application:
+ id: juice-shop
+ description: "OWASP Juice Shop server (Node.js/Express, v19.0.0)."
+ type: process
+ usage: business
+ used_as_client_by_human: false
+ out_of_scope: false
+ justification_out_of_scope:
+ size: application
+ technology: web-server
+ tags: ["app", "nodejs"]
+ internet: false
+ machine: container
+ encryption: none
+ owner: Lab Owner
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: "In-scope web application (contains all business logic and vulnerabilities by design)."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: true
+ data_assets_processed:
+ - user-accounts
+ - orders
+ - product-catalog
+ - tokens-sessions
+ data_assets_stored:
+ - logs
+ data_formats_accepted:
+ - json
+ communication_links:
+ To Challenge WebHook:
+ target: webhook-endpoint
+ description: "Optional outbound callback (HTTP POST) to external WebHook when a challenge is solved."
+ protocol: https
+ authentication: none
+ authorization: none
+ tags: ["egress"]
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - orders
+
+ Persistent Storage:
+ id: persistent-storage
+ description: "Host-mounted volume for database, file uploads, and logs."
+ type: datastore
+ usage: devops
+ used_as_client_by_human: false
+ out_of_scope: false
+ justification_out_of_scope:
+ size: component
+ technology: file-server
+ tags: ["storage", "volume"]
+ internet: false
+ machine: virtual
+ encryption: transparent
+ owner: Lab Owner
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: "Local disk storage for the container – not directly exposed, but if compromised it contains sensitive data (database and logs)."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: false
+ data_assets_processed: []
+ data_assets_stored:
+ - logs
+ - user-accounts
+ - orders
+ - product-catalog
+ data_formats_accepted:
+ - file
+ communication_links: {}
+
+ Webhook Endpoint:
+ id: webhook-endpoint
+ description: "External WebHook service (3rd-party, if configured for integrations)."
+ type: external-entity
+ usage: business
+ used_as_client_by_human: false
+ out_of_scope: true
+ justification_out_of_scope: "Third-party service to receive notifications (not under our control)."
+ size: system
+ technology: web-service-rest
+ tags: ["saas", "webhook"]
+ internet: true
+ machine: virtual
+ encryption: none
+ owner: Third-Party
+ confidentiality: internal
+ integrity: operational
+ availability: operational
+ justification_cia_rating: "External service that receives data (like order or challenge info). Treated as a trusted integration point but could be abused if misconfigured."
+ multi_tenant: true
+ redundant: true
+ custom_developed_parts: false
+ data_assets_processed:
+ - orders
+ data_assets_stored: []
+ data_formats_accepted:
+ - json
+ communication_links: {}
+
+# =========================
+# TRUST BOUNDARIES
+# =========================
+trust_boundaries:
+
+ Internet:
+ id: internet
+ description: "Untrusted public network (Internet)."
+ type: network-dedicated-hoster
+ tags: []
+ technical_assets_inside:
+ - user-browser
+ - webhook-endpoint
+ trust_boundaries_nested:
+ - host
+
+ Host:
+ id: host
+ description: "Local host machine / VM running the Docker environment."
+ type: network-dedicated-hoster
+ tags: []
+ technical_assets_inside:
+ - reverse-proxy
+ - persistent-storage
+ trust_boundaries_nested:
+ - container-network
+
+ Container Network:
+ id: container-network
+ description: "Docker container network (isolated internal network for containers)."
+ type: network-dedicated-hoster
+ tags: []
+ technical_assets_inside:
+ - juice-shop
+ trust_boundaries_nested: []
+
+# =========================
+# SHARED RUNTIMES
+# =========================
+shared_runtimes:
+
+ Docker Host:
+ id: docker-host
+ description: "Docker Engine and default bridge network on the host."
+ tags: ["docker"]
+ technical_assets_running:
+ - juice-shop
+ # If the reverse proxy is containerized, include it:
+ # - reverse-proxy
+
+# =========================
+# INDIVIDUAL RISK CATEGORIES (optional)
+# =========================
+individual_risk_categories: {}
+
+# =========================
+# RISK TRACKING (optional)
+# =========================
+risk_tracking: {}
+
+# (Optional diagram layout tweaks can be added here)
+#diagram_tweak_edge_layout: spline
+#diagram_tweak_layout_left_to_right: true
diff --git a/labs/lab4/analysis/sbom-analysis.txt b/labs/lab4/analysis/sbom-analysis.txt
new file mode 100644
index 00000000..25719b65
--- /dev/null
+++ b/labs/lab4/analysis/sbom-analysis.txt
@@ -0,0 +1,81 @@
+=== SBOM Component Analysis ===
+
+Syft Package Counts:
+ 1128 npm
+ 10 deb
+ 1 binary
+
+
+Trivy Package Counts:
+ 4 null
+ 1 debian
+ 1 node-pkg
+
+
+=== License Analysis ===
+
+Syft Licenses:
+ 890 MIT
+ 143 ISC
+ 19 LGPL-3.0
+ 16 BSD-3-Clause
+ 15 Apache-2.0
+ 12 BSD-2-Clause
+ 6 GPL-2
+ 5 Artistic
+ 5 BlueOak-1.0.0
+ 5 GPL
+ 4 GPL-3
+ 4 GFDL-1.2
+ 4 LGPL
+ 2 (MIT OR Apache-2.0)
+ 2 sha256:cb992345949ccd6e8394b2cd6c465f7b897c864f845937dbf64e8997f389e164
+ 2 Unlicense
+ 2 MIT/X11
+ 2 MPL-2.0
+ 1 WTFPL OR ISC
+ 1 (BSD-2-Clause OR MIT OR Apache-2.0)
+ 1 WTFPL
+ 1 0BSD
+ 1 (WTFPL OR MIT)
+ 1 public-domain
+ 1 GPL-2.0
+ 1 BSD
+ 1 Apache2
+ 1 (MIT OR WTFPL)
+ 1 LGPL-2.1
+ 1 ad-hoc
+ 1 GPL-1+
+ 1 GPL-1
+
+
+Trivy Licenses:
+ 878 MIT
+ 143 ISC
+ 19 LGPL-3.0-only
+ 14 BSD-3-Clause
+ 13 Apache-2.0
+ 12 BSD-2-Clause
+ 5 BlueOak-1.0.0
+ 4 GPL-2.0-only
+ 2 MPL-2.0
+ 2 MIT/X11
+ 2 GPL-2.0-or-later
+ 2 Unlicense
+ 2 (MIT OR Apache-2.0)
+ 2 Artistic-2.0
+ 1 WTFPL OR ISC
+ 1 (BSD-2-Clause OR MIT OR Apache-2.0)
+ 1 (MIT OR WTFPL)
+ 1 (WTFPL OR MIT)
+ 1 GPL-3.0-only
+ 1 WTFPL
+ 1 0BSD
+ 1 GPL-1.0-only
+ 1 ad-hoc
+ 1 public-domain
+ 1 GPL-1.0-or-later
+ 1 GFDL-1.2-only
+ 1 LGPL-2.0-or-later
+ 1 LGPL-2.1-only
+
diff --git a/labs/lab4/analysis/vulnerability-analysis.txt b/labs/lab4/analysis/vulnerability-analysis.txt
new file mode 100644
index 00000000..81da0221
--- /dev/null
+++ b/labs/lab4/analysis/vulnerability-analysis.txt
@@ -0,0 +1,21 @@
+=== Vulnerability Analysis ===
+
+Grype Vulnerabilities by Severity:
+ 60 High
+ 31 Medium
+ 12 Negligible
+ 11 Critical
+ 3 Low
+
+
+Trivy Vulnerabilities by Severity:
+ 55 HIGH
+ 33 MEDIUM
+ 18 LOW
+ 10 CRITICAL
+
+
+=== License Analysis Summary ===
+
+Syft unique license types: 32
+Trivy unique license types: 28
diff --git a/labs/lab4/comparison/accuracy-analysis.txt b/labs/lab4/comparison/accuracy-analysis.txt
new file mode 100644
index 00000000..921b9ceb
--- /dev/null
+++ b/labs/lab4/comparison/accuracy-analysis.txt
@@ -0,0 +1,13 @@
+=== Package Detection Comparison ===
+
+Packages detected by both tools: 988
+Packages only detected by Syft: 13
+Packages only detected by Trivy: 9
+
+=== Vulnerability Detection Overlap ===
+
+CVEs found by Grype: 90
+CVEs found by Trivy: 88
+Common CVEs: 26
+Grype-only CVEs: 64
+Trivy-only CVEs: 62
diff --git a/labs/lab4/comparison/grype-cves.txt b/labs/lab4/comparison/grype-cves.txt
new file mode 100644
index 00000000..8a5912e1
--- /dev/null
+++ b/labs/lab4/comparison/grype-cves.txt
@@ -0,0 +1,90 @@
+CVE-2010-4756
+CVE-2018-20796
+CVE-2019-1010022
+CVE-2019-1010023
+CVE-2019-1010024
+CVE-2019-1010025
+CVE-2019-9192
+CVE-2022-27943
+CVE-2025-15281
+CVE-2025-15467
+CVE-2025-27587
+CVE-2025-4802
+CVE-2025-55130
+CVE-2025-55131
+CVE-2025-55132
+CVE-2025-59465
+CVE-2025-59466
+CVE-2025-68160
+CVE-2025-69418
+CVE-2025-69419
+CVE-2025-69420
+CVE-2025-69421
+CVE-2025-8058
+CVE-2025-9230
+CVE-2025-9232
+CVE-2026-0861
+CVE-2026-0915
+CVE-2026-21637
+CVE-2026-22795
+CVE-2026-22796
+GHSA-25hc-qcg6-38wj
+GHSA-2p57-rm9w-gvfp
+GHSA-34x7-hfp2-rc4v
+GHSA-35jh-r3h4-6jhm
+GHSA-3h5v-q93c-6h6q
+GHSA-3j7m-hmh3-9jmp
+GHSA-3ppc-4f35-3m26
+GHSA-446m-mv8f-q348
+GHSA-44fp-w29j-9vj5
+GHSA-4pg4-qvpc-4q3h
+GHSA-4xc9-xhrj-v574
+GHSA-5j98-mcp5-4vw2
+GHSA-5mrr-rgp6-x4gr
+GHSA-6g6m-m6h5-w9gf
+GHSA-6rw7-vpxm-498p
+GHSA-73rr-hh4g-fpgx
+GHSA-83g3-92jg-28cx
+GHSA-869p-cjfg-cm3x
+GHSA-87vv-r9j6-g5qv
+GHSA-8cf7-32gw-wr33
+GHSA-8g4m-cjm2-96wq
+GHSA-8hfj-j24r-96c4
+GHSA-8qq5-rm4j-mr97
+GHSA-952p-6rrq-rcjv
+GHSA-9965-vmph-33xx
+GHSA-99p7-6v5w-7xg8
+GHSA-c7hr-j4mj-j2w6
+GHSA-cchq-frgv-rjh5
+GHSA-cgfm-xwp7-2cvr
+GHSA-cqmj-92xf-r6r9
+GHSA-f5x3-32g6-xq36
+GHSA-fjgf-rc76-4x9p
+GHSA-fvqr-27wr-82fm
+GHSA-g5hg-p3ph-g8qg
+GHSA-g644-9gfx-q4q4
+GHSA-gjcw-v447-2w7q
+GHSA-grv7-fg5c-xmjg
+GHSA-hjrf-2m68-5959
+GHSA-jf85-cpcp-j695
+GHSA-mh29-5h37-fv8m
+GHSA-mjxr-4v3x-q3m4
+GHSA-p5gc-c584-jj6v
+GHSA-p6mc-m468-83gw
+GHSA-pfrx-2q88-qq97
+GHSA-pxg6-pf52-xh8x
+GHSA-qhxp-v273-g94h
+GHSA-qwph-4952-7xr6
+GHSA-r6q2-hw4h-h46w
+GHSA-r7qp-cfhv-p84w
+GHSA-rc47-6667-2j5j
+GHSA-rjqq-98f6-6j3r
+GHSA-rm97-x556-q36h
+GHSA-rvg8-pwq2-xj7q
+GHSA-vghf-hv5q-vc2g
+GHSA-vj76-c3g6-qr5v
+GHSA-w7fw-mjwx-w883
+GHSA-whpj-8f3w-67p5
+GHSA-xc6g-ggrc-qq4r
+GHSA-xwcq-pm8m-c4vf
+GHSA-xxjr-mmjv-4gpg
diff --git a/labs/lab4/comparison/syft-packages.txt b/labs/lab4/comparison/syft-packages.txt
new file mode 100644
index 00000000..53199146
--- /dev/null
+++ b/labs/lab4/comparison/syft-packages.txt
@@ -0,0 +1,1001 @@
+@adraffy/ens-normalize@1.10.1
+@babel/helper-string-parser@7.27.1
+@babel/helper-validator-identifier@7.27.1
+@babel/parser@7.28.3
+@babel/types@7.28.2
+@colors/colors@1.6.0
+@dabh/diagnostics@2.0.3
+@ethereumjs/rlp@4.0.1
+@ethereumjs/rlp@5.0.2
+@gar/promisify@1.1.3
+@isaacs/cliui@8.0.2
+@isaacs/fs-minipass@4.0.1
+@my-scope/package-a@0.0.0
+@my-scope/package-b@0.0.0
+@nlpjs/core@4.26.1
+@nlpjs/core-loader@4.26.1
+@nlpjs/evaluator@4.26.1
+@nlpjs/lang-en@4.26.1
+@nlpjs/lang-en-min@4.26.1
+@nlpjs/language@4.25.0
+@nlpjs/language-min@4.25.0
+@nlpjs/ner@4.27.0
+@nlpjs/neural@4.25.0
+@nlpjs/nlg@4.26.1
+@nlpjs/nlp@4.27.0
+@nlpjs/nlu@4.27.0
+@nlpjs/request@4.25.0
+@nlpjs/sentiment@4.26.1
+@nlpjs/similarity@4.26.1
+@nlpjs/slot@4.26.1
+@noble/curves@1.2.0
+@noble/curves@1.4.2
+@noble/hashes@1.3.2
+@noble/hashes@1.4.0
+@npmcli/agent@3.0.0
+@npmcli/fs@1.1.1
+@npmcli/fs@4.0.0
+@npmcli/move-file@1.1.2
+@otplib/core@12.0.1
+@otplib/plugin-crypto@12.0.1
+@otplib/plugin-thirty-two@12.0.1
+@otplib/preset-default@12.0.1
+@otplib/preset-v11@12.0.1
+@pkgjs/parseargs@0.11.0
+@scarf/scarf@1.4.0
+@scure/base@1.1.9
+@scure/bip32@1.4.0
+@scure/bip39@1.3.0
+@sindresorhus/is@0.7.0
+@swc/helpers@0.3.17
+@tokenizer/token@0.3.0
+@tootallnate/once@1.1.2
+@tootallnate/once@2.0.0
+@types/component-emitter@1.2.14
+@types/cookie@0.4.1
+@types/cors@2.8.19
+@types/debug@4.1.12
+@types/ms@2.1.0
+@types/node@20.19.12
+@types/node@22.7.5
+@types/strip-bom@3.0.0
+@types/strip-json-comments@0.0.30
+@types/triple-beam@1.3.5
+@types/validator@13.15.3
+@types/ws@8.5.3
+1to2@1.0.0
+abbrev@1.1.1
+abbrev@3.0.1
+abitype@0.7.1
+abort-controller@3.0.0
+accepts@1.3.8
+acorn@7.4.1
+acorn@8.15.0
+acorn-walk@8.3.4
+aes-js@4.0.0-beta.5
+agent-base@6.0.2
+agent-base@7.1.4
+agentkeepalive@4.6.0
+aggregate-error@3.1.0
+ansi-regex@2.1.1
+ansi-regex@3.0.1
+ansi-regex@5.0.1
+ansi-regex@6.2.0
+ansi-styles@2.2.1
+ansi-styles@3.2.1
+ansi-styles@4.3.0
+ansi-styles@6.2.1
+anymatch@3.1.3
+append-field@1.0.0
+aproba@1.2.0
+archiver@1.3.0
+archiver-utils@1.3.0
+archive-type@4.0.0
+are-we-there-yet@1.1.7
+are-we-there-yet@3.0.1
+arg@4.1.3
+argparse@1.0.10
+array-buffer-byte-length@1.0.2
+array-each@1.0.1
+array-flatten@1.1.1
+array-slice@1.1.0
+array-unique@0.3.2
+arr-diff@4.0.0
+arr-flatten@1.1.0
+arr-union@3.1.0
+asap@2.0.6
+assert-never@1.4.0
+assign-symbols@1.0.0
+async@2.6.4
+async@3.2.6
+at-least-node@1.0.0
+atob@2.1.2
+available-typed-arrays@1.0.7
+babel-walk@3.0.0-canary-5
+balanced-match@1.0.2
+base@0.11.2
+base64-arraybuffer@0.1.4
+base64id@2.0.0
+base64-js@0.0.8
+base64-js@1.5.1
+base64url@0.0.6
+base-files@12.4+deb12u11
+basic-auth@2.0.1
+batch@0.6.1
+baz@UNKNOWN
+beep-boop@1.2.3
+big-integer@1.6.52
+binary@0.3.0
+binary-extensions@2.3.0
+bindings@1.5.0
+bintrees@1.0.2
+bl@1.2.3
+bl@4.1.0
+bluebird@3.4.7
+bluebird@3.7.2
+body-parser@1.20.3
+bower-config@1.4.3
+brace-expansion@1.1.12
+brace-expansion@2.0.2
+braces@2.3.2
+braces@3.0.3
+brotli@1.3.3
+browser_field@UNKNOWN
+buffer@5.7.1
+buffer@6.0.3
+buffer-alloc@1.2.0
+buffer-alloc-unsafe@1.1.0
+buffer-crc32@0.2.13
+buffer-fill@1.0.0
+buffer-from@1.1.2
+buffer-indexof-polyfill@1.0.2
+buffers@0.1.1
+busboy@1.6.0
+byline@4.2.2
+bytes@3.1.2
+cacache@15.3.0
+cacache@19.0.1
+cacheable-request@2.1.4
+cache-base@1.0.1
+call-bind@1.0.8
+call-bind-apply-helpers@1.0.2
+call-bound@1.0.4
+camelcase@5.3.1
+chainsaw@0.1.0
+chalk@1.1.3
+chalk@2.4.2
+chalk@4.1.2
+character-parser@2.2.0
+check-dependencies@1.1.1
+check-internet-connected@2.0.6
+check-types@6.0.0
+chokidar@3.5.1
+chownr@1.1.4
+chownr@2.0.0
+chownr@3.0.0
+clarinet@0.12.6
+class-utils@0.3.6
+clean-stack@2.2.0
+cliui@6.0.0
+clone@2.1.2
+clone-response@1.0.2
+code-point-at@1.1.0
+collection-visit@1.0.0
+color@3.2.1
+color-convert@1.9.3
+color-convert@2.0.1
+color-name@1.1.3
+color-name@1.1.4
+colors@1.1.2
+colors@1.4.0
+colorspace@1.1.4
+color-string@1.9.1
+color-support@1.1.3
+commander@2.20.3
+component-emitter@1.3.1
+component-type@1.2.1
+compress-commons@1.2.2
+compressible@2.0.18
+compression@1.8.1
+concat-map@0.0.1
+concat-stream@1.6.2
+config@3.3.12
+console-control-strings@1.1.0
+constantinople@4.0.1
+content-disposition@0.5.4
+content-type@1.0.5
+cookie@0.4.2
+cookie@0.7.1
+cookie@0.7.2
+cookie-parser@1.4.7
+cookie-signature@1.0.6
+copy-descriptor@0.1.1
+core-util-is@1.0.2
+cors@2.8.5
+crc@3.8.0
+crc-32@1.2.2
+crc32-stream@2.0.0
+create-require@1.1.1
+cross-fetch@4.1.0
+cross-fetch-polyfill@0.0.0
+cross-spawn@7.0.6
+crypto-js@3.3.0
+dateformat@4.6.3
+debug@2.6.9
+debug@3.2.7
+debug@4.3.7
+decamelize@1.2.0
+decode-uri-component@0.2.2
+decompress@4.2.1
+decompress-response@3.3.0
+decompress-response@4.2.1
+decompress-response@6.0.0
+decompress-tar@4.1.1
+decompress-tarbz2@4.1.1
+decompress-targz@4.1.1
+decompress-unzip@4.0.1
+deep-equal@2.2.3
+deep-extend@0.6.0
+define-data-property@1.1.4
+define-properties@1.2.1
+define-property@0.2.5
+define-property@1.0.0
+define-property@2.0.2
+delegates@1.0.0
+depd@1.1.2
+depd@2.0.0
+destroy@1.2.0
+detect-file@1.0.0
+detect-libc@1.0.3
+detect-libc@2.0.4
+dfa@1.2.0
+diff@4.0.2
+doctypes@1.1.0
+domelementtype@1.3.1
+domhandler@2.1.0
+domutils@1.1.6
+dottie@2.0.6
+double-ended-queue@0.9.7
+download@8.0.0
+dunder-proto@1.0.1
+duplexer2@0.1.4
+duplexer3@0.1.5
+dynamic-dedupe@0.3.0
+eastasianwidth@0.2.0
+ee-first@1.1.1
+eivindfjeldstad-dot@0.0.1
+emoji-regex@8.0.0
+emoji-regex@9.2.2
+enabled@2.0.0
+encodeurl@1.0.2
+encodeurl@2.0.0
+encoding@0.1.13
+end-of-stream@1.4.5
+engine.io@4.1.2
+engine.io-parser@4.0.3
+env-paths@2.2.1
+err-code@1.1.2
+err-code@2.0.3
+errorhandler@1.5.1
+escape-html@1.0.3
+escape-string-regexp@1.0.5
+escodegen@2.1.0
+es-define-property@1.0.1
+es-errors@1.3.0
+es-get-iterator@1.1.3
+es-object-atoms@1.1.1
+esprima@1.0.4
+esprima@4.0.1
+estraverse@5.3.0
+esutils@2.0.3
+etag@1.8.1
+ethereum-cryptography@2.2.1
+ethers@6.15.0
+eventemitter2@0.4.14
+eventemitter3@1.1.1
+eventemitter3@5.0.1
+events@3.3.0
+event-target-shim@5.0.1
+exit@0.1.2
+expand-brackets@2.1.4
+expand-template@2.0.3
+expand-tilde@2.0.2
+exponential-backoff@3.1.2
+express@4.21.2
+express-ipfilter@1.3.2
+express-jwt@0.1.3
+express-rate-limit@7.5.1
+express-robots-txt@0.4.1
+express-security.txt@2.0.0
+extend@3.0.2
+extend-shallow@2.0.1
+extend-shallow@3.0.2
+extglob@2.0.4
+ext-list@2.2.2
+ext-name@5.0.0
+false_main@UNKNOWN
+fast.js@0.1.1
+fdir@6.5.0
+fd-slicer@1.1.0
+feature-policy@0.5.0
+fecha@4.2.3
+filehound@1.17.6
+file-js@0.3.0
+filename-reserved-regex@2.0.0
+filenamify@3.0.0
+filesniffer@1.0.3
+file-stream-rotator@1.0.0
+file-type@11.1.0
+file-type@16.5.4
+file-type@3.9.0
+file-type@4.4.0
+file-type@5.2.0
+file-type@6.2.0
+file-uri-to-path@1.0.0
+fill-range@4.0.0
+fill-range@7.1.1
+finale-rest@1.2.2
+finalhandler@1.3.1
+find-up@4.1.0
+findup-sync@2.0.0
+findup-sync@4.0.0
+findup-sync@5.0.0
+fined@1.2.0
+flagged-respawn@1.0.1
+fn.name@1.1.0
+fontkit@1.9.0
+for-each@0.3.5
+foreachasync@3.0.0
+foreground-child@3.3.1
+for-in@1.0.2
+formatio@1.1.1
+for-own@1.0.0
+forwarded@0.2.0
+fragment-cache@0.2.1
+fresh@0.5.2
+from2@2.3.0
+frontend@19.0.0
+fs.realpath@1.0.0
+fs-constants@1.0.0
+fs-extra@9.1.0
+fs-minipass@1.2.7
+fs-minipass@2.1.0
+fs-minipass@3.0.3
+fstream@1.0.12
+function-bind@1.1.2
+functions-have-names@1.2.3
+fuzzball@1.4.0
+gauge@2.7.4
+gauge@4.0.4
+gcc-12-base@12.2.0-14+deb12u1
+geojson-utils@1.1.0
+get-caller-file@2.0.5
+get-intrinsic@1.3.0
+getobject@1.0.2
+get-proto@1.0.1
+get-stream@2.3.1
+get-stream@3.0.0
+get-stream@4.1.0
+get-value@2.0.6
+github-from-package@0.0.0
+glob@10.4.5
+glob@7.1.7
+glob@7.2.3
+global-modules@1.0.0
+global-prefix@1.0.2
+glob-parent@5.1.2
+gopd@1.2.0
+got@8.3.2
+graceful-fs@4.2.11
+grunt@1.6.1
+grunt-cli@1.4.3
+grunt-contrib-compress@1.6.0
+grunt-known-options@2.0.0
+grunt-legacy-log@3.0.0
+grunt-legacy-log-utils@2.1.0
+grunt-legacy-util@2.0.1
+grunt-replace-json@0.1.0
+handlebars@4.7.7
+has-ansi@2.0.0
+has-bigints@1.1.0
+has-flag@3.0.0
+has-flag@4.0.0
+hashids@2.3.0
+hashids-esm@UNKNOWN
+hasown@2.0.2
+has-property-descriptors@1.0.2
+has-symbols@1.1.0
+has-symbol-support-x@1.4.2
+has-tostringtag@1.0.2
+has-to-string-tag-x@1.4.1
+has-unicode@2.0.1
+has-value@0.3.1
+has-value@1.0.0
+has-values@0.1.4
+has-values@1.0.0
+hbs@4.2.0
+he@0.4.1
+heap@0.2.7
+helmet@4.6.0
+hoister@0.0.2
+homedir-polyfill@1.0.3
+hooker@0.2.3
+html-entities@1.4.0
+htmlparser2@3.3.0
+http-cache-semantics@3.8.1
+http-cache-semantics@4.2.0
+http-errors@1.6.3
+http-errors@2.0.0
+http-proxy-agent@4.0.1
+http-proxy-agent@5.0.0
+http-proxy-agent@7.0.2
+https-proxy-agent@5.0.1
+https-proxy-agent@7.0.6
+humanize-ms@1.2.1
+i18n@0.11.1
+iconv-lite@0.4.24
+iconv-lite@0.6.3
+ieee754@1.2.1
+ignore-walk@3.0.4
+iltorb@2.4.5
+imurmurhash@0.1.4
+indent-string@4.0.0
+infer-owner@1.0.4
+inflection@1.13.4
+inflight@1.0.6
+inherits@2.0.3
+inherits@2.0.4
+ini@1.3.8
+internal-slot@1.1.0
+interpret@1.1.0
+into-stream@3.1.0
+invalid_main@UNKNOWN
+invariant@2.2.4
+ip@2.0.1
+ip6@0.2.11
+ipaddr.js@1.9.1
+ip-address@10.0.1
+is-absolute@1.0.0
+is-accessor-descriptor@1.0.1
+is-arguments@1.2.0
+isarray@0.0.1
+isarray@1.0.0
+isarray@2.0.5
+is-array-buffer@3.0.5
+is-arrayish@0.3.2
+is-bigint@1.1.0
+is-binary-path@2.1.0
+is-boolean-object@1.2.2
+is-buffer@1.1.6
+is-callable@1.2.7
+is-core-module@2.16.1
+is-data-descriptor@1.0.1
+is-date-object@1.1.0
+is-descriptor@0.1.7
+is-descriptor@1.0.3
+isexe@2.0.0
+isexe@3.1.1
+is-expression@4.0.0
+is-extendable@0.1.1
+is-extendable@1.0.1
+is-extglob@2.1.1
+is-fullwidth-code-point@1.0.0
+is-fullwidth-code-point@2.0.0
+is-fullwidth-code-point@3.0.0
+is-generator-function@1.1.0
+is-glob@3.1.0
+is-glob@4.0.3
+is-lambda@1.0.1
+is-map@2.0.3
+is-natural-number@4.0.1
+is-number@3.0.0
+is-number@7.0.0
+is-number-like@1.0.8
+is-number-object@1.1.1
+is-object@1.0.2
+isobject@2.1.0
+isobject@3.0.1
+isomorphic-ws@5.0.0
+is-plain-obj@1.1.0
+is-plain-object@2.0.4
+is-promise@2.2.2
+is-regex@1.2.1
+is-relative@1.0.0
+is-retry-allowed@1.2.0
+is-set@2.0.3
+is-shared-array-buffer@1.0.4
+is-stream@1.1.0
+is-stream@2.0.1
+is-string@1.1.1
+is-symbol@1.1.1
+is-typed-array@1.1.15
+is-unc-path@1.0.0
+isurl@1.0.0
+is-weakmap@2.0.2
+is-weakset@2.0.4
+is-windows@1.0.2
+jackspeak@3.4.3
+json5@2.2.3
+json-buffer@3.0.0
+jsonfile@6.2.0
+jsonwebtoken@0.1.0
+jsonwebtoken@0.4.0
+jssha@3.3.1
+js-stringify@1.0.2
+js-tokens@4.0.0
+jstransformer@1.0.0
+js-yaml@3.14.1
+juice-shop@19.0.0
+juicy-chat-bot@0.9.0
+jwa@0.0.1
+jws@0.2.6
+keyv@3.0.0
+kind-of@3.2.2
+kind-of@4.0.0
+kind-of@6.0.3
+kuler@2.0.0
+lazystream@1.0.1
+libc6@2.36-9+deb12u10
+libgcc-s1@12.2.0-14+deb12u1
+libgomp1@12.2.0-14+deb12u1
+libssl3@3.0.17-1~deb12u2
+libstdc++6@12.2.0-14+deb12u1
+libxmljs2@0.37.0
+liftup@3.0.1
+linebreak@1.1.0
+listenercount@1.0.1
+ljharb-monorepo-symlink-test@0.0.0
+locate-path@5.0.0
+lodash.camelcase@4.3.0
+lodash.isfinite@3.3.2
+lodash.set@4.3.2
+lodash@2.4.2
+lodash@4.17.21
+logform@2.7.0
+lolex@1.3.2
+loose-envify@1.4.0
+lowercase-keys@1.0.0
+lru-cache@10.4.3
+lru-cache@6.0.0
+make-dir@1.3.0
+make-dir@2.1.0
+make-error@1.3.6
+make-fetch-happen@14.0.3
+make-fetch-happen@9.1.0
+make-iterator@1.0.1
+make-plural@4.3.0
+make-plural@6.2.2
+map-cache@0.2.2
+map-visit@1.0.0
+marsdb@0.6.11
+math-interval-parser@2.0.1
+math-intrinsics@1.1.0
+median@0.0.2
+media-typer@0.3.0
+media-types@10.0.0
+merge-descriptors@1.0.3
+messageformat@2.3.0
+messageformat-formatters@2.0.1
+messageformat-parser@4.1.3
+methods@1.1.2
+micromatch@3.1.10
+micromatch@4.0.8
+mime@1.6.0
+mime-db@1.52.0
+mime-types@2.1.35
+mimic-response@1.0.1
+mimic-response@2.1.0
+mimic-response@3.1.0
+minami@1.1.1
+minimatch@3.0.5
+minimatch@3.0.8
+minimatch@3.1.2
+minimatch@5.1.6
+minimatch@9.0.5
+minimist@0.2.4
+minimist@1.2.8
+minipass@2.9.0
+minipass@3.3.6
+minipass@5.0.0
+minipass@7.1.2
+minipass-collect@1.0.2
+minipass-collect@2.0.1
+minipass-fetch@1.4.1
+minipass-fetch@4.0.1
+minipass-flush@1.0.5
+minipass-pipeline@1.2.4
+minipass-sized@1.0.3
+minizlib@1.3.3
+minizlib@2.1.2
+minizlib@3.0.2
+mixin-deep@1.3.2
+mkdirp@0.5.6
+mkdirp@1.0.4
+mkdirp@3.0.1
+mkdirp-classic@0.5.3
+moment@2.0.0
+moment@2.30.1
+moment-timezone@0.5.48
+morgan@1.10.1
+mout@1.2.4
+ms@2.0.0
+ms@2.1.3
+multer@1.4.5-lts.2
+mustache@4.2.0
+mylib@0.0.0
+nan@2.22.2
+nanomatch@1.2.13
+napi-build-utils@1.0.2
+napi-build-utils@2.0.0
+needle@2.9.1
+negotiator@0.6.3
+negotiator@0.6.4
+negotiator@1.0.0
+neo-async@2.6.2
+netbase@6.4
+node@22.18.0
+node-abi@2.30.1
+node-abi@3.77.0
+node-addon-api@7.1.1
+node-fetch@2.7.0
+node-gyp@11.4.2
+node-gyp@8.4.1
+node-pre-gyp@0.15.0
+noop-logger@0.1.1
+nopt@3.0.6
+nopt@4.0.3
+nopt@5.0.0
+nopt@8.1.0
+normalize-path@2.1.1
+normalize-path@3.0.0
+normalize-url@2.0.1
+notevil@1.3.3
+npm-bundled@1.1.2
+npmlog@4.1.2
+npmlog@6.0.2
+npm-normalize-package-bin@1.0.1
+npm-packlist@1.4.8
+number-is-nan@1.0.1
+nw-pre-gyp-module-test@0.0.1
+object.assign@4.1.7
+object.defaults@1.1.0
+object.map@1.0.1
+object.pick@1.3.0
+object-assign@4.1.1
+object-copy@0.1.0
+object-inspect@1.13.4
+object-is@1.1.6
+object-keys@1.1.1
+object-visit@1.0.1
+once@1.4.0
+one-time@1.0.0
+on-finished@2.3.0
+on-finished@2.4.1
+on-headers@1.1.0
+opentype.js@0.7.3
+osenv@0.1.5
+os-homedir@1.0.2
+os-tmpdir@1.0.2
+otplib@12.0.1
+package-json-from-dist@1.0.1
+pako@0.2.9
+parse-filepath@1.0.2
+parse-passwd@1.0.0
+parseurl@1.3.3
+pascalcase@0.1.1
+path-exists@4.0.0
+path-is-absolute@1.0.1
+path-key@3.1.1
+path-parse@1.0.7
+path-root@0.1.1
+path-root-regex@0.1.2
+path-scurry@1.11.1
+path-to-regexp@0.1.12
+p-cancelable@0.4.1
+pdfkit@0.11.0
+peek-readable@4.1.0
+pend@1.2.0
+p-event@2.3.1
+p-finally@1.0.0
+pg-connection-string@2.9.1
+picomatch@2.3.1
+picomatch@4.0.3
+pify@2.3.0
+pify@3.0.0
+pify@4.0.1
+pinkie@2.0.4
+pinkie-promise@2.0.1
+p-is-promise@1.1.0
+p-limit@2.3.0
+p-locate@4.1.0
+p-map@4.0.0
+p-map@7.0.3
+png-js@1.0.0
+posix-character-classes@0.1.1
+possible-typed-array-names@1.1.0
+prebuild-install@5.3.6
+prebuild-install@7.1.3
+prepend-http@2.0.0
+pretty-bytes@4.0.2
+process@0.11.10
+process-nextick-args@2.0.1
+proc-log@5.0.0
+prom-client@14.2.0
+promise@7.3.1
+promise-inflight@1.0.1
+promise-retry@2.0.1
+proper-lockfile@1.2.0
+proxy-addr@2.0.7
+p-timeout@2.0.1
+p-try@2.2.0
+pug@3.0.3
+pug-attrs@3.0.0
+pug-code-gen@3.0.3
+pug-error@2.1.0
+pug-filters@4.0.0
+pug-lexer@5.0.1
+pug-linker@4.0.0
+pug-load@3.0.0
+pug-parser@6.0.0
+pug-runtime@3.0.1
+pug-strip-comments@2.0.0
+pug-walk@2.0.0
+pump@3.0.3
+qs@6.13.0
+query-string@5.1.1
+range_check@2.0.4
+range-parser@1.2.1
+raw-body@2.5.2
+rc@1.2.8
+readable-stream@1.0.34
+readable-stream@2.3.8
+readable-stream@3.6.2
+readable-stream@4.7.0
+readable-web-to-node-stream@3.0.4
+readdirp@3.5.0
+rechoir@0.7.1
+recursedir-comparisons@0.0.0
+regex-not@1.0.2
+regexp.prototype.flags@1.5.4
+remove-trailing-separator@1.1.0
+repeat-element@1.1.4
+repeat-string@1.6.1
+replace@1.2.2
+require-directory@2.1.1
+require-main-filename@2.0.0
+resolve@1.22.10
+resolve-dir@1.0.1
+resolve-url@0.2.1
+responselike@1.0.2
+restructure@2.0.1
+ret@0.1.15
+retry@0.10.1
+retry@0.12.0
+retry-as-promised@7.1.1
+rimraf@2.7.1
+rimraf@3.0.2
+safe-buffer@5.1.2
+safe-buffer@5.2.1
+safer-buffer@2.1.2
+safe-regex@1.1.0
+safe-regex-test@1.1.0
+safe-stable-stringify@2.5.0
+samsam@1.1.2
+sanitize-filename@1.6.3
+sanitize-html@1.4.2
+sax@1.4.1
+seek-bzip@1.0.6
+semver@5.7.2
+semver@7.7.2
+send@0.19.0
+sequelize@6.37.7
+sequelize-pool@7.1.0
+serve-index@1.9.1
+serve-static@1.16.2
+set-blocking@2.0.0
+set-function-length@1.2.2
+set-function-name@2.0.2
+setimmediate@1.0.5
+setprototypeof@1.1.0
+setprototypeof@1.2.0
+set-value@2.0.1
+shebang-command@2.0.0
+shebang-regex@3.0.0
+side-channel@1.1.0
+side-channel-list@1.0.0
+side-channel-map@1.0.1
+side-channel-weakmap@1.0.2
+signal-exit@3.0.7
+signal-exit@4.1.0
+simple-concat@1.0.1
+simple-get@3.1.1
+simple-get@4.0.1
+simple-swizzle@0.2.2
+sinon@1.17.7
+smart-buffer@4.2.0
+snapdragon@0.8.2
+snapdragon-node@2.1.1
+snapdragon-util@3.0.1
+socket.io@3.1.2
+socket.io-adapter@2.1.0
+socket.io-parser@4.0.5
+socks@2.8.7
+socks-proxy-agent@6.2.1
+socks-proxy-agent@8.0.5
+sort-keys@1.1.2
+sort-keys@2.0.0
+sort-keys-length@1.0.1
+source-map@0.5.7
+source-map@0.6.1
+source-map-resolve@0.5.3
+source-map-support@0.5.21
+source-map-url@0.4.1
+split-string@3.1.0
+sprintf-js@1.0.3
+sprintf-js@1.1.3
+sqlite3@5.1.7
+ssri@12.0.0
+ssri@8.0.1
+stack-trace@0.0.10
+static-extend@0.1.2
+statuses@1.5.0
+statuses@2.0.1
+stop-iteration-iterator@1.1.0
+stream-buffers@2.2.0
+streamsearch@1.1.0
+strict-uri-encode@1.1.0
+string.fromcodepoint@0.2.1
+string.prototype.codepointat@0.2.1
+string_decoder@0.10.31
+string_decoder@1.1.1
+string_decoder@1.3.0
+string-width@1.0.2
+string-width@2.1.1
+string-width@4.2.3
+string-width@5.1.2
+strip-ansi@3.0.1
+strip-ansi@4.0.0
+strip-ansi@6.0.1
+strip-ansi@7.1.0
+strip-bom@3.0.0
+strip-dirs@2.1.0
+strip-json-comments@2.0.1
+strip-outer@1.0.1
+strtok3@6.3.0
+supports-color@2.0.0
+supports-color@5.5.0
+supports-color@7.2.0
+supports-preserve-symlinks-flag@1.0.0
+svg-captcha@1.4.0
+swagger-ui-dist@5.28.1
+swagger-ui-express@5.0.1
+tar@4.4.19
+tar@6.2.1
+tar@7.4.3
+tar-fs@2.1.3
+tar-stream@1.6.2
+tar-stream@2.2.0
+tdigest@0.1.2
+text-hex@1.0.0
+thirty-two@1.0.2
+through@2.3.8
+timed-out@4.0.1
+tinyglobby@0.2.14
+tiny-inflate@1.0.3
+to-buffer@1.2.1
+toidentifier@1.0.1
+token-stream@1.0.0
+token-types@4.2.1
+to-object-path@0.3.0
+to-regex@3.0.2
+to-regex-range@2.1.1
+to-regex-range@5.0.1
+tr46@0.0.3
+traverse@0.3.9
+tree-kill@1.2.2
+trim-repeated@1.0.0
+triple-beam@1.4.1
+truncate-utf8-bytes@1.0.2
+tsconfig@7.0.0
+tslib@2.7.0
+ts-node@9.1.1
+ts-node-dev@1.1.8
+tunnel-agent@0.6.0
+typecast@0.0.1
+typedarray@0.0.6
+typed-array-buffer@1.0.3
+type-is@1.6.18
+typescript@5.3.3
+tzdata@2025b-0+deb12u1
+uglify-js@3.19.3
+unbzip2-stream@1.4.3
+unc-path-regex@0.1.2
+underscore.string@3.3.6
+undici-types@6.19.8
+undici-types@6.21.0
+unicode-properties@1.4.1
+unicode-trie@2.0.0
+union-value@1.0.1
+unique-filename@1.1.1
+unique-filename@4.0.0
+unique-slug@2.0.2
+unique-slug@5.0.0
+unit-compare@1.0.1
+universalify@2.0.1
+unpipe@1.0.0
+unset-value@1.0.0
+untildify@2.1.0
+unzipper@0.9.15
+urix@0.1.0
+url-parse-lax@3.0.0
+url-to-options@1.0.1
+use@3.1.1
+utf8-byte-length@1.0.5
+util@0.12.5
+util-deprecate@1.0.2
+utils-merge@1.0.1
+uuid@8.3.2
+v8flags@3.2.0
+validate@4.5.1
+validator@13.15.15
+vary@1.1.2
+vm2@3.9.17
+void-elements@3.1.0
+walk@2.3.15
+walkdir@0.0.11
+web3@4.16.0
+web3-core@4.7.1
+web3-errors@1.3.1
+web3-eth@4.11.1
+web3-eth-abi@4.4.1
+web3-eth-accounts@4.3.1
+web3-eth-contract@4.7.2
+web3-eth-ens@4.4.0
+web3-eth-iban@4.0.7
+web3-eth-personal@4.1.0
+web3-net@4.1.0
+web3-providers-http@4.2.0
+web3-providers-ipc@4.0.7
+web3-providers-ws@4.0.8
+web3-rpc-methods@1.3.0
+web3-rpc-providers@1.0.0-rc.4
+web3-types@1.10.0
+web3-utils@4.3.3
+web3-validator@2.0.6
+webidl-conversions@3.0.1
+whatwg-url@5.0.0
+which@1.3.1
+which@2.0.2
+which@5.0.0
+which-boxed-primitive@1.1.1
+which-collection@1.0.2
+which-module@2.0.1
+which-pm-runs@1.1.0
+which-typed-array@1.1.19
+wide-align@1.1.3
+wide-align@1.1.5
+winston@3.17.0
+winston-transport@4.9.0
+with@7.0.2
+wkx@0.5.0
+wordwrap@0.0.3
+wordwrap@1.0.0
+wrap-ansi@6.2.0
+wrap-ansi@7.0.0
+wrap-ansi@8.1.0
+wrappy@1.0.2
+ws@7.4.6
+ws@8.17.1
+xtend@4.0.2
+y18n@4.0.3
+yallist@3.1.1
+yallist@4.0.0
+yallist@5.0.0
+yaml-schema-validator@1.2.3
+yargs@15.4.1
+yargs-parser@18.1.3
+yauzl@2.10.0
+yn@3.1.1
+z85@0.0.2
+zip-stream@1.2.0
+zod@3.25.76
diff --git a/labs/lab4/comparison/trivy-cves.txt b/labs/lab4/comparison/trivy-cves.txt
new file mode 100644
index 00000000..be29f082
--- /dev/null
+++ b/labs/lab4/comparison/trivy-cves.txt
@@ -0,0 +1,88 @@
+CVE-2010-4756
+CVE-2015-9235
+CVE-2016-1000223
+CVE-2016-1000237
+CVE-2016-4055
+CVE-2017-16016
+CVE-2017-18214
+CVE-2018-16487
+CVE-2018-20796
+CVE-2018-3721
+CVE-2019-1010022
+CVE-2019-1010023
+CVE-2019-1010024
+CVE-2019-1010025
+CVE-2019-10744
+CVE-2019-25225
+CVE-2019-9192
+CVE-2020-15084
+CVE-2020-8203
+CVE-2021-23337
+CVE-2021-23771
+CVE-2021-26539
+CVE-2021-26540
+CVE-2022-23539
+CVE-2022-23540
+CVE-2022-23541
+CVE-2022-24785
+CVE-2022-25881
+CVE-2022-25887
+CVE-2022-27943
+CVE-2022-33987
+CVE-2022-41940
+CVE-2023-32313
+CVE-2023-32314
+CVE-2023-32695
+CVE-2023-37466
+CVE-2023-37903
+CVE-2023-46233
+CVE-2024-21501
+CVE-2024-28863
+CVE-2024-29415
+CVE-2024-37890
+CVE-2024-38355
+CVE-2024-4067
+CVE-2024-4068
+CVE-2024-47764
+CVE-2025-12758
+CVE-2025-13465
+CVE-2025-15281
+CVE-2025-15284
+CVE-2025-15467
+CVE-2025-27587
+CVE-2025-47935
+CVE-2025-47944
+CVE-2025-4802
+CVE-2025-48997
+CVE-2025-56200
+CVE-2025-57349
+CVE-2025-59343
+CVE-2025-64718
+CVE-2025-64756
+CVE-2025-65945
+CVE-2025-68160
+CVE-2025-69418
+CVE-2025-69419
+CVE-2025-69420
+CVE-2025-69421
+CVE-2025-7338
+CVE-2025-8058
+CVE-2025-9230
+CVE-2025-9232
+CVE-2026-0861
+CVE-2026-0915
+CVE-2026-22709
+CVE-2026-22795
+CVE-2026-22796
+CVE-2026-23745
+CVE-2026-2391
+CVE-2026-23950
+CVE-2026-24001
+CVE-2026-24842
+CVE-2026-26960
+CVE-2026-26996
+GHSA-5mrr-rgp6-x4gr
+GHSA-rvg8-pwq2-xj7q
+NSWG-ECO-154
+NSWG-ECO-17
+NSWG-ECO-428
diff --git a/labs/lab4/comparison/trivy-packages.txt b/labs/lab4/comparison/trivy-packages.txt
new file mode 100644
index 00000000..2e6d6305
--- /dev/null
+++ b/labs/lab4/comparison/trivy-packages.txt
@@ -0,0 +1,997 @@
+@adraffy/ens-normalize@1.10.1
+@babel/helper-string-parser@7.27.1
+@babel/helper-validator-identifier@7.27.1
+@babel/parser@7.28.3
+@babel/types@7.28.2
+@colors/colors@1.6.0
+@dabh/diagnostics@2.0.3
+@ethereumjs/rlp@4.0.1
+@ethereumjs/rlp@5.0.2
+@gar/promisify@1.1.3
+@isaacs/cliui@8.0.2
+@isaacs/fs-minipass@4.0.1
+@my-scope/package-a@0.0.0
+@my-scope/package-b@0.0.0
+@nlpjs/core@4.26.1
+@nlpjs/core-loader@4.26.1
+@nlpjs/evaluator@4.26.1
+@nlpjs/lang-en@4.26.1
+@nlpjs/lang-en-min@4.26.1
+@nlpjs/language@4.25.0
+@nlpjs/language-min@4.25.0
+@nlpjs/ner@4.27.0
+@nlpjs/neural@4.25.0
+@nlpjs/nlg@4.26.1
+@nlpjs/nlp@4.27.0
+@nlpjs/nlu@4.27.0
+@nlpjs/request@4.25.0
+@nlpjs/sentiment@4.26.1
+@nlpjs/similarity@4.26.1
+@nlpjs/slot@4.26.1
+@noble/curves@1.2.0
+@noble/curves@1.4.2
+@noble/hashes@1.3.2
+@noble/hashes@1.4.0
+@npmcli/agent@3.0.0
+@npmcli/fs@1.1.1
+@npmcli/fs@4.0.0
+@npmcli/move-file@1.1.2
+@otplib/core@12.0.1
+@otplib/plugin-crypto@12.0.1
+@otplib/plugin-thirty-two@12.0.1
+@otplib/preset-default@12.0.1
+@otplib/preset-v11@12.0.1
+@pkgjs/parseargs@0.11.0
+@scarf/scarf@1.4.0
+@scure/base@1.1.9
+@scure/bip32@1.4.0
+@scure/bip39@1.3.0
+@sindresorhus/is@0.7.0
+@swc/helpers@0.3.17
+@tokenizer/token@0.3.0
+@tootallnate/once@1.1.2
+@tootallnate/once@2.0.0
+@types/component-emitter@1.2.14
+@types/cookie@0.4.1
+@types/cors@2.8.19
+@types/debug@4.1.12
+@types/ms@2.1.0
+@types/node@20.19.12
+@types/node@22.7.5
+@types/strip-bom@3.0.0
+@types/strip-json-comments@0.0.30
+@types/triple-beam@1.3.5
+@types/validator@13.15.3
+@types/ws@8.5.3
+1to2@1.0.0
+abbrev@1.1.1
+abbrev@3.0.1
+abitype@0.7.1
+abort-controller@3.0.0
+accepts@1.3.8
+acorn@7.4.1
+acorn@8.15.0
+acorn-walk@8.3.4
+aes-js@4.0.0-beta.5
+agent-base@6.0.2
+agent-base@7.1.4
+agentkeepalive@4.6.0
+aggregate-error@3.1.0
+ansi-regex@2.1.1
+ansi-regex@3.0.1
+ansi-regex@5.0.1
+ansi-regex@6.2.0
+ansi-styles@2.2.1
+ansi-styles@3.2.1
+ansi-styles@4.3.0
+ansi-styles@6.2.1
+anymatch@3.1.3
+append-field@1.0.0
+aproba@1.2.0
+archiver@1.3.0
+archiver-utils@1.3.0
+archive-type@4.0.0
+are-we-there-yet@1.1.7
+are-we-there-yet@3.0.1
+arg@4.1.3
+argparse@1.0.10
+array-buffer-byte-length@1.0.2
+array-each@1.0.1
+array-flatten@1.1.1
+array-slice@1.1.0
+array-unique@0.3.2
+arr-diff@4.0.0
+arr-flatten@1.1.0
+arr-union@3.1.0
+asap@2.0.6
+assert-never@1.4.0
+assign-symbols@1.0.0
+async@2.6.4
+async@3.2.6
+at-least-node@1.0.0
+atob@2.1.2
+available-typed-arrays@1.0.7
+babel-walk@3.0.0-canary-5
+balanced-match@1.0.2
+base@0.11.2
+base64-arraybuffer@0.1.4
+base64id@2.0.0
+base64-js@0.0.8
+base64-js@1.5.1
+base64url@0.0.6
+base-files@12.4+deb12u11
+basic-auth@2.0.1
+batch@0.6.1
+beep-boop@1.2.3
+big-integer@1.6.52
+binary@0.3.0
+binary-extensions@2.3.0
+bindings@1.5.0
+bintrees@1.0.2
+bl@1.2.3
+bl@4.1.0
+bluebird@3.4.7
+bluebird@3.7.2
+body-parser@1.20.3
+bower-config@1.4.3
+brace-expansion@1.1.12
+brace-expansion@2.0.2
+braces@2.3.2
+braces@3.0.3
+brotli@1.3.3
+buffer@5.7.1
+buffer@6.0.3
+buffer-alloc@1.2.0
+buffer-alloc-unsafe@1.1.0
+buffer-crc32@0.2.13
+buffer-fill@1.0.0
+buffer-from@1.1.2
+buffer-indexof-polyfill@1.0.2
+buffers@0.1.1
+busboy@1.6.0
+byline@4.2.2
+bytes@3.1.2
+cacache@15.3.0
+cacache@19.0.1
+cacheable-request@2.1.4
+cache-base@1.0.1
+call-bind@1.0.8
+call-bind-apply-helpers@1.0.2
+call-bound@1.0.4
+camelcase@5.3.1
+chainsaw@0.1.0
+chalk@1.1.3
+chalk@2.4.2
+chalk@4.1.2
+character-parser@2.2.0
+check-dependencies@1.1.1
+check-internet-connected@2.0.6
+check-types@6.0.0
+chokidar@3.5.1
+chownr@1.1.4
+chownr@2.0.0
+chownr@3.0.0
+clarinet@0.12.6
+class-utils@0.3.6
+clean-stack@2.2.0
+cliui@6.0.0
+clone@2.1.2
+clone-response@1.0.2
+code-point-at@1.1.0
+collection-visit@1.0.0
+color@3.2.1
+color-convert@1.9.3
+color-convert@2.0.1
+color-name@1.1.3
+color-name@1.1.4
+colors@1.1.2
+colors@1.4.0
+colorspace@1.1.4
+color-string@1.9.1
+color-support@1.1.3
+commander@2.20.3
+component-emitter@1.3.1
+component-type@1.2.1
+compress-commons@1.2.2
+compressible@2.0.18
+compression@1.8.1
+concat-map@0.0.1
+concat-stream@1.6.2
+config@3.3.12
+console-control-strings@1.1.0
+constantinople@4.0.1
+content-disposition@0.5.4
+content-type@1.0.5
+cookie@0.4.2
+cookie@0.7.1
+cookie@0.7.2
+cookie-parser@1.4.7
+cookie-signature@1.0.6
+copy-descriptor@0.1.1
+core-util-is@1.0.2
+cors@2.8.5
+crc@3.8.0
+crc-32@1.2.2
+crc32-stream@2.0.0
+create-require@1.1.1
+cross-fetch@4.1.0
+cross-fetch-polyfill@0.0.0
+cross-spawn@7.0.6
+crypto-js@3.3.0
+dateformat@4.6.3
+debug@2.6.9
+debug@3.2.7
+debug@4.3.7
+decamelize@1.2.0
+decode-uri-component@0.2.2
+decompress@4.2.1
+decompress-response@3.3.0
+decompress-response@4.2.1
+decompress-response@6.0.0
+decompress-tar@4.1.1
+decompress-tarbz2@4.1.1
+decompress-targz@4.1.1
+decompress-unzip@4.0.1
+deep-equal@2.2.3
+deep-extend@0.6.0
+define-data-property@1.1.4
+define-properties@1.2.1
+define-property@0.2.5
+define-property@1.0.0
+define-property@2.0.2
+delegates@1.0.0
+depd@1.1.2
+depd@2.0.0
+destroy@1.2.0
+detect-file@1.0.0
+detect-libc@1.0.3
+detect-libc@2.0.4
+dfa@1.2.0
+diff@4.0.2
+doctypes@1.1.0
+domelementtype@1.3.1
+domhandler@2.1.0
+domutils@1.1.6
+dottie@2.0.6
+double-ended-queue@0.9.7
+download@8.0.0
+dunder-proto@1.0.1
+duplexer2@0.1.4
+duplexer3@0.1.5
+dynamic-dedupe@0.3.0
+eastasianwidth@0.2.0
+ee-first@1.1.1
+eivindfjeldstad-dot@0.0.1
+emoji-regex@8.0.0
+emoji-regex@9.2.2
+enabled@2.0.0
+encodeurl@1.0.2
+encodeurl@2.0.0
+encoding@0.1.13
+end-of-stream@1.4.5
+engine.io@4.1.2
+engine.io-parser@4.0.3
+env-paths@2.2.1
+err-code@1.1.2
+err-code@2.0.3
+errorhandler@1.5.1
+escape-html@1.0.3
+escape-string-regexp@1.0.5
+escodegen@2.1.0
+es-define-property@1.0.1
+es-errors@1.3.0
+es-get-iterator@1.1.3
+es-object-atoms@1.1.1
+esprima@1.0.4
+esprima@4.0.1
+estraverse@5.3.0
+esutils@2.0.3
+etag@1.8.1
+ethereum-cryptography@2.2.1
+ethers@6.15.0
+eventemitter2@0.4.14
+eventemitter3@1.1.1
+eventemitter3@5.0.1
+events@3.3.0
+event-target-shim@5.0.1
+exit@0.1.2
+expand-brackets@2.1.4
+expand-template@2.0.3
+expand-tilde@2.0.2
+exponential-backoff@3.1.2
+express@4.21.2
+express-ipfilter@1.3.2
+express-jwt@0.1.3
+express-rate-limit@7.5.1
+express-robots-txt@0.4.1
+express-security.txt@2.0.0
+extend@3.0.2
+extend-shallow@2.0.1
+extend-shallow@3.0.2
+extglob@2.0.4
+ext-list@2.2.2
+ext-name@5.0.0
+fast.js@0.1.1
+fdir@6.5.0
+fd-slicer@1.1.0
+feature-policy@0.5.0
+fecha@4.2.3
+filehound@1.17.6
+file-js@0.3.0
+filename-reserved-regex@2.0.0
+filenamify@3.0.0
+filesniffer@1.0.3
+file-stream-rotator@1.0.0
+file-type@11.1.0
+file-type@16.5.4
+file-type@3.9.0
+file-type@4.4.0
+file-type@5.2.0
+file-type@6.2.0
+file-uri-to-path@1.0.0
+fill-range@4.0.0
+fill-range@7.1.1
+finale-rest@1.2.2
+finalhandler@1.3.1
+find-up@4.1.0
+findup-sync@2.0.0
+findup-sync@4.0.0
+findup-sync@5.0.0
+fined@1.2.0
+flagged-respawn@1.0.1
+fn.name@1.1.0
+fontkit@1.9.0
+for-each@0.3.5
+foreachasync@3.0.0
+foreground-child@3.3.1
+for-in@1.0.2
+formatio@1.1.1
+for-own@1.0.0
+forwarded@0.2.0
+fragment-cache@0.2.1
+fresh@0.5.2
+from2@2.3.0
+frontend@19.0.0
+fs.realpath@1.0.0
+fs-constants@1.0.0
+fs-extra@9.1.0
+fs-minipass@1.2.7
+fs-minipass@2.1.0
+fs-minipass@3.0.3
+fstream@1.0.12
+function-bind@1.1.2
+functions-have-names@1.2.3
+fuzzball@1.4.0
+gauge@2.7.4
+gauge@4.0.4
+gcc-12-base@12.2.0
+geojson-utils@1.1.0
+get-caller-file@2.0.5
+get-intrinsic@1.3.0
+getobject@1.0.2
+get-proto@1.0.1
+get-stream@2.3.1
+get-stream@3.0.0
+get-stream@4.1.0
+get-value@2.0.6
+github-from-package@0.0.0
+glob@10.4.5
+glob@7.1.7
+glob@7.2.3
+global-modules@1.0.0
+global-prefix@1.0.2
+glob-parent@5.1.2
+gopd@1.2.0
+got@8.3.2
+graceful-fs@4.2.11
+grunt@1.6.1
+grunt-cli@1.4.3
+grunt-contrib-compress@1.6.0
+grunt-known-options@2.0.0
+grunt-legacy-log@3.0.0
+grunt-legacy-log-utils@2.1.0
+grunt-legacy-util@2.0.1
+grunt-replace-json@0.1.0
+handlebars@4.7.7
+has-ansi@2.0.0
+has-bigints@1.1.0
+has-flag@3.0.0
+has-flag@4.0.0
+hashids@2.3.0
+hasown@2.0.2
+has-property-descriptors@1.0.2
+has-symbols@1.1.0
+has-symbol-support-x@1.4.2
+has-tostringtag@1.0.2
+has-to-string-tag-x@1.4.1
+has-unicode@2.0.1
+has-value@0.3.1
+has-value@1.0.0
+has-values@0.1.4
+has-values@1.0.0
+hbs@4.2.0
+he@0.4.1
+heap@0.2.7
+helmet@4.6.0
+hoister@0.0.2
+homedir-polyfill@1.0.3
+hooker@0.2.3
+html-entities@1.4.0
+htmlparser2@3.3.0
+http-cache-semantics@3.8.1
+http-cache-semantics@4.2.0
+http-errors@1.6.3
+http-errors@2.0.0
+http-proxy-agent@4.0.1
+http-proxy-agent@5.0.0
+http-proxy-agent@7.0.2
+https-proxy-agent@5.0.1
+https-proxy-agent@7.0.6
+humanize-ms@1.2.1
+i18n@0.11.1
+iconv-lite@0.4.24
+iconv-lite@0.6.3
+ieee754@1.2.1
+ignore-walk@3.0.4
+iltorb@2.4.5
+imurmurhash@0.1.4
+indent-string@4.0.0
+infer-owner@1.0.4
+inflection@1.13.4
+inflight@1.0.6
+inherits@2.0.3
+inherits@2.0.4
+ini@1.3.8
+internal-slot@1.1.0
+interpret@1.1.0
+into-stream@3.1.0
+invariant@2.2.4
+ip@2.0.1
+ip6@0.2.11
+ipaddr.js@1.9.1
+ip-address@10.0.1
+is-absolute@1.0.0
+is-accessor-descriptor@1.0.1
+is-arguments@1.2.0
+isarray@0.0.1
+isarray@1.0.0
+isarray@2.0.5
+is-array-buffer@3.0.5
+is-arrayish@0.3.2
+is-bigint@1.1.0
+is-binary-path@2.1.0
+is-boolean-object@1.2.2
+is-buffer@1.1.6
+is-callable@1.2.7
+is-core-module@2.16.1
+is-data-descriptor@1.0.1
+is-date-object@1.1.0
+is-descriptor@0.1.7
+is-descriptor@1.0.3
+isexe@2.0.0
+isexe@3.1.1
+is-expression@4.0.0
+is-extendable@0.1.1
+is-extendable@1.0.1
+is-extglob@2.1.1
+is-fullwidth-code-point@1.0.0
+is-fullwidth-code-point@2.0.0
+is-fullwidth-code-point@3.0.0
+is-generator-function@1.1.0
+is-glob@3.1.0
+is-glob@4.0.3
+is-lambda@1.0.1
+is-map@2.0.3
+is-natural-number@4.0.1
+is-number@3.0.0
+is-number@7.0.0
+is-number-like@1.0.8
+is-number-object@1.1.1
+is-object@1.0.2
+isobject@2.1.0
+isobject@3.0.1
+isomorphic-ws@5.0.0
+is-plain-obj@1.1.0
+is-plain-object@2.0.4
+is-promise@2.2.2
+is-regex@1.2.1
+is-relative@1.0.0
+is-retry-allowed@1.2.0
+is-set@2.0.3
+is-shared-array-buffer@1.0.4
+is-stream@1.1.0
+is-stream@2.0.1
+is-string@1.1.1
+is-symbol@1.1.1
+is-typed-array@1.1.15
+is-unc-path@1.0.0
+isurl@1.0.0
+is-weakmap@2.0.2
+is-weakset@2.0.4
+is-windows@1.0.2
+jackspeak@3.4.3
+json5@2.2.3
+json-buffer@3.0.0
+jsonfile@6.2.0
+jsonwebtoken@0.1.0
+jsonwebtoken@0.4.0
+jssha@3.3.1
+js-stringify@1.0.2
+js-tokens@4.0.0
+jstransformer@1.0.0
+js-yaml@3.14.1
+juice-shop@19.0.0
+juicy-chat-bot@0.9.0
+jwa@0.0.1
+jws@0.2.6
+keyv@3.0.0
+kind-of@3.2.2
+kind-of@4.0.0
+kind-of@6.0.3
+kuler@2.0.0
+lazystream@1.0.1
+libc6@2.36
+libgcc-s1@12.2.0
+libgomp1@12.2.0
+libssl3@3.0.17
+libstdc++6@12.2.0
+libxmljs2@0.37.0
+liftup@3.0.1
+linebreak@1.1.0
+listenercount@1.0.1
+ljharb-monorepo-symlink-test@0.0.0
+locate-path@5.0.0
+lodash.camelcase@4.3.0
+lodash.isfinite@3.3.2
+lodash.set@4.3.2
+lodash@2.4.2
+lodash@4.17.21
+logform@2.7.0
+lolex@1.3.2
+loose-envify@1.4.0
+lowercase-keys@1.0.0
+lru-cache@10.4.3
+lru-cache@6.0.0
+make-dir@1.3.0
+make-dir@2.1.0
+make-error@1.3.6
+make-fetch-happen@14.0.3
+make-fetch-happen@9.1.0
+make-iterator@1.0.1
+make-plural@4.3.0
+make-plural@6.2.2
+map-cache@0.2.2
+map-visit@1.0.0
+marsdb@0.6.11
+math-interval-parser@2.0.1
+math-intrinsics@1.1.0
+median@0.0.2
+media-typer@0.3.0
+media-types@10.0.0
+merge-descriptors@1.0.3
+messageformat@2.3.0
+messageformat-formatters@2.0.1
+messageformat-parser@4.1.3
+methods@1.1.2
+micromatch@3.1.10
+micromatch@4.0.8
+mime@1.6.0
+mime-db@1.52.0
+mime-types@2.1.35
+mimic-response@1.0.1
+mimic-response@2.1.0
+mimic-response@3.1.0
+minami@1.1.1
+minimatch@3.0.5
+minimatch@3.0.8
+minimatch@3.1.2
+minimatch@5.1.6
+minimatch@9.0.5
+minimist@0.2.4
+minimist@1.2.8
+minipass@2.9.0
+minipass@3.3.6
+minipass@5.0.0
+minipass@7.1.2
+minipass-collect@1.0.2
+minipass-collect@2.0.1
+minipass-fetch@1.4.1
+minipass-fetch@4.0.1
+minipass-flush@1.0.5
+minipass-pipeline@1.2.4
+minipass-sized@1.0.3
+minizlib@1.3.3
+minizlib@2.1.2
+minizlib@3.0.2
+mixin-deep@1.3.2
+mkdirp@0.5.6
+mkdirp@1.0.4
+mkdirp@3.0.1
+mkdirp-classic@0.5.3
+moment@2.0.0
+moment@2.30.1
+moment-timezone@0.5.48
+morgan@1.10.1
+mout@1.2.4
+ms@2.0.0
+ms@2.1.3
+multer@1.4.5-lts.2
+mustache@4.2.0
+mylib@0.0.0
+nan@2.22.2
+nanomatch@1.2.13
+napi-build-utils@1.0.2
+napi-build-utils@2.0.0
+needle@2.9.1
+negotiator@0.6.3
+negotiator@0.6.4
+negotiator@1.0.0
+neo-async@2.6.2
+netbase@6.4
+node-abi@2.30.1
+node-abi@3.77.0
+node-addon-api@7.1.1
+node-fetch@2.7.0
+node-gyp@11.4.2
+node-gyp@8.4.1
+node-pre-gyp@0.15.0
+noop-logger@0.1.1
+nopt@3.0.6
+nopt@4.0.3
+nopt@5.0.0
+nopt@8.1.0
+normalize-path@2.1.1
+normalize-path@3.0.0
+normalize-url@2.0.1
+notevil@1.3.3
+npm-bundled@1.1.2
+npmlog@4.1.2
+npmlog@6.0.2
+npm-normalize-package-bin@1.0.1
+npm-packlist@1.4.8
+number-is-nan@1.0.1
+nw-pre-gyp-module-test@0.0.1
+object.assign@4.1.7
+object.defaults@1.1.0
+object.map@1.0.1
+object.pick@1.3.0
+object-assign@4.1.1
+object-copy@0.1.0
+object-inspect@1.13.4
+object-is@1.1.6
+object-keys@1.1.1
+object-visit@1.0.1
+once@1.4.0
+one-time@1.0.0
+on-finished@2.3.0
+on-finished@2.4.1
+on-headers@1.1.0
+opentype.js@0.7.3
+osenv@0.1.5
+os-homedir@1.0.2
+os-tmpdir@1.0.2
+otplib@12.0.1
+package-json-from-dist@1.0.1
+pako@0.2.9
+parse-filepath@1.0.2
+parse-passwd@1.0.0
+parseurl@1.3.3
+pascalcase@0.1.1
+path-exists@4.0.0
+path-is-absolute@1.0.1
+path-key@3.1.1
+path-parse@1.0.7
+path-root@0.1.1
+path-root-regex@0.1.2
+path-scurry@1.11.1
+path-to-regexp@0.1.12
+p-cancelable@0.4.1
+pdfkit@0.11.0
+peek-readable@4.1.0
+pend@1.2.0
+p-event@2.3.1
+p-finally@1.0.0
+pg-connection-string@2.9.1
+picomatch@2.3.1
+picomatch@4.0.3
+pify@2.3.0
+pify@3.0.0
+pify@4.0.1
+pinkie@2.0.4
+pinkie-promise@2.0.1
+p-is-promise@1.1.0
+p-limit@2.3.0
+p-locate@4.1.0
+p-map@4.0.0
+p-map@7.0.3
+png-js@1.0.0
+portscanner@2.2.0
+posix-character-classes@0.1.1
+possible-typed-array-names@1.1.0
+prebuild-install@5.3.6
+prebuild-install@7.1.3
+prepend-http@2.0.0
+pretty-bytes@4.0.2
+process@0.11.10
+process-nextick-args@2.0.1
+proc-log@5.0.0
+prom-client@14.2.0
+promise@7.3.1
+promise-inflight@1.0.1
+promise-retry@2.0.1
+proper-lockfile@1.2.0
+proxy-addr@2.0.7
+p-timeout@2.0.1
+p-try@2.2.0
+pug@3.0.3
+pug-attrs@3.0.0
+pug-code-gen@3.0.3
+pug-error@2.1.0
+pug-filters@4.0.0
+pug-lexer@5.0.1
+pug-linker@4.0.0
+pug-load@3.0.0
+pug-parser@6.0.0
+pug-runtime@3.0.1
+pug-strip-comments@2.0.0
+pug-walk@2.0.0
+pump@3.0.3
+qs@6.13.0
+query-string@5.1.1
+range_check@2.0.4
+range-parser@1.2.1
+raw-body@2.5.2
+rc@1.2.8
+readable-stream@1.0.34
+readable-stream@2.3.8
+readable-stream@3.6.2
+readable-stream@4.7.0
+readable-web-to-node-stream@3.0.4
+readdirp@3.5.0
+rechoir@0.7.1
+recursedir-comparisons@0.0.0
+regex-not@1.0.2
+regexp.prototype.flags@1.5.4
+remove-trailing-separator@1.1.0
+repeat-element@1.1.4
+repeat-string@1.6.1
+replace@1.2.2
+require-directory@2.1.1
+require-main-filename@2.0.0
+resolve@1.22.10
+resolve-dir@1.0.1
+resolve-url@0.2.1
+responselike@1.0.2
+restructure@2.0.1
+ret@0.1.15
+retry@0.10.1
+retry@0.12.0
+retry-as-promised@7.1.1
+rimraf@2.7.1
+rimraf@3.0.2
+safe-buffer@5.1.2
+safe-buffer@5.2.1
+safer-buffer@2.1.2
+safe-regex@1.1.0
+safe-regex-test@1.1.0
+safe-stable-stringify@2.5.0
+samsam@1.1.2
+sanitize-filename@1.6.3
+sanitize-html@1.4.2
+sax@1.4.1
+seek-bzip@1.0.6
+semver@5.7.2
+semver@7.7.2
+send@0.19.0
+sequelize@6.37.7
+sequelize-pool@7.1.0
+serve-index@1.9.1
+serve-static@1.16.2
+set-blocking@2.0.0
+set-function-length@1.2.2
+set-function-name@2.0.2
+setimmediate@1.0.5
+setprototypeof@1.1.0
+setprototypeof@1.2.0
+set-value@2.0.1
+shebang-command@2.0.0
+shebang-regex@3.0.0
+side-channel@1.1.0
+side-channel-list@1.0.0
+side-channel-map@1.0.1
+side-channel-weakmap@1.0.2
+signal-exit@3.0.7
+signal-exit@4.1.0
+simple-concat@1.0.1
+simple-get@3.1.1
+simple-get@4.0.1
+simple-swizzle@0.2.2
+sinon@1.17.7
+smart-buffer@4.2.0
+snapdragon@0.8.2
+snapdragon-node@2.1.1
+snapdragon-util@3.0.1
+socket.io@3.1.2
+socket.io-adapter@2.1.0
+socket.io-parser@4.0.5
+socks@2.8.7
+socks-proxy-agent@6.2.1
+socks-proxy-agent@8.0.5
+sort-keys@1.1.2
+sort-keys@2.0.0
+sort-keys-length@1.0.1
+source-map@0.5.7
+source-map@0.6.1
+source-map-resolve@0.5.3
+source-map-support@0.5.21
+source-map-url@0.4.1
+split-string@3.1.0
+sprintf-js@1.0.3
+sprintf-js@1.1.3
+sqlite3@5.1.7
+ssri@12.0.0
+ssri@8.0.1
+stack-trace@0.0.10
+static-extend@0.1.2
+statuses@1.5.0
+statuses@2.0.1
+stop-iteration-iterator@1.1.0
+stream-buffers@2.2.0
+streamsearch@1.1.0
+strict-uri-encode@1.1.0
+string.fromcodepoint@0.2.1
+string.prototype.codepointat@0.2.1
+string_decoder@0.10.31
+string_decoder@1.1.1
+string_decoder@1.3.0
+string-width@1.0.2
+string-width@2.1.1
+string-width@4.2.3
+string-width@5.1.2
+strip-ansi@3.0.1
+strip-ansi@4.0.0
+strip-ansi@6.0.1
+strip-ansi@7.1.0
+strip-bom@3.0.0
+strip-dirs@2.1.0
+strip-json-comments@2.0.1
+strip-outer@1.0.1
+strtok3@6.3.0
+supports-color@2.0.0
+supports-color@5.5.0
+supports-color@7.2.0
+supports-preserve-symlinks-flag@1.0.0
+svg-captcha@1.4.0
+swagger-ui-dist@5.28.1
+swagger-ui-express@5.0.1
+tar@4.4.19
+tar@6.2.1
+tar@7.4.3
+tar-fs@2.1.3
+tar-stream@1.6.2
+tar-stream@2.2.0
+tdigest@0.1.2
+text-hex@1.0.0
+thirty-two@1.0.2
+through@2.3.8
+timed-out@4.0.1
+tinyglobby@0.2.14
+tiny-inflate@1.0.3
+to-buffer@1.2.1
+toidentifier@1.0.1
+token-stream@1.0.0
+token-types@4.2.1
+to-object-path@0.3.0
+toposort-class@1.0.1
+to-regex@3.0.2
+to-regex-range@2.1.1
+to-regex-range@5.0.1
+tr46@0.0.3
+traverse@0.3.9
+tree-kill@1.2.2
+trim-repeated@1.0.0
+triple-beam@1.4.1
+truncate-utf8-bytes@1.0.2
+tsconfig@7.0.0
+tslib@2.7.0
+ts-node@9.1.1
+ts-node-dev@1.1.8
+tunnel-agent@0.6.0
+typecast@0.0.1
+typedarray@0.0.6
+typed-array-buffer@1.0.3
+type-is@1.6.18
+typescript@5.3.3
+tzdata@2025b
+uglify-js@3.19.3
+unbzip2-stream@1.4.3
+unc-path-regex@0.1.2
+underscore.string@3.3.6
+undici-types@6.19.8
+undici-types@6.21.0
+unicode-properties@1.4.1
+unicode-trie@2.0.0
+union-value@1.0.1
+unique-filename@1.1.1
+unique-filename@4.0.0
+unique-slug@2.0.2
+unique-slug@5.0.0
+unit-compare@1.0.1
+universalify@2.0.1
+unpipe@1.0.0
+unset-value@1.0.0
+untildify@2.1.0
+unzipper@0.9.15
+urix@0.1.0
+url-parse-lax@3.0.0
+url-to-options@1.0.1
+use@3.1.1
+utf8-byte-length@1.0.5
+util@0.12.5
+util-deprecate@1.0.2
+utils-merge@1.0.1
+uuid@8.3.2
+v8flags@3.2.0
+validate@4.5.1
+validator@13.15.15
+vary@1.1.2
+vm2@3.9.17
+void-elements@3.1.0
+walk@2.3.15
+walkdir@0.0.11
+web3@4.16.0
+web3-core@4.7.1
+web3-errors@1.3.1
+web3-eth@4.11.1
+web3-eth-abi@4.4.1
+web3-eth-accounts@4.3.1
+web3-eth-contract@4.7.2
+web3-eth-ens@4.4.0
+web3-eth-iban@4.0.7
+web3-eth-personal@4.1.0
+web3-net@4.1.0
+web3-providers-http@4.2.0
+web3-providers-ipc@4.0.7
+web3-providers-ws@4.0.8
+web3-rpc-methods@1.3.0
+web3-rpc-providers@1.0.0-rc.4
+web3-types@1.10.0
+web3-utils@4.3.3
+web3-validator@2.0.6
+webidl-conversions@3.0.1
+whatwg-url@5.0.0
+which@1.3.1
+which@2.0.2
+which@5.0.0
+which-boxed-primitive@1.1.1
+which-collection@1.0.2
+which-module@2.0.1
+which-pm-runs@1.1.0
+which-typed-array@1.1.19
+wide-align@1.1.3
+wide-align@1.1.5
+winston@3.17.0
+winston-transport@4.9.0
+with@7.0.2
+wkx@0.5.0
+wordwrap@0.0.3
+wordwrap@1.0.0
+wrap-ansi@6.2.0
+wrap-ansi@7.0.0
+wrap-ansi@8.1.0
+wrappy@1.0.2
+ws@7.4.6
+ws@8.17.1
+xtend@4.0.2
+y18n@4.0.3
+yallist@3.1.1
+yallist@4.0.0
+yallist@5.0.0
+yaml-schema-validator@1.2.3
+yargs@15.4.1
+yargs-parser@18.1.3
+yauzl@2.10.0
+yn@3.1.1
+z85@0.0.2
+zip-stream@1.2.0
+zod@3.25.76
diff --git a/labs/lab4/syft/grype-vuln-results.json b/labs/lab4/syft/grype-vuln-results.json
new file mode 100644
index 00000000..02452be3
--- /dev/null
+++ b/labs/lab4/syft/grype-vuln-results.json
@@ -0,0 +1 @@
+{"matches":[{"vulnerability":{"id":"GHSA-2p57-rm9w-gvfp","dataSource":"https://github.com/advisories/GHSA-2p57-rm9w-gvfp","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-29415","https://github.com/indutny/node-ip/issues/150","https://github.com/indutny/node-ip/pull/143","https://github.com/indutny/node-ip/pull/144","https://security.netapp.com/advisory/ntap-20250117-0010"],"description":"ip SSRF improper categorization in isPublic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29415","epss":0.86505,"percentile":0.99395,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-29415","cwe":"CWE-918","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2024-29415","cwe":"CWE-941","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":67.4739},"relatedVulnerabilities":[{"id":"CVE-2024-29415","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29415","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/indutny/node-ip/issues/150","https://github.com/indutny/node-ip/pull/143","https://github.com/indutny/node-ip/pull/144","https://security.netapp.com/advisory/ntap-20250117-0010/"],"description":"The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29415","epss":0.86505,"percentile":0.99395,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-29415","cwe":"CWE-918","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2024-29415","cwe":"CWE-941","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-2p57-rm9w-gvfp","versionConstraint":"<=2.0.1 (semantic)"}}],"artifact":{"id":"80c437d1f8f690a8","name":"ip","version":"2.0.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/ip/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ip/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fedorindutny:ip:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-whpj-8f3w-67p5","dataSource":"https://github.com/advisories/GHSA-whpj-8f3w-67p5","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5","https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf","https://github.com/patriksimek/vm2/releases/tag/3.9.18","https://nvd.nist.gov/vuln/detail/CVE-2023-32314","https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac"],"description":"vm2 Sandbox Escape vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32314","epss":0.69875,"percentile":0.9863,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-32314","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.9.18"],"state":"fixed","available":[{"version":"3.9.18","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":65.6825},"relatedVulnerabilities":[{"id":"CVE-2023-32314","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32314","namespace":"nvd:cpe","severity":"Critical","urls":["https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac","https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf","https://github.com/patriksimek/vm2/releases/tag/3.9.18","https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5"],"description":"vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32314","epss":0.69875,"percentile":0.9863,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-32314","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-whpj-8f3w-67p5","versionConstraint":"<3.9.18 (semantic)"},"fix":{"suggestedVersion":"3.9.18"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-g644-9gfx-q4q4","dataSource":"https://github.com/advisories/GHSA-g644-9gfx-q4q4","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4","https://nvd.nist.gov/vuln/detail/CVE-2023-37903","https://security.netapp.com/advisory/ntap-20230831-0007","https://security.netapp.com/advisory/ntap-20241108-0002"],"description":"vm2 Sandbox Escape vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37903","epss":0.39234,"percentile":0.9719,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-37903","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-37903","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":36.879960000000004},"relatedVulnerabilities":[{"id":"CVE-2023-37903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37903","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4","https://security.netapp.com/advisory/ntap-20230831-0007/","https://security.netapp.com/advisory/ntap-20241108-0002/"],"description":"vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37903","epss":0.39234,"percentile":0.9719,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-37903","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-37903","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-g644-9gfx-q4q4","versionConstraint":"<=3.9.19 (semantic)"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-c7hr-j4mj-j2w6","dataSource":"https://github.com/advisories/GHSA-c7hr-j4mj-j2w6","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-9235","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://www.npmjs.com/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html"],"description":"Verification Bypass in jsonwebtoken","cvss":[],"epss":[{"cve":"CVE-2015-9235","epss":0.3247,"percentile":0.96748,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2015-9235","cwe":"CWE-20","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2015-9235","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.2"],"state":"fixed","available":[{"version":"4.2.2","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":29.223},"relatedVulnerabilities":[{"id":"CVE-2015-9235","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-9235","namespace":"nvd:cpe","severity":"Critical","urls":["https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://nodesecurity.io/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html"],"description":"In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-9235","epss":0.3247,"percentile":0.96748,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2015-9235","cwe":"CWE-20","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2015-9235","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-c7hr-j4mj-j2w6","versionConstraint":"<4.2.2 (semantic)"},"fix":{"suggestedVersion":"4.2.2"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c7hr-j4mj-j2w6","dataSource":"https://github.com/advisories/GHSA-c7hr-j4mj-j2w6","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-9235","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://www.npmjs.com/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html"],"description":"Verification Bypass in jsonwebtoken","cvss":[],"epss":[{"cve":"CVE-2015-9235","epss":0.3247,"percentile":0.96748,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2015-9235","cwe":"CWE-20","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2015-9235","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.2"],"state":"fixed","available":[{"version":"4.2.2","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":29.223},"relatedVulnerabilities":[{"id":"CVE-2015-9235","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-9235","namespace":"nvd:cpe","severity":"Critical","urls":["https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://nodesecurity.io/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html"],"description":"In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-9235","epss":0.3247,"percentile":0.96748,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2015-9235","cwe":"CWE-20","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2015-9235","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-c7hr-j4mj-j2w6","versionConstraint":"<4.2.2 (semantic)"},"fix":{"suggestedVersion":"4.2.2"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-cchq-frgv-rjh5","dataSource":"https://github.com/advisories/GHSA-cchq-frgv-rjh5","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5","https://nvd.nist.gov/vuln/detail/CVE-2023-37466","https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9","https://security.netapp.com/advisory/ntap-20230831-0007","https://security.netapp.com/advisory/ntap-20241108-0002","https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744","https://github.com/patriksimek/vm2/releases/tag/v3.10.0"],"description":"vm2 Sandbox Escape vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37466","epss":0.04997,"percentile":0.89498,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-37466","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-37466","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.10.0"],"state":"fixed","available":[{"version":"3.10.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":4.69718},"relatedVulnerabilities":[{"id":"CVE-2023-37466","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37466","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744","https://github.com/patriksimek/vm2/releases/tag/v3.10.0","https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5","https://security.netapp.com/advisory/ntap-20241108-0002/"],"description":"vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37466","epss":0.04997,"percentile":0.89498,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-37466","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-37466","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-cchq-frgv-rjh5","versionConstraint":"<=3.9.19 (semantic)"},"fix":{"suggestedVersion":"3.10.0"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-87vv-r9j6-g5qv","dataSource":"https://github.com/advisories/GHSA-87vv-r9j6-g5qv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-4055","https://www.npmjs.com/advisories/55","https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E","https://www.tenable.com/security/tns-2019-02","http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/95849"],"description":"Regular Expression Denial of Service in moment","cvss":[{"type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-4055","epss":0.04049,"percentile":0.8828,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2016-4055","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.11.2"],"state":"fixed","available":[{"version":"2.11.2","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":2.328175},"relatedVulnerabilities":[{"id":"CVE-2016-4055","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4055","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/95849","https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E","https://nodesecurity.io/advisories/55","https://www.tenable.com/security/tns-2019-02"],"description":"The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a \"regular expression Denial of Service (ReDoS).\"","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"exploitabilityScore":10,"impactScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-4055","epss":0.04049,"percentile":0.8828,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2016-4055","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-87vv-r9j6-g5qv","versionConstraint":"<2.11.2 (semantic)"},"fix":{"suggestedVersion":"2.11.2"}}],"artifact":{"id":"fb07dad56d7726f5","name":"moment","version":"2.0.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:momentjs:moment:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-jf85-cpcp-j695","dataSource":"https://github.com/advisories/GHSA-jf85-cpcp-j695","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/lodash/lodash/pull/4336","https://nvd.nist.gov/vuln/detail/CVE-2019-10744","https://snyk.io/vuln/SNYK-JS-LODASH-450202","https://access.redhat.com/errata/RHSA-2019:3024","https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS","https://security.netapp.com/advisory/ntap-20191004-0005","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-10744.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10744","epss":0.02441,"percentile":0.84893,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-10744","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.12"],"state":"fixed","available":[{"version":"4.17.12","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":2.209105},"relatedVulnerabilities":[{"id":"CVE-2019-10744","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10744","namespace":"nvd:cpe","severity":"Critical","urls":["https://access.redhat.com/errata/RHSA-2019:3024","https://security.netapp.com/advisory/ntap-20191004-0005/","https://snyk.io/vuln/SNYK-JS-LODASH-450202","https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"description":"Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"exploitabilityScore":10,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10744","epss":0.02441,"percentile":0.84893,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-10744","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-jf85-cpcp-j695","versionConstraint":"<4.17.12 (semantic)"},"fix":{"suggestedVersion":"4.17.12"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-p6mc-m468-83gw","dataSource":"https://github.com/advisories/GHSA-p6mc-m468-83gw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/issues/4744","https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12","https://nvd.nist.gov/vuln/detail/CVE-2020-8203","https://hackerone.com/reports/712065","https://github.com/lodash/lodash/issues/4874","https://github.com/github/advisory-database/pull/2884","https://hackerone.com/reports/864701","https://github.com/lodash/lodash/wiki/Changelog#v41719","https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744","https://security.netapp.com/advisory/ntap-20200724-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.02615,"percentile":0.85376,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":1.948175},"relatedVulnerabilities":[{"id":"CVE-2020-8203","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8203","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/lodash/lodash/issues/4874","https://hackerone.com/reports/712065","https://security.netapp.com/advisory/ntap-20200724-0006/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.02615,"percentile":0.85376,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash.set","version":"4.3.2"}},"found":{"vulnerabilityID":"GHSA-p6mc-m468-83gw","versionConstraint":">=3.7.0,<=4.3.2 (semantic)"}}],"artifact":{"id":"be8f210a7cd0fab3","name":"lodash.set","version":"4.3.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/lodash.set/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/lodash.set/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash.set:lodash.set:4.3.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/lodash.set@4.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8hfj-j24r-96c4","dataSource":"https://github.com/advisories/GHSA-8hfj-j24r-96c4","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","https://nvd.nist.gov/vuln/detail/CVE-2022-24785","https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5","https://www.tenable.com/security/tns-2022-09","https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5","https://security.netapp.com/advisory/ntap-20220513-0006","https://security.netapp.com/advisory/ntap-20241108-0002"],"description":"Path Traversal: 'dir/../../filename' in moment.locale","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24785","epss":0.01673,"percentile":0.81853,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-27","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.29.2"],"state":"fixed","available":[{"version":"2.29.2","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":1.25475},"relatedVulnerabilities":[{"id":"CVE-2022-24785","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24785","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5","https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/","https://security.netapp.com/advisory/ntap-20220513-0006/","https://www.tenable.com/security/tns-2022-09","https://security.netapp.com/advisory/ntap-20241108-0002/"],"description":"Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24785","epss":0.01673,"percentile":0.81853,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-27","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-8hfj-j24r-96c4","versionConstraint":"<2.29.2 (semantic)"},"fix":{"suggestedVersion":"2.29.2"}}],"artifact":{"id":"fb07dad56d7726f5","name":"moment","version":"2.0.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:momentjs:moment:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-r7qp-cfhv-p84w","dataSource":"https://github.com/advisories/GHSA-r7qp-cfhv-p84w","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w","https://nvd.nist.gov/vuln/detail/CVE-2022-41940","https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6","https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085"],"description":"Uncaught exception in engine.io","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-41940","epss":0.0206,"percentile":0.83628,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-41940","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.2.1"],"state":"fixed","available":[{"version":"6.2.1","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":1.1844999999999999},"relatedVulnerabilities":[{"id":"CVE-2022-41940","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41940","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6","https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085","https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w"],"description":"Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-41940","epss":0.0206,"percentile":0.83628,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-41940","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"engine.io","version":"4.1.2"}},"found":{"vulnerabilityID":"GHSA-r7qp-cfhv-p84w","versionConstraint":">=4.0.0,<6.2.1 (semantic)"},"fix":{"suggestedVersion":"6.2.1"}}],"artifact":{"id":"8c4af4f22e5de7e4","name":"engine.io","version":"4.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/engine.io/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:socket:engine.io:4.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/engine.io@4.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xwcq-pm8m-c4vf","dataSource":"https://github.com/advisories/GHSA-xwcq-pm8m-c4vf","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf","https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a","https://nvd.nist.gov/vuln/detail/CVE-2023-46233","https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html"],"description":"crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-46233","epss":0.00823,"percentile":0.74099,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-46233","cwe":"CWE-328","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-46233","cwe":"CWE-916","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-46233","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.744815},"relatedVulnerabilities":[{"id":"CVE-2023-46233","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-46233","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a","https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf","https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html"],"description":"crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-46233","epss":0.00823,"percentile":0.74099,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-46233","cwe":"CWE-328","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-46233","cwe":"CWE-916","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-46233","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"crypto-js","version":"3.3.0"}},"found":{"vulnerabilityID":"GHSA-xwcq-pm8m-c4vf","versionConstraint":"<4.2.0 (semantic)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"c00a8b8b043aae72","name":"crypto-js","version":"3.3.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/crypto-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crypto-js/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:crypto-js:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto-js:crypto_js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto_js:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto_js:crypto_js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto:crypto_js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:brix:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:brix:crypto_js:3.3.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/crypto-js@3.3.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-rm97-x556-q36h","dataSource":"https://github.com/advisories/GHSA-rm97-x556-q36h","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21501","https://github.com/apostrophecms/sanitize-html/pull/650","https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4","https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf","https://github.com/apostrophecms/apostrophe/discussions/4436","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S"],"description":"sanitize-html Information Exposure vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21501","epss":0.01341,"percentile":0.79753,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-21501","cwe":"CWE-200","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21501","cwe":"CWE-538","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["2.12.1"],"state":"fixed","available":[{"version":"2.12.1","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.690615},"relatedVulnerabilities":[{"id":"CVE-2024-21501","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21501","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf","https://github.com/apostrophecms/apostrophe/discussions/4436","https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4","https://github.com/apostrophecms/sanitize-html/pull/650","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334"],"description":"Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21501","epss":0.01341,"percentile":0.79753,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-21501","cwe":"CWE-200","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21501","cwe":"CWE-538","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-rm97-x556-q36h","versionConstraint":"<2.12.1 (semantic)"},"fix":{"suggestedVersion":"2.12.1"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-15467","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15467","namespace":"debian:distro:debian:12","severity":"Critical","urls":[],"description":"Issue summary: Parsing CMS AuthEnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15467","epss":0.00672,"percentile":0.71001,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.6316800000000001},"relatedVulnerabilities":[{"id":"CVE-2025-15467","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703","https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9","https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3","https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e","https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc","https://openssl-library.org/news/secadv/20260127.txt","http://www.openwall.com/lists/oss-security/2026/01/27/10"],"description":"Issue summary: Parsing CMS AuthEnvelopedData message with maliciously\ncrafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS AuthEnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME AuthEnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15467","epss":0.00672,"percentile":0.71001,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-15467","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-35jh-r3h4-6jhm","dataSource":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml"],"description":"Command Injection in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.00741,"percentile":0.72603,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.544635},"relatedVulnerabilities":[{"id":"CVE-2021-23337","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.00741,"percentile":0.72603,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-35jh-r3h4-6jhm","versionConstraint":"<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3h5v-q93c-6h6q","dataSource":"https://github.com/advisories/GHSA-3h5v-q93c-6h6q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q","https://github.com/websockets/ws/issues/2230","https://github.com/websockets/ws/pull/2231","https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f","https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e","https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c","https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63"],"description":"ws affected by a DoS when handling a request with many HTTP headers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37890","epss":0.00541,"percentile":0.67208,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-37890","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.10"],"state":"fixed","available":[{"version":"7.5.10","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.42198},"relatedVulnerabilities":[{"id":"CVE-2024-37890","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37890","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f","https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e","https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c","https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63","https://github.com/websockets/ws/issues/2230","https://github.com/websockets/ws/pull/2231","https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q","https://nodejs.org/api/http.html#servermaxheaderscount"],"description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37890","epss":0.00541,"percentile":0.67208,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-37890","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"7.4.6"}},"found":{"vulnerabilityID":"GHSA-3h5v-q93c-6h6q","versionConstraint":">=7.0.0,<7.5.10 (semantic)"},"fix":{"suggestedVersion":"7.5.10"}}],"artifact":{"id":"670482146c83d660","name":"ws","version":"7.4.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/ws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/ws/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ws_project:ws:7.4.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@7.4.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-pfrx-2q88-qq97","dataSource":"https://github.com/advisories/GHSA-pfrx-2q88-qq97","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-33987","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/commit/861ccd9ac2237df762a9e2beed7edd88c60782dc","https://github.com/sindresorhus/got/releases/tag/v11.8.5","https://github.com/sindresorhus/got/releases/tag/v12.1.0"],"description":"Got allows a redirect to a UNIX socket","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.00807,"percentile":0.73852,"date":"2026-02-23"}],"fix":{"versions":["11.8.5"],"state":"fixed","available":[{"version":"11.8.5","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.41560500000000006},"relatedVulnerabilities":[{"id":"CVE-2022-33987","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-33987","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/releases/tag/v11.8.5"],"description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.00807,"percentile":0.73852,"date":"2026-02-23"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"got","version":"8.3.2"}},"found":{"vulnerabilityID":"GHSA-pfrx-2q88-qq97","versionConstraint":"<11.8.5 (semantic)"},"fix":{"suggestedVersion":"11.8.5"}}],"artifact":{"id":"5bd1b0995776246c","name":"got","version":"8.3.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/got/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/got/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:got:got:8.3.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/got@8.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-cgfm-xwp7-2cvr","dataSource":"https://github.com/advisories/GHSA-cgfm-xwp7-2cvr","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25887","https://github.com/apostrophecms/sanitize-html/pull/557","https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526"],"description":"Sanitize-html Vulnerable To REDoS Attacks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25887","epss":0.00447,"percentile":0.63113,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-25887","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.7.1"],"state":"fixed","available":[{"version":"2.7.1","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.33525},"relatedVulnerabilities":[{"id":"CVE-2022-25887","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25887","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c","https://github.com/apostrophecms/sanitize-html/pull/557","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526"],"description":"The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25887","epss":0.00447,"percentile":0.63113,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-25887","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-cgfm-xwp7-2cvr","versionConstraint":"<2.7.1 (semantic)"},"fix":{"suggestedVersion":"2.7.1"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-p5gc-c584-jj6v","dataSource":"https://github.com/advisories/GHSA-p5gc-c584-jj6v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v","https://nvd.nist.gov/vuln/detail/CVE-2023-32313","https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238","https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550","https://github.com/patriksimek/vm2/releases/tag/3.9.18"],"description":"vm2 vulnerable to Inspect Manipulation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32313","epss":0.0057,"percentile":0.68141,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-32313","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.9.18"],"state":"fixed","available":[{"version":"3.9.18","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.29355000000000003},"relatedVulnerabilities":[{"id":"CVE-2023-32313","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32313","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550","https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238","https://github.com/patriksimek/vm2/releases/tag/3.9.18","https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v"],"description":"vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32313","epss":0.0057,"percentile":0.68141,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-32313","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-p5gc-c584-jj6v","versionConstraint":"<3.9.18 (semantic)"},"fix":{"suggestedVersion":"3.9.18"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-4xc9-xhrj-v574","dataSource":"https://github.com/advisories/GHSA-4xc9-xhrj-v574","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-16487","https://hackerone.com/reports/380873","https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad","https://security.netapp.com/advisory/ntap-20190919-0004","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-16487.yml"],"description":"Prototype Pollution in lodash","cvss":[],"epss":[{"cve":"CVE-2018-16487","epss":0.00345,"percentile":0.56616,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2018-16487","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"}],"fix":{"versions":["4.17.11"],"state":"fixed","available":[{"version":"4.17.11","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.25875},"relatedVulnerabilities":[{"id":"CVE-2018-16487","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16487","namespace":"nvd:cpe","severity":"Medium","urls":["https://hackerone.com/reports/380873","https://security.netapp.com/advisory/ntap-20190919-0004/"],"description":"A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-16487","epss":0.00345,"percentile":0.56616,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2018-16487","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-4xc9-xhrj-v574","versionConstraint":"<4.17.11 (semantic)"},"fix":{"suggestedVersion":"4.17.11"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-f5x3-32g6-xq36","dataSource":"https://github.com/advisories/GHSA-f5x3-32g6-xq36","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://nvd.nist.gov/vuln/detail/CVE-2024-28863","https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://security.netapp.com/advisory/ntap-20240524-0005"],"description":"Denial of service while parsing a tar file due to lack of folders count validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.0045,"percentile":0.63219,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.2.1"],"state":"fixed","available":[{"version":"6.2.1","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.2587499999999999},"relatedVulnerabilities":[{"id":"CVE-2024-28863","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28863","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://security.netapp.com/advisory/ntap-20240524-0005/"],"description":"node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.0045,"percentile":0.63219,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-f5x3-32g6-xq36","versionConstraint":"<6.2.1 (semantic)"},"fix":{"suggestedVersion":"6.2.1"}}],"artifact":{"id":"f42c59d94c10b95d","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-446m-mv8f-q348","dataSource":"https://github.com/advisories/GHSA-446m-mv8f-q348","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-18214","https://github.com/moment/moment/issues/4163","https://github.com/moment/moment/pull/4326","https://www.npmjs.com/advisories/532","https://www.tenable.com/security/tns-2019-02","https://github.com/moment/moment/commit/69ed9d44957fa6ab12b73d2ae29d286a857b80eb"],"description":"Regular Expression Denial of Service in moment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-18214","epss":0.00311,"percentile":0.53923,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2017-18214","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.19.3"],"state":"fixed","available":[{"version":"2.19.3","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.23324999999999999},"relatedVulnerabilities":[{"id":"CVE-2017-18214","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-18214","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moment/moment/issues/4163","https://nodesecurity.io/advisories/532","https://www.tenable.com/security/tns-2019-02"],"description":"The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-18214","epss":0.00311,"percentile":0.53923,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2017-18214","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-446m-mv8f-q348","versionConstraint":"<2.19.3 (semantic)"},"fix":{"suggestedVersion":"2.19.3"}}],"artifact":{"id":"fb07dad56d7726f5","name":"moment","version":"2.0.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:momentjs:moment:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-3j7m-hmh3-9jmp","dataSource":"https://github.com/advisories/GHSA-3j7m-hmh3-9jmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-1000237","https://github.com/apostrophecms/sanitize-html/issues/29","https://github.com/apostrophecms/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf","https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json","https://github.com/punkave/sanitize-html/issues/29","https://www.npmjs.com/advisories/135"],"description":"Cross-Site Scripting in sanitize-html","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-1000237","epss":0.00328,"percentile":0.55302,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2016-1000237","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.4.3"],"state":"fixed","available":[{"version":"1.4.3","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.18203999999999998},"relatedVulnerabilities":[{"id":"CVE-2016-1000237","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000237","namespace":"nvd:cpe","severity":"Medium","urls":["https://nodesecurity.io/advisories/135","https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json"],"description":"sanitize-html before 1.4.3 has XSS.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-1000237","epss":0.00328,"percentile":0.55302,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2016-1000237","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-3j7m-hmh3-9jmp","versionConstraint":"<1.4.3 (semantic)"},"fix":{"suggestedVersion":"1.4.3"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8g4m-cjm2-96wq","dataSource":"https://github.com/advisories/GHSA-8g4m-cjm2-96wq","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23771","https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587","https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946"],"description":"Sandbox escape in notevil and argencoders-notevil","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23771","epss":0.00304,"percentile":0.53281,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2021-23771","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1748},"relatedVulnerabilities":[{"id":"CVE-2021-23771","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23771","namespace":"nvd:cpe","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587","https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946"],"description":"This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"exploitabilityScore":10,"impactScore":5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23771","epss":0.00304,"percentile":0.53281,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2021-23771","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"notevil","version":"1.3.3"}},"found":{"vulnerabilityID":"GHSA-8g4m-cjm2-96wq","versionConstraint":"<=1.3.3 (semantic)"}}],"artifact":{"id":"06d4740823f7ae47","name":"notevil","version":"1.3.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/notevil/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/notevil/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:notevil_project:notevil:1.3.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/notevil@1.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-grv7-fg5c-xmjg","dataSource":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4068","https://github.com/micromatch/braces/issues/35","https://devhub.checkmarx.com/cve-details/CVE-2024-4068","https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff"],"description":"Uncontrolled resource consumption in braces","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.00225,"percentile":0.44923,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["3.0.3"],"state":"fixed","available":[{"version":"3.0.3","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.16874999999999998},"relatedVulnerabilities":[{"id":"CVE-2024-4068","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4068","namespace":"nvd:cpe","severity":"High","urls":["https://devhub.checkmarx.com/cve-details/CVE-2024-4068/","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff","https://github.com/micromatch/braces/issues/35","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40"],"description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","cvss":[{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.00225,"percentile":0.44923,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"braces","version":"2.3.2"}},"found":{"vulnerabilityID":"GHSA-grv7-fg5c-xmjg","versionConstraint":"<3.0.3 (semantic)"},"fix":{"suggestedVersion":"3.0.3"}}],"artifact":{"id":"e18c817c2057c675","name":"braces","version":"2.3.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:braces_project:braces:2.3.2:*:*:*:*:node.js:*:*","cpe:2.3:a:jonschlinkert:braces:2.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/braces@2.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6g6m-m6h5-w9gf","dataSource":"https://github.com/advisories/GHSA-6g6m-m6h5-w9gf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf","https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef","https://nvd.nist.gov/vuln/detail/CVE-2020-15084"],"description":"Authorization bypass in express-jwt","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.7,"exploitabilityScore":1.3,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15084","epss":0.00222,"percentile":0.44605,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2020-15084","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-15084","cwe":"CWE-863","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["6.0.0"],"state":"fixed","available":[{"version":"6.0.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.16872000000000004},"relatedVulnerabilities":[{"id":"CVE-2020-15084","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15084","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef","https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf"],"description":"In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.7,"exploitabilityScore":1.3,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15084","epss":0.00222,"percentile":0.44605,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2020-15084","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-15084","cwe":"CWE-863","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"express-jwt","version":"0.1.3"}},"found":{"vulnerabilityID":"GHSA-6g6m-m6h5-w9gf","versionConstraint":"<=5.3.3 (semantic)"},"fix":{"suggestedVersion":"6.0.0"}}],"artifact":{"id":"b057e452c5702954","name":"express-jwt","version":"0.1.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:express-jwt:0.1.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/express-jwt@0.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-mjxr-4v3x-q3m4","dataSource":"https://github.com/advisories/GHSA-mjxr-4v3x-q3m4","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-26540","https://github.com/apostrophecms/sanitize-html/pull/460","https://advisory.checkmarx.net/advisory/CX-2021-4309","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26"],"description":"Improper Input Validation in sanitize-html","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26540","epss":0.00288,"percentile":0.51906,"date":"2026-02-23"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.14832},"relatedVulnerabilities":[{"id":"CVE-2021-26540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-26540","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CX-2021-4309","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26","https://github.com/apostrophecms/sanitize-html/pull/460"],"description":"Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the \"allowedIframeHostnames\" option when the \"allowIframeRelativeUrls\" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with \"/\\\\example.com\".","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26540","epss":0.00288,"percentile":0.51906,"date":"2026-02-23"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-mjxr-4v3x-q3m4","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rjqq-98f6-6j3r","dataSource":"https://github.com/advisories/GHSA-rjqq-98f6-6j3r","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-26539","https://github.com/apostrophecms/sanitize-html/pull/458","https://advisory.checkmarx.net/advisory/CX-2021-4308","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22","https://github.com/apostrophecms/sanitize-html/commit/bdf7836ef8f0e5b21f9a1aab0623ae8fcd09c1da"],"description":"Improper Input Validation in sanitize-html","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26539","epss":0.00288,"percentile":0.51906,"date":"2026-02-23"}],"fix":{"versions":["2.3.1"],"state":"fixed","available":[{"version":"2.3.1","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.14832},"relatedVulnerabilities":[{"id":"CVE-2021-26539","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-26539","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CX-2021-4308","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22","https://github.com/apostrophecms/sanitize-html/pull/458"],"description":"Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the \"allowedIframeHostnames\" option.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26539","epss":0.00288,"percentile":0.51906,"date":"2026-02-23"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-rjqq-98f6-6j3r","versionConstraint":"<2.3.1 (semantic)"},"fix":{"suggestedVersion":"2.3.1"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rc47-6667-2j5j","dataSource":"https://github.com/advisories/GHSA-rc47-6667-2j5j","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25881","https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332","https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783","https://github.com/kornelski/http-cache-semantics/commit/560b2d8ef452bbba20ffed69dc155d63ac757b74","https://security.netapp.com/advisory/ntap-20230622-0008"],"description":"http-cache-semantics vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25881","epss":0.00196,"percentile":0.41479,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["4.1.1"],"state":"fixed","available":[{"version":"4.1.1","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.147},"relatedVulnerabilities":[{"id":"CVE-2022-25881","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25881","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83","https://security.netapp.com/advisory/ntap-20230622-0008/","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332","https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783"],"description":"This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25881","epss":0.00196,"percentile":0.41479,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"http-cache-semantics","version":"3.8.1"}},"found":{"vulnerabilityID":"GHSA-rc47-6667-2j5j","versionConstraint":"<4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.1.1"}}],"artifact":{"id":"bd9e0a0c5346494e","name":"http-cache-semantics","version":"3.8.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/http-cache-semantics/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/http-cache-semantics/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["BSD-2-Clause"],"cpes":["cpe:2.3:a:http-cache-semantics_project:http-cache-semantics:3.8.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/http-cache-semantics@3.8.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-fvqr-27wr-82fm","dataSource":"https://github.com/advisories/GHSA-fvqr-27wr-82fm","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-3721","https://hackerone.com/reports/310443","https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a","https://security.netapp.com/advisory/ntap-20190919-0004","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-3721.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3721","epss":0.00252,"percentile":0.48265,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2018-3721","cwe":"CWE-471","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2018-3721","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.5"],"state":"fixed","available":[{"version":"4.17.5","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.1449},"relatedVulnerabilities":[{"id":"CVE-2018-3721","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-3721","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a","https://hackerone.com/reports/310443","https://security.netapp.com/advisory/ntap-20190919-0004/"],"description":"lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3721","epss":0.00252,"percentile":0.48265,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2018-3721","cwe":"CWE-471","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2018-3721","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-fvqr-27wr-82fm","versionConstraint":"<4.17.5 (semantic)"},"fix":{"suggestedVersion":"4.17.5"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xc6g-ggrc-qq4r","dataSource":"https://github.com/advisories/GHSA-xc6g-ggrc-qq4r","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-16016","https://github.com/punkave/sanitize-html/issues/100","https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403)))","https://npmjs.com/package/sanitize-html#discarding-the-entire-contents-of-a-disallowed-tag","https://www.npmjs.com/advisories/154","https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403"],"description":"Cross-Site Scripting in sanitize-html","cvss":[],"epss":[{"cve":"CVE-2017-16016","epss":0.00286,"percentile":0.51666,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2017-16016","cwe":"CWE-79","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16016","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.11.4"],"state":"fixed","available":[{"version":"1.11.4","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.14300000000000002},"relatedVulnerabilities":[{"id":"CVE-2017-16016","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16016","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403","https://github.com/punkave/sanitize-html/issues/100","https://nodesecurity.io/advisories/154"],"description":"Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16016","epss":0.00286,"percentile":0.51666,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2017-16016","cwe":"CWE-79","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16016","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-xc6g-ggrc-qq4r","versionConstraint":"<=1.11.1 (semantic)"},"fix":{"suggestedVersion":"1.11.4"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-cqmj-92xf-r6r9","dataSource":"https://github.com/advisories/GHSA-cqmj-92xf-r6r9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9","https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3","https://github.com/socketio/socket.io-parser/commit/1c220ddbf45ea4b44bc8dbf6f9ae245f672ba1b9","https://nvd.nist.gov/vuln/detail/CVE-2023-32695","https://github.com/socketio/socket.io-parser/releases/tag/4.2.3","https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4"],"description":"Insufficient validation when decoding a Socket.IO packet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32695","epss":0.00203,"percentile":0.42311,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-32695","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-32695","cwe":"CWE-754","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.3"],"state":"fixed","available":[{"version":"4.2.3","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.12281500000000001},"relatedVulnerabilities":[{"id":"CVE-2023-32695","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32695","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3","https://github.com/socketio/socket.io-parser/releases/tag/4.2.3","https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9"],"description":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32695","epss":0.00203,"percentile":0.42311,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2023-32695","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-32695","cwe":"CWE-754","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io-parser","version":"4.0.5"}},"found":{"vulnerabilityID":"GHSA-cqmj-92xf-r6r9","versionConstraint":">=4.0.4,<4.2.3 (semantic)"},"fix":{"suggestedVersion":"4.2.3"}}],"artifact":{"id":"dd154d7bfbaea09c","name":"socket.io-parser","version":"4.0.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/socket.io-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socket.io-parser/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:socket:socket.io-parser:4.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io-parser@4.0.5","upstreams":[]}},{"vulnerability":{"id":"CVE-2018-20796","dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.","cvss":[],"epss":[{"cve":"CVE-2018-20796","epss":0.01669,"percentile":0.81831,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.08345000000000001},"relatedVulnerabilities":[{"id":"CVE-2018-20796","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","namespace":"nvd:cpe","severity":"High","urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS"],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20796","epss":0.01669,"percentile":0.81831,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-25hc-qcg6-38wj","dataSource":"https://github.com/advisories/GHSA-25hc-qcg6-38wj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj","https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115","https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c","https://nvd.nist.gov/vuln/detail/CVE-2024-38355"],"description":"socket.io has an unhandled 'error' event","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-38355","epss":0.00136,"percentile":0.33449,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-38355","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-38355","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.6.2"],"state":"fixed","available":[{"version":"4.6.2","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.08228},"relatedVulnerabilities":[{"id":"CVE-2024-38355","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38355","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115","https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c","https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj","https://www.vicarius.io/vsociety/posts/unhandled-exception-in-socketio-cve-2024-38355"],"description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\" event to catch these errors.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-38355","epss":0.00136,"percentile":0.33449,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-38355","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-38355","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-25hc-qcg6-38wj","versionConstraint":">=3.0.0,<4.6.2 (semantic)"},"fix":{"suggestedVersion":"4.6.2"}}],"artifact":{"id":"a59f241f8d484687","name":"socket.io","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/socket.io/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socket.io/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:socket:socket.io:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-6rw7-vpxm-498p","dataSource":"https://github.com/advisories/GHSA-6rw7-vpxm-498p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","https://nvd.nist.gov/vuln/detail/CVE-2025-15284","https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"],"description":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.00085,"percentile":0.24617,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.1"],"state":"fixed","available":[{"version":"6.14.1","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.0663},"relatedVulnerabilities":[{"id":"CVE-2025-15284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"],"description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' && options.parseArrays) {\n obj = utils.combine([], leaf); // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index <= options.arrayLimit) { // Limit checked here\n obj = [];\n obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length); // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.00085,"percentile":0.24617,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.13.0"}},"found":{"vulnerabilityID":"GHSA-6rw7-vpxm-498p","versionConstraint":"<6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.1"}}],"artifact":{"id":"f1485a5d8cce1397","name":"qs","version":"6.13.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/qs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.13.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-g5hg-p3ph-g8qg","dataSource":"https://github.com/advisories/GHSA-g5hg-p3ph-g8qg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg","https://nvd.nist.gov/vuln/detail/CVE-2025-48997","https://github.com/expressjs/multer/issues/1233","https://github.com/expressjs/multer/pull/1256","https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9"],"description":"Multer vulnerable to Denial of Service via unhandled exception","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-48997","epss":0.00081,"percentile":0.23741,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-48997","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.06561},"relatedVulnerabilities":[{"id":"CVE-2025-48997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48997","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9","https://github.com/expressjs/multer/issues/1233","https://github.com/expressjs/multer/pull/1256","https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to `2.0.1` to receive a patch. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-48997","epss":0.00081,"percentile":0.23741,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-48997","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-g5hg-p3ph-g8qg","versionConstraint":">=1.4.4-lts.1,<2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.00126,"percentile":0.32023,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.06489},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.00126,"percentile":0.32023,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"3.1.10"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"2f60ee768b1461a2","name":"micromatch","version":"3.1.10","type":"npm","locations":[{"path":"/juice-shop/node_modules/micromatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/micromatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:jonschlinkert:micromatch:3.1.10:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/micromatch@3.1.10","upstreams":[]}},{"vulnerability":{"id":"GHSA-pxg6-pf52-xh8x","dataSource":"https://github.com/advisories/GHSA-pxg6-pf52-xh8x","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c"],"description":"cookie accepts cookie name, path, and domain with out of bounds characters","cvss":[],"epss":[{"cve":"CVE-2024-47764","epss":0.00205,"percentile":0.42501,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.0"],"state":"fixed","available":[{"version":"0.7.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.0615},"relatedVulnerabilities":[{"id":"CVE-2024-47764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x"],"description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47764","epss":0.00205,"percentile":0.42501,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cookie","version":"0.4.2"}},"found":{"vulnerabilityID":"GHSA-pxg6-pf52-xh8x","versionConstraint":"<0.7.0 (semantic)"},"fix":{"suggestedVersion":"0.7.0"}}],"artifact":{"id":"299182936c2fe78a","name":"cookie","version":"0.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:cookie:cookie:0.4.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/cookie@0.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8cf7-32gw-wr33","dataSource":"https://github.com/advisories/GHSA-8cf7-32gw-wr33","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23539","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken unrestricted key type could lead to legacy keys usage","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00072,"percentile":0.21985,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23539","cwe":"CWE-327","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.05616000000000001},"relatedVulnerabilities":[{"id":"CVE-2022-23539","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23539","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00072,"percentile":0.21985,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23539","cwe":"CWE-327","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-8cf7-32gw-wr33","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8cf7-32gw-wr33","dataSource":"https://github.com/advisories/GHSA-8cf7-32gw-wr33","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23539","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken unrestricted key type could lead to legacy keys usage","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00072,"percentile":0.21985,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23539","cwe":"CWE-327","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.05616000000000001},"relatedVulnerabilities":[{"id":"CVE-2022-23539","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23539","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00072,"percentile":0.21985,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23539","cwe":"CWE-327","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-8cf7-32gw-wr33","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vghf-hv5q-vc2g","dataSource":"https://github.com/advisories/GHSA-vghf-hv5q-vc2g","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-12758","https://github.com/validatorjs/validator.js/pull/2616","https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e","https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476","https://github.com/validatorjs/validator.js/commit/d457ecaf55b0f3d8bd379d82757425d0d13dd382","http://seclists.org/fulldisclosure/2026/Jan/27"],"description":"Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-12758","epss":0.00074,"percentile":0.2235,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-12758","cwe":"CWE-792","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2025-12758","cwe":"CWE-172","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["13.15.22"],"state":"fixed","available":[{"version":"13.15.22","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.055869999999999996},"relatedVulnerabilities":[{"id":"CVE-2025-12758","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12758","namespace":"nvd:cpe","severity":"High","urls":["https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e","https://github.com/validatorjs/validator.js/pull/2616","https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476","http://seclists.org/fulldisclosure/2026/Jan/27"],"description":"Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\\uFE0F, \\uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-12758","epss":0.00074,"percentile":0.2235,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-12758","cwe":"CWE-792","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2025-12758","cwe":"CWE-172","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"validator","version":"13.15.15"}},"found":{"vulnerabilityID":"GHSA-vghf-hv5q-vc2g","versionConstraint":"<13.15.22 (semantic)"},"fix":{"suggestedVersion":"13.15.22"}}],"artifact":{"id":"3b9b91f7d23a3503","name":"validator","version":"13.15.15","type":"npm","locations":[{"path":"/juice-shop/node_modules/validator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/validator/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:validator_project:validator:13.15.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/validator@13.15.15","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-69420","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69420","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2() access the signing cert attribute value without validating its type. When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed TimeStamp Response to an application that verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not widely used and the impact of the exploit is just a Denial of Service. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the TimeStamp Response implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69420","epss":0.0007,"percentile":0.21337,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.0525},"relatedVulnerabilities":[{"id":"CVE-2025-69420","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9","https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a","https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e","https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b","https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69420","epss":0.0007,"percentile":0.21337,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-69420","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2025-59465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59465","namespace":"nvd:cpe","severity":"High","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on('secureConnection', socket => {\n socket.on('error', err => {\n console.log(err)\n })\n})\n```","cvss":[{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59465","epss":0.00069,"percentile":0.21075,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-59465","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.05175},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2025-59465","versionConstraint":"< 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-69421","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69421","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69421","epss":0.00059,"percentile":0.1853,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.044250000000000005},"relatedVulnerabilities":[{"id":"CVE-2025-69421","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b","https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7","https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd","https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3","https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69421","epss":0.00059,"percentile":0.1853,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-69421","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2019-1010025","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.","cvss":[],"epss":[{"cve":"CVE-2019-1010025","epss":0.00856,"percentile":0.74635,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0428},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","namespace":"nvd:cpe","severity":"Medium","urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025"],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010025","epss":0.00856,"percentile":0.74635,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2019-9192","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern","cvss":[],"epss":[{"cve":"CVE-2019-9192","epss":0.00841,"percentile":0.74388,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.04205000000000001},"relatedVulnerabilities":[{"id":"CVE-2019-9192","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS"],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-9192","epss":0.00841,"percentile":0.74388,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2025-69419","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69419","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes, but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is added to the output length without validation, causing the length to become negative. The subsequent trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer. The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue, PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69419","epss":0.00056,"percentile":0.17516,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-69419","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.04171999999999999},"relatedVulnerabilities":[{"id":"CVE-2025-69419","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296","https://github.com/openssl/openssl/commit/7e9cac9832e4705b91987c2474ed06a37a93cecb","https://github.com/openssl/openssl/commit/a26a90d38edec3748566129d824e664b54bee2e2","https://github.com/openssl/openssl/commit/cda12de3bc0e333ea8d2c6fd15001dbdaf280015","https://github.com/openssl/openssl/commit/ff628933755075446bca8307e8417c14d164b535","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously\ncrafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing\nnon-ASCII BMP code point can trigger a one byte write before the allocated\nbuffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption\nwhich can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12\nBMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,\nthe helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16\nsource byte count as the destination buffer capacity to UTF8_putc(). For BMP\ncode points above U+07FF, UTF-8 requires three bytes, but the forwarded\ncapacity can be just two bytes. UTF8_putc() then returns -1, and this negative\nvalue is added to the output length without validation, causing the\nlength to become negative. The subsequent trailing NUL byte is then written\nat a negative offset, causing write outside of heap allocated buffer.\n\nThe vulnerability is reachable via the public PKCS12_get_friendlyname() API\nwhen parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a\ndifferent code path that avoids this issue, PKCS12_get_friendlyname() directly\ninvokes the vulnerable function. Exploitation requires an attacker to provide\na malicious PKCS#12 file to be parsed by the application and the attacker\ncan just trigger a one zero byte write before the allocated buffer.\nFor that reason the issue was assessed as Low severity according to our\nSecurity Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69419","epss":0.00056,"percentile":0.17516,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-69419","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-69419","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-9965-vmph-33xx","dataSource":"https://github.com/advisories/GHSA-9965-vmph-33xx","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-56200","https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666","https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596","https://github.com/validatorjs/validator.js","http://validatorjs.com","https://github.com/validatorjs/validator.js/issues/2600","https://github.com/validatorjs/validator.js/pull/2608","https://github.com/validatorjs/validator.js/commit/cbef5088f02d36caf978f378bb845fe49bdc0809","https://github.com/validatorjs/validator.js/releases/tag/13.15.20"],"description":"validator.js has a URL validation bypass vulnerability in its isURL function","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-56200","epss":0.00072,"percentile":0.21792,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-56200","cwe":"CWE-79","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["13.15.20"],"state":"fixed","available":[{"version":"13.15.20","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.039959999999999996},"relatedVulnerabilities":[{"id":"CVE-2025-56200","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-56200","namespace":"nvd:cpe","severity":"Medium","urls":["http://validatorjs.com","https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666","https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596","https://github.com/validatorjs/validator.js"],"description":"A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-56200","epss":0.00072,"percentile":0.21792,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-56200","cwe":"CWE-79","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"validator","version":"13.15.15"}},"found":{"vulnerabilityID":"GHSA-9965-vmph-33xx","versionConstraint":"<13.15.20 (semantic)"},"fix":{"suggestedVersion":"13.15.20"}}],"artifact":{"id":"3b9b91f7d23a3503","name":"validator","version":"13.15.15","type":"npm","locations":[{"path":"/juice-shop/node_modules/validator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/validator/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:validator_project:validator:13.15.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/validator@13.15.15","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-15281","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15281","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15281","epss":0.00053,"percentile":0.16639,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.039749999999999994},"relatedVulnerabilities":[{"id":"CVE-2025-15281","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15281","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33814","http://www.openwall.com/lists/oss-security/2026/01/20/3"],"description":"Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15281","epss":0.00053,"percentile":0.16639,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-15281","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-22796","dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-22796","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be using the CMS API instead. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22796","epss":0.0007,"percentile":0.21552,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.03605},"relatedVulnerabilities":[{"id":"CVE-2026-22796","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22796","epss":0.0007,"percentile":0.21552,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2026-22796","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-44fp-w29j-9vj5","dataSource":"https://github.com/advisories/GHSA-44fp-w29j-9vj5","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5","https://nvd.nist.gov/vuln/detail/CVE-2025-47935","https://github.com/expressjs/multer/pull/1120","https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665"],"description":"Multer vulnerable to Denial of Service via memory leaks from unclosed streams","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47935","epss":0.00048,"percentile":0.14987,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-47935","cwe":"CWE-401","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.0"],"state":"fixed","available":[{"version":"2.0.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.036000000000000004},"relatedVulnerabilities":[{"id":"CVE-2025-47935","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47935","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665","https://github.com/expressjs/multer/pull/1120","https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47935","epss":0.00048,"percentile":0.14987,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-47935","cwe":"CWE-401","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-44fp-w29j-9vj5","versionConstraint":"<2.0.0 (semantic)"},"fix":{"suggestedVersion":"2.0.0"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.5"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"a7d9f58fa9223af7","name":"minimatch","version":"3.0.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.8"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"64792428adfc1585","name":"minimatch","version":"3.0.8","type":"npm","locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"34e3a98e2f474c3f","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/ignore-walk/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ignore-walk/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"31053d1a3eefafcf","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/archiver-utils/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"60218374fb088257","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"203e6da42d80803d","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"5c4dec26d80d1f6e","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/rimraf/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/rimraf/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"182b6a07cfd75764","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"2ea489db3cb444cd","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/file-js/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/file-js/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"a88006b8a0ec9567","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/fstream/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/fstream/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"c46d28efb236e0c8","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"5.1.6"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"ae8bd0e649f1262b","name":"minimatch","version":"5.1.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/filehound/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/filehound/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:5.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@5.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["10.2.1"],"state":"fixed","available":[{"version":"10.2.1","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.0324},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.0004,"percentile":0.12068,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<10.2.1 (semantic)"},"fix":{"suggestedVersion":"10.2.1"}}],"artifact":{"id":"1f297f7286432e88","name":"minimatch","version":"9.0.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/glob/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/glob/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.5","upstreams":[]}},{"vulnerability":{"id":"CVE-2019-1010024","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[],"epss":[{"cve":"CVE-2019-1010024","epss":0.00646,"percentile":0.70329,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0323},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024"],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010024","epss":0.00646,"percentile":0.70329,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-hjrf-2m68-5959","dataSource":"https://github.com/advisories/GHSA-hjrf-2m68-5959","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23541","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.0006,"percentile":0.18837,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23541","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"CWE-1259","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.03},"relatedVulnerabilities":[{"id":"CVE-2022-23541","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23541","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.0006,"percentile":0.18837,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23541","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"CWE-1259","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-hjrf-2m68-5959","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hjrf-2m68-5959","dataSource":"https://github.com/advisories/GHSA-hjrf-2m68-5959","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23541","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.0006,"percentile":0.18837,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23541","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"CWE-1259","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.03},"relatedVulnerabilities":[{"id":"CVE-2022-23541","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23541","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.0006,"percentile":0.18837,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23541","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"CWE-1259","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-hjrf-2m68-5959","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5j98-mcp5-4vw2","dataSource":"https://github.com/advisories/GHSA-5j98-mcp5-4vw2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2","https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146","https://nvd.nist.gov/vuln/detail/CVE-2025-64756","https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f"],"description":"glob CLI: Command injection via -c/--cmd executes matches with shell:true","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64756","epss":0.00038,"percentile":0.11522,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-64756","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.5.0"],"state":"fixed","available":[{"version":"10.5.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.028499999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-64756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f","https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146","https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2"],"description":"Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64756","epss":0.00038,"percentile":0.11522,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-64756","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.4.5"}},"found":{"vulnerabilityID":"GHSA-5j98-mcp5-4vw2","versionConstraint":">=10.2.0,<10.5.0 (semantic)"},"fix":{"suggestedVersion":"10.5.0"}}],"artifact":{"id":"ba9bf93e12b9ecba","name":"glob","version":"10.4.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/glob/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/glob/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:isaacs:glob:10.4.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.4.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-99p7-6v5w-7xg8","dataSource":"https://github.com/advisories/GHSA-99p7-6v5w-7xg8","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8","https://github.com/patriksimek/vm2/commit/4b009c2d4b1131c01810c1205e641d614c322a29","https://github.com/patriksimek/vm2/releases/tag/v3.10.2","https://nvd.nist.gov/vuln/detail/CVE-2026-22709"],"description":"vm2 has a Sandbox Escape","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22709","epss":0.0003,"percentile":0.08595,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-22709","cwe":"CWE-94","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-22709","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-22709","cwe":"CWE-913","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.10.2"],"state":"fixed","available":[{"version":"3.10.2","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.028199999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-22709","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22709","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/patriksimek/vm2/commit/4b009c2d4b1131c01810c1205e641d614c322a29","https://github.com/patriksimek/vm2/releases/tag/v3.10.2","https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8"],"description":"vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22709","epss":0.0003,"percentile":0.08595,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-22709","cwe":"CWE-94","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-22709","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-22709","cwe":"CWE-913","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-99p7-6v5w-7xg8","versionConstraint":"<=3.10.1 (semantic)"},"fix":{"suggestedVersion":"3.10.2"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-21637","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21637","namespace":"nvd:cpe","severity":"High","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21637","epss":0.00035,"percentile":0.10432,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-21637","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.024849999999999997},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2026-21637","versionConstraint":"< 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-9230","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-9230","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9230","epss":0.00031,"percentile":0.08975,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","source":"openssl-security@openssl.org","type":"Secondary"},{"cve":"CVE-2025-9230","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.17-1~deb12u3"],"state":"fixed","available":[{"version":"3.0.17-1~deb12u3","date":"2025-10-01","kind":"advisory"}]},"advisories":[{"id":"DSA-6015-1","link":"https://security-tracker.debian.org/tracker/DSA-6015-1"}],"risk":0.02325},"relatedVulnerabilities":[{"id":"CVE-2025-9230","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html"],"description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9230","epss":0.00031,"percentile":0.08975,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","source":"openssl-security@openssl.org","type":"Secondary"},{"cve":"CVE-2025-9230","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"< 3.0.17-1~deb12u3 (deb)"},"fix":{"suggestedVersion":"3.0.17-1~deb12u3"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-qhxp-v273-g94h","dataSource":"https://github.com/advisories/GHSA-qhxp-v273-g94h","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-25225","https://github.com/apostrophecms/sanitize-html/issues/293","https://github.com/apostrophecms/sanitize-html/pull/156","https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3","https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225"],"description":"sanitize-html is vulnerable to XSS through incomprehensive sanitization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-25225","epss":0.0004,"percentile":0.12117,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-25225","cwe":"CWE-79","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["2.0.0-beta"],"state":"fixed","available":[{"version":"2.0.0-beta","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.022199999999999998},"relatedVulnerabilities":[{"id":"CVE-2019-25225","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-25225","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225","https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3","https://github.com/apostrophecms/sanitize-html/issues/293","https://github.com/apostrophecms/sanitize-html/pull/156"],"description":"`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.","cvss":[{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-25225","epss":0.0004,"percentile":0.12117,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-25225","cwe":"CWE-79","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-qhxp-v273-g94h","versionConstraint":"<2.0.0-beta (semantic)"},"fix":{"suggestedVersion":"2.0.0-beta"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-vj76-c3g6-qr5v","dataSource":"https://github.com/advisories/GHSA-vj76-c3g6-qr5v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v","https://nvd.nist.gov/vuln/detail/CVE-2025-59343","https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09","https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html"],"description":"tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59343","epss":0.00027,"percentile":0.07261,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-59343","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-59343","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.4"],"state":"fixed","available":[{"version":"2.1.4","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.021869999999999997},"relatedVulnerabilities":[{"id":"CVE-2025-59343","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59343","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09","https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v","https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html"],"description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59343","epss":0.00027,"percentile":0.07261,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-59343","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-59343","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar-fs","version":"2.1.3"}},"found":{"vulnerabilityID":"GHSA-vj76-c3g6-qr5v","versionConstraint":">=2.0.0,<2.1.4 (semantic)"},"fix":{"suggestedVersion":"2.1.4"}}],"artifact":{"id":"9680d7d122bfb97a","name":"tar-fs","version":"2.1.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/tar-fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:mafintosh:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:mafintosh:tar_fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar-fs:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar-fs:tar_fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar_fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar_fs:2.1.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/tar-fs@2.1.3","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-9232","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-9232","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9232","epss":0.00039,"percentile":0.11765,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.17-1~deb12u3"],"state":"fixed","available":[{"version":"3.0.17-1~deb12u3","date":"2025-10-01","kind":"advisory"}]},"advisories":[{"id":"DSA-6015-1","link":"https://security-tracker.debian.org/tracker/DSA-6015-1"}],"risk":0.021255000000000003},"relatedVulnerabilities":[{"id":"CVE-2025-9232","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35","https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b","https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3","https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf","https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5"],"description":"Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9232","epss":0.00039,"percentile":0.11765,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-9232","versionConstraint":"< 3.0.17-1~deb12u3 (deb)"},"fix":{"suggestedVersion":"3.0.17-1~deb12u3"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2025-55131","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55131","namespace":"nvd:cpe","severity":"High","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.","cvss":[{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-55131","epss":0.00027,"percentile":0.07517,"date":"2026-02-23"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.01971},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2025-55131","versionConstraint":"< 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"CVE-2010-4756","dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.","cvss":[],"epss":[{"cve":"CVE-2010-4756","epss":0.00394,"percentile":0.59824,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.019700000000000002},"relatedVulnerabilities":[{"id":"CVE-2010-4756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","namespace":"nvd:cpe","severity":"Medium","urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","https://security.netapp.com/advisory/ntap-20241108-0002/"],"description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4756","epss":0.00394,"percentile":0.59824,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2025-59466","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59466","namespace":"nvd:cpe","severity":"High","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"We have identified a bug in Node.js error handling where \"Maximum call stack size exceeded\" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59466","epss":0.00026,"percentile":0.06956,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-59466","cwe":"CWE-248","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.018459999999999997},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2025-59466","versionConstraint":"< 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"CVE-2019-1010023","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[],"epss":[{"cve":"CVE-2019-1010023","epss":0.00322,"percentile":0.54833,"date":"2026-02-23"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0161},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","namespace":"nvd:cpe","severity":"High","urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023"],"description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","epss":0.00322,"percentile":0.54833,"date":"2026-02-23"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-xxjr-mmjv-4gpg","dataSource":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81"],"description":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.00025,"percentile":0.06818,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.17.23"],"state":"fixed","available":[{"version":"4.17.23","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.014625},"relatedVulnerabilities":[{"id":"CVE-2025-13465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"],"description":"Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.00025,"percentile":0.06818,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.21"}},"found":{"vulnerabilityID":"GHSA-xxjr-mmjv-4gpg","versionConstraint":">=4.0.0,<=4.17.22 (semantic)"},"fix":{"suggestedVersion":"4.17.23"}}],"artifact":{"id":"32afa1bf90ac61bc","name":"lodash","version":"4.17.21","type":"npm","locations":[{"path":"/juice-shop/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.21","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-0915","dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-0915","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-0915","epss":0.00019,"percentile":0.04651,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.014249999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-0915","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0915","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33802","http://www.openwall.com/lists/oss-security/2026/01/16/6"],"description":"Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-0915","epss":0.00019,"percentile":0.04651,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2026-0915","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2025-4802","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-4802","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-4802","epss":0.00016,"percentile":0.03393,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-4802","cwe":"CWE-426","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":["2.36-9+deb12u11"],"state":"fixed","available":[{"version":"2.36-9+deb12u11","date":"2025-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.012240000000000003},"relatedVulnerabilities":[{"id":"CVE-2025-4802","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4802","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32976","https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e","http://www.openwall.com/lists/oss-security/2025/05/16/7","http://www.openwall.com/lists/oss-security/2025/05/17/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00033.html"],"description":"Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-4802","epss":0.00016,"percentile":0.03393,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-4802","cwe":"CWE-426","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-4802","versionConstraint":"< 2.36-9+deb12u11 (deb)"},"fix":{"suggestedVersion":"2.36-9+deb12u11"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.0002,"percentile":0.04961,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.2"],"state":"fixed","available":[{"version":"3.14.2","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.0103},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.0002,"percentile":0.04961,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":"<3.14.2 (semantic)"},"fix":{"suggestedVersion":"3.14.2"}}],"artifact":{"id":"2ec6fdae7536262a","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/js-yaml/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/js-yaml/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-55130","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55130","namespace":"nvd:cpe","severity":"Critical","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-55130","epss":0.00012,"percentile":0.01666,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-55130","cwe":"CWE-289","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.01026},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2025-55130","versionConstraint":">= 20, < 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qwph-4952-7xr6","dataSource":"https://github.com/advisories/GHSA-qwph-4952-7xr6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23540","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00017,"percentile":0.03952,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23540","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23540","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00969},"relatedVulnerabilities":[{"id":"CVE-2022-23540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23540","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00017,"percentile":0.03952,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23540","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23540","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-qwph-4952-7xr6","versionConstraint":"<9.0.0 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qwph-4952-7xr6","dataSource":"https://github.com/advisories/GHSA-qwph-4952-7xr6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23540","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00017,"percentile":0.03952,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23540","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23540","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00969},"relatedVulnerabilities":[{"id":"CVE-2022-23540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23540","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00017,"percentile":0.03952,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-23540","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23540","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-qwph-4952-7xr6","versionConstraint":"<9.0.0 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00013,"percentile":0.02119,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-02-18","kind":"first-observed"}]},"advisories":[],"risk":0.009489999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00013,"percentile":0.02119,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"f42c59d94c10b95d","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00013,"percentile":0.02119,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-02-18","kind":"first-observed"}]},"advisories":[],"risk":0.009489999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00013,"percentile":0.02119,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"09de397807f7641f","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00013,"percentile":0.02119,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-02-18","kind":"first-observed"}]},"advisories":[],"risk":0.009489999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00013,"percentile":0.02119,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.4.3"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"328bcb4be5561b99","name":"tar","version":"7.4.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:7.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:7.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00012,"percentile":0.01838,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00942},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00012,"percentile":0.01838,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"f42c59d94c10b95d","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00012,"percentile":0.01838,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00942},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00012,"percentile":0.01838,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"09de397807f7641f","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00012,"percentile":0.01838,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00942},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00012,"percentile":0.01838,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.4.3"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"328bcb4be5561b99","name":"tar","version":"7.4.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:7.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:7.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-fjgf-rc76-4x9p","dataSource":"https://github.com/advisories/GHSA-fjgf-rc76-4x9p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p","https://nvd.nist.gov/vuln/detail/CVE-2025-7338","https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b","https://cna.openjsf.org/security-advisories.html"],"description":"Multer vulnerable to Denial of Service via unhandled exception from malformed request","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7338","epss":0.00012,"percentile":0.01491,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-7338","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.0.2"],"state":"fixed","available":[{"version":"2.0.2","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.009000000000000001},"relatedVulnerabilities":[{"id":"CVE-2025-7338","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7338","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b","https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.2 to receive a patch. No known workarounds are available.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7338","epss":0.00012,"percentile":0.01491,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-7338","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-fjgf-rc76-4x9p","versionConstraint":">=1.4.4-lts.1,<2.0.2 (semantic)"},"fix":{"suggestedVersion":"2.0.2"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-4pg4-qvpc-4q3h","dataSource":"https://github.com/advisories/GHSA-4pg4-qvpc-4q3h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h","https://nvd.nist.gov/vuln/detail/CVE-2025-47944","https://github.com/expressjs/multer/issues/1176","https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665"],"description":"Multer vulnerable to Denial of Service from maliciously crafted requests","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47944","epss":0.00011,"percentile":0.01432,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-47944","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.0"],"state":"fixed","available":[{"version":"2.0.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00825},"relatedVulnerabilities":[{"id":"CVE-2025-47944","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47944","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665","https://github.com/expressjs/multer/issues/1176","https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47944","epss":0.00011,"percentile":0.01432,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-47944","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-4pg4-qvpc-4q3h","versionConstraint":">=1.4.4-lts.1,<2.0.0 (semantic)"},"fix":{"suggestedVersion":"2.0.0"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-22795","dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-22795","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read. The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For these reasons, the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22795","epss":0.00015,"percentile":0.03073,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-22795","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.007874999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-22795","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22795","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22795","epss":0.00015,"percentile":0.03073,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-22795","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2026-22795","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2025-68160","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68160","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line applications, it is typically only pushed onto stdout/stderr on VMS systems. Third-party applications that explicitly use this filter with a BIO chain that can short-write and that write large, newline-free data influenced by an attacker would be affected. However, the circumstances where this could happen are unlikely to be under attacker control, and BIO_f_linebuffer is unlikely to be handling non-curated data controlled by an attacker. For that reason the issue was assessed as Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the BIO implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68160","epss":0.00014,"percentile":0.02559,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-68160","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.00679},"relatedVulnerabilities":[{"id":"CVE-2025-68160","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68160","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/commit/384011202af92605d926fafe4a0bcd6b65d162ad","https://github.com/openssl/openssl/commit/475c466ef2fbd8fc1df6fae1c3eed9c813fc8ff6","https://github.com/openssl/openssl/commit/4c96fbba618e1940f038012506ee9e21d32ee12c","https://github.com/openssl/openssl/commit/6845c3b6460a98b1ec4e463baa2ea1a63a32d7c0","https://github.com/openssl/openssl/commit/68a7cd2e2816c3a02f4d45a2ce43fc04fac97096","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a BIO chain that can short-write and that\nwrite large, newline-free data influenced by an attacker would be affected.\nHowever, the circumstances where this could happen are unlikely to be under\nattacker control, and BIO_f_linebuffer is unlikely to be handling non-curated\ndata controlled by an attacker. For that reason the issue was assessed as\nLow severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the BIO implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68160","epss":0.00014,"percentile":0.02559,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-68160","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-68160","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-869p-cjfg-cm3x","dataSource":"https://github.com/advisories/GHSA-869p-cjfg-cm3x","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x","https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e","https://github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6","https://github.com/auth0/node-jws/releases/tag/v3.2.3","https://github.com/auth0/node-jws/releases/tag/v4.0.1","https://nvd.nist.gov/vuln/detail/CVE-2025-65945"],"description":"auth0/node-jws Improperly Verifies HMAC Signature","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-65945","epss":0.00009,"percentile":0.00911,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-65945","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.2.3"],"state":"fixed","available":[{"version":"3.2.3","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00675},"relatedVulnerabilities":[{"id":"CVE-2025-65945","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-65945","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e","https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x"],"description":"auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-65945","epss":0.00009,"percentile":0.00911,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-65945","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jws","version":"0.2.6"}},"found":{"vulnerabilityID":"GHSA-869p-cjfg-cm3x","versionConstraint":"<3.2.3 (semantic)"},"fix":{"suggestedVersion":"3.2.3"}}],"artifact":{"id":"e3ae0c46d846c3b2","name":"jws","version":"0.2.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/jws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jws/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:brianloveswords:jws:0.2.6:*:*:*:*:*:*:*","cpe:2.3:a:jws:jws:0.2.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/jws@0.2.6","upstreams":[]}},{"vulnerability":{"id":"CVE-2019-1010022","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[],"epss":[{"cve":"CVE-2019-1010022","epss":0.00131,"percentile":0.32792,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.00655},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","namespace":"nvd:cpe","severity":"Critical","urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022"],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010022","epss":0.00131,"percentile":0.32792,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-w7fw-mjwx-w883","dataSource":"https://github.com/advisories/GHSA-w7fw-mjwx-w883","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://nvd.nist.gov/vuln/detail/CVE-2026-2391","https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482"],"description":"qs's arrayLimit bypass in comma parsing allows denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00019,"percentile":0.04599,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.2"],"state":"fixed","available":[{"version":"6.14.2","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.006365},"relatedVulnerabilities":[{"id":"CVE-2026-2391","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2391","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883"],"description":"### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.\n\n**Vulnerable code** (lib/parse.js: lines ~40-50):\n```js\nif (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {\n    return val.split(',');\n}\n\nif (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {\n    throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');\n}\n\nreturn val;\n```\nThe `split(',')` returns the array immediately, skipping the subsequent limit check. Downstream merging via `utils.combine` does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., `?param=,,,,,,,,...`), allocating massive arrays in memory without triggering limits. It bypasses the intent of `arrayLimit`, which is enforced correctly for indexed (`a[0]=`) and bracket (`a[]=`) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).\n\n### PoC\n**Test 1 - Basic bypass:**\n```\nnpm install qs\n```\n\n```js\nconst qs = require('qs');\n\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\n\ntry {\n  const result = qs.parse(payload, options);\n  console.log(result.a.length); // Outputs: 26 (bypass successful)\n} catch (e) {\n  console.log('Limit enforced:', e.message); // Not thrown\n}\n```\n**Configuration:**\n- `comma: true`\n- `arrayLimit: 5`\n- `throwOnLimitExceeded: true`\n\nExpected: Throws \"Array limit exceeded\" error.\nActual: Parses successfully, creating an array of length 26.\n\n\n### Impact\nDenial of Service (DoS) via memory exhaustion.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00019,"percentile":0.04599,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.13.0"}},"found":{"vulnerabilityID":"GHSA-w7fw-mjwx-w883","versionConstraint":">=6.7.0,<=6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.2"}}],"artifact":{"id":"f1485a5d8cce1397","name":"qs","version":"6.13.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/qs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.13.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-73rr-hh4g-fpgx","dataSource":"https://github.com/advisories/GHSA-73rr-hh4g-fpgx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://nvd.nist.gov/vuln/detail/CVE-2026-24001"],"description":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.0002,"percentile":0.04878,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.0.4"],"state":"fixed","available":[{"version":"4.0.4","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.005700000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-24001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx"],"description":"jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its \"leading garbage\"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\\r`, `\\u2028`, or `\\u2029`.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.0002,"percentile":0.04878,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"diff","version":"4.0.2"}},"found":{"vulnerabilityID":"GHSA-73rr-hh4g-fpgx","versionConstraint":">=4.0.0,<4.0.4 (semantic)"},"fix":{"suggestedVersion":"4.0.4"}}],"artifact":{"id":"a4cf03c6615f9d2d","name":"diff","version":"4.0.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/diff/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/diff/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:kpdecker:diff:4.0.2:*:*:*:*:*:*:*","cpe:2.3:a:diff:diff:4.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/diff@4.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.00306,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00489},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.00306,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"f42c59d94c10b95d","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.00306,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00489},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.00306,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"09de397807f7641f","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.00306,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00489},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.00306,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.4.3"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"328bcb4be5561b99","name":"tar","version":"7.4.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:7.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:7.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.4.3","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-0861","dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-0861","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-0861","epss":0.00006,"percentile":0.00337,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-0861","cwe":"CWE-190","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.00477},"relatedVulnerabilities":[{"id":"CVE-2026-0861","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0861","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33796","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001","http://www.openwall.com/lists/oss-security/2026/01/16/5"],"description":"Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-0861","epss":0.00006,"percentile":0.00337,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-0861","cwe":"CWE-190","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2026-0861","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00006,"percentile":0.00284,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00471},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00006,"percentile":0.00284,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"f42c59d94c10b95d","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00006,"percentile":0.00284,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00471},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00006,"percentile":0.00284,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"09de397807f7641f","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00006,"percentile":0.00284,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0.00471},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00006,"percentile":0.00284,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.4.3"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"328bcb4be5561b99","name":"tar","version":"7.4.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:7.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:7.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.4.3","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-55132","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55132","namespace":"nvd:cpe","severity":"Medium","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.8,"exploitabilityScore":1.4,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-55132","epss":0.00009,"percentile":0.00787,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-55132","cwe":"CWE-276","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.0040725},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2025-55132","versionConstraint":">= 20, < 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-8058","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-8058","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-8058","epss":0.00007,"percentile":0.00495,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-8058","cwe":"CWE-415","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":["2.36-9+deb12u13"],"state":"fixed","available":[{"version":"2.36-9+deb12u13","date":"2025-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.003815},"relatedVulnerabilities":[{"id":"CVE-2025-8058","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8058","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33185","https://sourceware.org/git/?p=glibc.git;a=commit;h=3ff17af18c38727b88d9115e536c069e6b5d601f","http://www.openwall.com/lists/oss-security/2025/07/23/1"],"description":"The regcomp function in the GNU C library version from 2.4 to 2.41 is \nsubject to a double free if some previous allocation fails. It can be \naccomplished either by a malloc failure or by using an interposed malloc\n that injects random malloc failures. The double free can allow buffer \nmanipulation depending of how the regex is constructed. This issue \naffects all architectures and ABIs supported by the GNU C library.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-8058","epss":0.00007,"percentile":0.00495,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-8058","cwe":"CWE-415","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-8058","versionConstraint":"< 2.36-9+deb12u13 (deb)"},"fix":{"suggestedVersion":"2.36-9+deb12u13"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2025-27587","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-27587","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","cvss":[],"epss":[{"cve":"CVE-2025-27587","epss":0.00051,"percentile":0.15859,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-27587","cwe":"CWE-385","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.00255},"relatedVulnerabilities":[{"id":"CVE-2025-27587","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27587","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/issues/24253","https://minerva.crocs.fi.muni.cz"],"description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27587","epss":0.00051,"percentile":0.15859,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-27587","cwe":"CWE-385","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-27587","versionConstraint":"none (unknown)"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15439,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0025},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15439,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"0a534483a88e1e33","name":"gcc-12-base","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/gcc-12-base","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/var/lib/dpkg/status.d/gcc-12-base","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/gcc-12-base.md5sums","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/var/lib/dpkg/status.d/gcc-12-base.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15439,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0025},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15439,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"74f0cf86f14f0675","name":"libgcc-s1","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libgcc-s1","layerID":"sha256:c3abae442368dc447f15c468933843c361f227f5d87b2bb86515b49f40583ed9","accessPath":"/var/lib/dpkg/status.d/libgcc-s1","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libgcc-s1.md5sums","layerID":"sha256:c3abae442368dc447f15c468933843c361f227f5d87b2bb86515b49f40583ed9","accessPath":"/var/lib/dpkg/status.d/libgcc-s1.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15439,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0025},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15439,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"cd7473971e9d06dd","name":"libgomp1","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libgomp1","layerID":"sha256:2401c5ea32a75452bc4b02a664c80cf63f197704653926fca19e22e6cbc85652","accessPath":"/var/lib/dpkg/status.d/libgomp1","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/status.d/libgomp1.md5sums","layerID":"sha256:2401c5ea32a75452bc4b02a664c80cf63f197704653926fca19e22e6cbc85652","accessPath":"/var/lib/dpkg/status.d/libgomp1.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:libgomp1:libgomp1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libgomp1@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15439,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0025},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15439,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"9a37debf0d05047e","name":"libstdc++6","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libstdc++6","layerID":"sha256:6819a1af097df543d58dc30b51f737e55f3f42a9a04e641f175834a55bf0629c","accessPath":"/var/lib/dpkg/status.d/libstdc++6","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/status.d/libstdc++6.md5sums","layerID":"sha256:6819a1af097df543d58dc30b51f737e55f3f42a9a04e641f175834a55bf0629c","accessPath":"/var/lib/dpkg/status.d/libstdc++6.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2025-69418","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69418","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the buffer while
leaving the actual trailing bytes unprocessed. The authentication checksum
also excludes the true tail bytes.
However, typical OpenSSL consumers using EVP are not affected because the
higher-level EVP and provider OCB implementations split inputs so that full
blocks and trailing partial blocks are processed in separate calls, avoiding
the problematic code path. Additionally, TLS does not use OCB ciphersuites.
The vulnerability only affects applications that call the low-level
CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with
non-block-aligned lengths in a single call on hardware-accelerated builds.
For these reasons the issue was assessed as Low severity.
The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected
by this issue, as OCB mode is not a FIPS-approved algorithm.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
OpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4,"exploitabilityScore":1.5,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69418","epss":0.00005,"percentile":0.00212,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-69418","cwe":"CWE-325","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.0022500000000000003},"relatedVulnerabilities":[{"id":"CVE-2025-69418","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69418","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffc","https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8","https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347","https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5ae","https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the buffer while
leaving the actual trailing bytes unprocessed. The authentication checksum
also excludes the true tail bytes.
However, typical OpenSSL consumers using EVP are not affected because the
higher-level EVP and provider OCB implementations split inputs so that full
blocks and trailing partial blocks are processed in separate calls, avoiding
the problematic code path. Additionally, TLS does not use OCB ciphersuites.
The vulnerability only affects applications that call the low-level
CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with
non-block-aligned lengths in a single call on hardware-accelerated builds.
For these reasons the issue was assessed as Low severity.
The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected
by this issue, as OCB mode is not a FIPS-approved algorithm.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
OpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4,"exploitabilityScore":1.5,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69418","epss":0.00005,"percentile":0.00212,"date":"2026-02-23"}],"cwes":[{"cve":"CVE-2025-69418","cwe":"CWE-325","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-69418","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-5mrr-rgp6-x4gr","dataSource":"https://github.com/advisories/GHSA-5mrr-rgp6-x4gr","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/bkimminich/juice-shop/issues/1173","https://www.npmjs.com/advisories/1122"],"description":"Command Injection in marsdb","cvss":[],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"marsdb","version":"0.6.11"}},"found":{"vulnerabilityID":"GHSA-5mrr-rgp6-x4gr","versionConstraint":">=0.0.0 (semantic)"}}],"artifact":{"id":"92d5870e9d43058d","name":"marsdb","version":"0.6.11","type":"npm","locations":[{"path":"/juice-shop/node_modules/marsdb/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/marsdb/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:marsdb:marsdb:0.6.11:*:*:*:*:*:*:*","cpe:2.3:a:c58:marsdb:0.6.11:*:*:*:*:*:*:*"],"purl":"pkg:npm/marsdb@0.6.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-gjcw-v447-2w7q","dataSource":"https://github.com/advisories/GHSA-gjcw-v447-2w7q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/brianloveswords/node-jws/commit/585d0e1e97b6747c10cf5b7689ccc5618a89b299#diff-4ac32a78649ca5bdd8e0ba38b7006a1e","https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://www.npmjs.com/advisories/88","https://nvd.nist.gov/vuln/detail/CVE-2016-1000223","https://snyk.io/vuln/npm:jws:20160726"],"description":"Forgeable Public/Private Tokens in jws","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"exploitabilityScore":2.3,"impactScore":5.8},"vendorMetadata":{}}],"fix":{"versions":["3.0.0"],"state":"fixed","available":[{"version":"3.0.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2016-1000223","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jws","version":"0.2.6"}},"found":{"vulnerabilityID":"GHSA-gjcw-v447-2w7q","versionConstraint":"<3.0.0 (semantic)"},"fix":{"suggestedVersion":"3.0.0"}}],"artifact":{"id":"e3ae0c46d846c3b2","name":"jws","version":"0.2.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/jws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jws/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:brianloveswords:jws:0.2.6:*:*:*:*:*:*:*","cpe:2.3:a:jws:jws:0.2.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/jws@0.2.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-rvg8-pwq2-xj7q","dataSource":"https://github.com/advisories/GHSA-rvg8-pwq2-xj7q","namespace":"github:language:javascript","severity":"Medium","urls":["https://hackerone.com/reports/321687","https://github.com/brianloveswords/base64url/pull/25","https://github.com/brianloveswords/base64url/commit/4fbd954a0a69e9d898de2146557cc6e893e79542"],"description":"Out-of-bounds Read in base64url","cvss":[],"fix":{"versions":["3.0.0"],"state":"fixed","available":[{"version":"3.0.0","date":"2026-02-13","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"base64url","version":"0.0.6"}},"found":{"vulnerabilityID":"GHSA-rvg8-pwq2-xj7q","versionConstraint":"<3.0.0 (semantic)"},"fix":{"suggestedVersion":"3.0.0"}}],"artifact":{"id":"2f8a9d6c7656ba10","name":"base64url","version":"0.0.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/base64url/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64url/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:brianloveswords:base64url:0.0.6:*:*:*:*:*:*:*","cpe:2.3:a:base64url:base64url:0.0.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/base64url@0.0.6","upstreams":[]}}],"source":{"type":"image","target":{"userInput":"bkimminich/juice-shop:v19.0.0","imageID":"sha256:37cc73163c4c269c044e890fee868d62637109cad126a26dab13dc442ef2ae76","manifestDigest":"sha256:547abd35794ef5435213b0bbd658d2e3f55528b390126334445124201eeefc1f","mediaType":"application/vnd.docker.distribution.manifest.v2+json","tags":["bkimminich/juice-shop:v19.0.0"],"imageSize":421051540,"layers":[{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","size":270682},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:8fa10c0194df9b7c054c90dbe482585f768a54428fc90a5b78a0066a123b1bba","size":22888},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:48c0fb67386ed713921fcc0468be23231d0872fa67ccc8ea3929df4656b6ddfc","size":1462778},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:114dde0fefebbca13165d0da9c500a66190e497a82a53dcaabc3172d630be1e9","size":82129},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:4d049f83d9cf21d1f5cc0e11deaf36df02790d0e60c1a3829538fb4b61685368","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:af5aa97ebe6ce1604747ec1e21af7136ded391bcabe4acef882e718a87c86bcc","size":149},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:6f1cdceb6a3146f0ccb986521156bef8a422cdbb0863396f7f751f575ba308f4","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:bbb6cacb8c82e4da4e8143e03351e939eab5e21ce0ef333c42e637af86c5217b","size":64},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2a92d6ac9e4fcc274d5168b217ca4458a9fec6f094ead68d99c77073f08caac1","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:1a73b54f556b477f0a8b939d13c504a3b4f4db71f7a09c63afbc10acb3de5849","size":497},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:f4aee9e53c42a22ed82451218c3ea03d1eea8d6ca8fbe8eb4e950304ba8a8bb3","size":346},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:bfe9137a1b044e8097cdfcb6899137a8a984ed70931ed1e8ef0cf7e023a139fc","size":235531},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","size":12820707},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","size":5901043},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","size":94016},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2401c5ea32a75452bc4b02a664c80cf63f197704653926fca19e22e6cbc85652","size":291001},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:6819a1af097df543d58dc30b51f737e55f3f42a9a04e641f175834a55bf0629c","size":2311333},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:c3abae442368dc447f15c468933843c361f227f5d87b2bb86515b49f40583ed9","size":126113},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","size":121755661},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:3cd50cf8b20753e35bd3d82fb45a6a248ae993d889e104e0be02d309d2accbdc","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","size":275676602}],"manifest":"eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo1MzA5LCJkaWdlc3QiOiJzaGEyNTY6MzdjYzczMTYzYzRjMjY5YzA0NGU4OTBmZWU4NjhkNjI2MzcxMDljYWQxMjZhMjZkYWIxM2RjNDQyZWYyYWU3NiJ9LCJsYXllcnMiOlt7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoxMDQyMjYsImRpZ2VzdCI6InNoYTI1NjpmNDY0YWY0YjliMjUxZWJlOGE3YzJmMTg2YWZmNjU2ZjA4OTJmNmNiMTU5ODM3YTZjZThmZDYzODQyZTgzZTM1In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MTMzNTYsImRpZ2VzdCI6InNoYTI1Njo4ZmExMGMwMTk0ZGY5YjdjMDU0YzkwZGJlNDgyNTg1Zjc2OGE1NDQyOGZjOTBhNWI3OGEwMDY2YTEyM2IxYmJhIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6NTQ3NTkzLCJkaWdlc3QiOiJzaGEyNTY6NDhjMGZiNjczODZlZDcxMzkyMWZjYzA0NjhiZTIzMjMxZDA4NzJmYTY3Y2NjOGVhMzkyOWRmNDY1NmI2ZGRmYyJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjMxMjQwLCJkaWdlc3QiOiJzaGEyNTY6MTE0ZGRlMGZlZmViYmNhMTMxNjVkMGRhOWM1MDBhNjYxOTBlNDk3YTgyYTUzZGNhYWJjMzE3MmQ2MzBiZTFlOSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjY3LCJkaWdlc3QiOiJzaGEyNTY6NGQwNDlmODNkOWNmMjFkMWY1Y2MwZTExZGVhZjM2ZGYwMjc5MGQwZTYwYzFhMzgyOTUzOGZiNGI2MTY4NTM2OCJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjE4OCwiZGlnZXN0Ijoic2hhMjU2OmFmNWFhOTdlYmU2Y2UxNjA0NzQ3ZWMxZTIxYWY3MTM2ZGVkMzkxYmNhYmU0YWNlZjg4MmU3MThhODdjODZiY2MifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoxMjMsImRpZ2VzdCI6InNoYTI1Njo2ZjFjZGNlYjZhMzE0NmYwY2NiOTg2NTIxMTU2YmVmOGE0MjJjZGJiMDg2MzM5NmY3Zjc1MWY1NzViYTMwOGY0In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MTY4LCJkaWdlc3QiOiJzaGEyNTY6YmJiNmNhY2I4YzgyZTRkYTRlODE0M2UwMzM1MWU5MzllYWI1ZTIxY2UwZWYzMzNjNDJlNjM3YWY4NmM1MjE3YiJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjkzLCJkaWdlc3QiOiJzaGEyNTY6MmE5MmQ2YWM5ZTRmY2MyNzRkNTE2OGIyMTdjYTQ0NThhOWZlYzZmMDk0ZWFkNjhkOTljNzcwNzNmMDhjYWFjMSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjM4NSwiZGlnZXN0Ijoic2hhMjU2OjFhNzNiNTRmNTU2YjQ3N2YwYThiOTM5ZDEzYzUwNGEzYjRmNGRiNzFmN2EwOWM2M2FmYmMxMGFjYjNkZTU4NDkifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjozMjEsImRpZ2VzdCI6InNoYTI1NjpmNGFlZTllNTNjNDJhMjJlZDgyNDUxMjE4YzNlYTAzZDFlZWE4ZDZjYThmYmU4ZWI0ZTk1MDMwNGJhOGE4YmIzIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MTMxOTI3LCJkaWdlc3QiOiJzaGEyNTY6YmZlOTEzN2ExYjA0NGU4MDk3Y2RmY2I2ODk5MTM3YThhOTg0ZWQ3MDkzMWVkMWU4ZWYwY2Y3ZTAyM2ExMzlmYyJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjU4MzAyMTQsImRpZ2VzdCI6InNoYTI1NjpkNWEzZTAxNDE2MWJiNjAyZDg3YzIzMTJlMzcxYWQyZWE2ZjgwMGM3ZjdhZjI2MWFmNGZhYTY3MzAyYjUzYzg4In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjgyNzIyNSwiZGlnZXN0Ijoic2hhMjU2OjJlNDk4M2M3NjFjZTQ5MzNlY2VjMjNjMzExNzNmZWQ1NTFhMjM3YzhkMGJhMzU5YjY5N2RlNjRiZDk1M2E3YzMifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjo0NDk4MywiZGlnZXN0Ijoic2hhMjU2OjcwOTU0MTI0MTdkMmRjZTI4OWI3N2Y3YThjNjMyYTA3YzgyYjcwN2ZlNDNjZmVmNzM2OGMzYjY1YzhkMjUzOGEifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoxNTA4MDgsImRpZ2VzdCI6InNoYTI1NjoyNDAxYzVlYTMyYTc1NDUyYmM0YjAyYTY2NGM4MGNmNjNmMTk3NzA0NjUzOTI2ZmNhMTllMjJlNmNiYzg1NjUyIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6OTExODEyLCJkaWdlc3QiOiJzaGEyNTY6NjgxOWExYWYwOTdkZjU0M2Q1OGRjMzBiNTFmNzM3ZTU1ZjNmNDJhOWEwNGU2NDFmMTc1ODM0YTU1YmYwNjI5YyJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjY1MTE2LCJkaWdlc3QiOiJzaGEyNTY6YzNhYmFlNDQyMzY4ZGM0NDdmMTVjNDY4OTMzODQzYzM2MWYyMjdmNWQ4N2IyYmI4NjUxNWI0OWY0MDU4M2VkOSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjUwNjUzMzgyLCJkaWdlc3QiOiJzaGEyNTY6MmY1MjM5YzdiMmJmYmRhM2UyNzVhMDUzY2EwODY1ZmM0Y2I4YWFkNmQxZmQ1YWNhMjJkM2UxZTU0ZjMyZGY5OSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjEwMCwiZGlnZXN0Ijoic2hhMjU2OjNjZDUwY2Y4YjIwNzUzZTM1YmQzZDgyZmI0NWE2YTI0OGFlOTkzZDg4OWUxMDRlMGJlMDJkMzA5ZDJhY2NiZGMifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjo5NzA3NTI0MCwiZGlnZXN0Ijoic2hhMjU2OjFlOGRhNjU0YjJlMDU3ZWY0M2YyNjM4NGFhOWM3MWQyYmRhZmRjNGRlMDI0OGNmMWNmZDQ0YzQ4Njc1NTkxMjMifV19","config":"eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJVc2VyIjoiNjU1MzIiLCJFeHBvc2VkUG9ydHMiOnsiMzAwMC90Y3AiOnt9fSwiRW52IjpbIlBBVEg9L3Vzci9sb2NhbC9zYmluOi91c3IvbG9jYWwvYmluOi91c3Ivc2JpbjovdXNyL2Jpbjovc2JpbjovYmluIiwiU1NMX0NFUlRfRklMRT0vZXRjL3NzbC9jZXJ0cy9jYS1jZXJ0aWZpY2F0ZXMuY3J0Il0sIkVudHJ5cG9pbnQiOlsiL25vZGVqcy9iaW4vbm9kZSJdLCJDbWQiOlsiL2p1aWNlLXNob3AvYnVpbGQvYXBwLmpzIl0sIldvcmtpbmdEaXIiOiIvanVpY2Utc2hvcCIsIkxhYmVscyI6eyJtYWludGFpbmVyIjoiQmpvZXJuIEtpbW1pbmljaCBcdTAwM2Niam9lcm4ua2ltbWluaWNoQG93YXNwLm9yZ1x1MDAzZSIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5hdXRob3JzIjoiQmpvZXJuIEtpbW1pbmljaCBcdTAwM2Niam9lcm4ua2ltbWluaWNoQG93YXNwLm9yZ1x1MDAzZSIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5jcmVhdGVkIjoi4oCdMjAyNS0wOS0wNFQwNTozODoxMVrigJ0iLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuZGVzY3JpcHRpb24iOiJQcm9iYWJseSB0aGUgbW9zdCBtb2Rlcm4gYW5kIHNvcGhpc3RpY2F0ZWQgaW5zZWN1cmUgd2ViIGFwcGxpY2F0aW9uIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRvY3VtZW50YXRpb24iOiJodHRwczovL2hlbHAub3dhc3AtanVpY2Uuc2hvcCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5saWNlbnNlcyI6Ik1JVCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5yZXZpc2lvbiI6IjM2ODcwY2IiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2Uuc291cmNlIjoiaHR0cHM6Ly9naXRodWIuY29tL2p1aWNlLXNob3AvanVpY2Utc2hvcCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS50aXRsZSI6Ik9XQVNQIEp1aWNlIFNob3AiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudXJsIjoiaHR0cHM6Ly9vd2FzcC1qdWljZS5zaG9wIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlbmRvciI6Ik9wZW4gV29ybGR3aWRlIEFwcGxpY2F0aW9uIFNlY3VyaXR5IFByb2plY3QiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVyc2lvbiI6IjE5LjAuMCJ9LCJBcmdzRXNjYXBlZCI6dHJ1ZX0sImNyZWF0ZWQiOiIyMDI1LTA5LTA0VDA1OjQyOjI3LjI1NDQyNzU5NloiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIyMDI1LTA5LTA0VDA1OjM4OjE4Ljg4MDcyMTk0MloiLCJjcmVhdGVkX2J5IjoiQVJHIEJVSUxEX0RBVEU94oCdMjAyNS0wOS0wNFQwNTozODoxMVrigJ0iLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI1LTA5LTA0VDA1OjM4OjE4Ljg4MDcyMTk0MloiLCJjcmVhdGVkX2J5IjoiQVJHIFZDU19SRUY9MzY4NzBjYiIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjUtMDktMDRUMDU6Mzg6MTguODgwNzIxOTQyWiIsImNyZWF0ZWRfYnkiOiJMQUJFTCBtYWludGFpbmVyPUJqb2VybiBLaW1taW5pY2ggXHUwMDNjYmpvZXJuLmtpbW1pbmljaEBvd2FzcC5vcmdcdTAwM2Ugb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnRpdGxlPU9XQVNQIEp1aWNlIFNob3Agb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRlc2NyaXB0aW9uPVByb2JhYmx5IHRoZSBtb3N0IG1vZGVybiBhbmQgc29waGlzdGljYXRlZCBpbnNlY3VyZSB3ZWIgYXBwbGljYXRpb24gb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmF1dGhvcnM9QmpvZXJuIEtpbW1pbmljaCBcdTAwM2Niam9lcm4ua2ltbWluaWNoQG93YXNwLm9yZ1x1MDAzZSBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVuZG9yPU9wZW4gV29ybGR3aWRlIEFwcGxpY2F0aW9uIFNlY3VyaXR5IFByb2plY3Qgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRvY3VtZW50YXRpb249aHR0cHM6Ly9oZWxwLm93YXNwLWp1aWNlLnNob3Agb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmxpY2Vuc2VzPU1JVCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVyc2lvbj0xOS4wLjAgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnVybD1odHRwczovL293YXNwLWp1aWNlLnNob3Agb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnNvdXJjZT1odHRwczovL2dpdGh1Yi5jb20vanVpY2Utc2hvcC9qdWljZS1zaG9wIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5yZXZpc2lvbj0zNjg3MGNiIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5jcmVhdGVkPeKAnTIwMjUtMDktMDRUMDU6Mzg6MTFa4oCdIiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNS0wOS0wNFQwNTozODoxOC44ODA3MjE5NDJaIiwiY3JlYXRlZF9ieSI6IldPUktESVIgL2p1aWNlLXNob3AiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjUtMDktMDRUMDU6NDI6MjcuMjU0NDI3NTk2WiIsImNyZWF0ZWRfYnkiOiJDT1BZIC0tY2hvd249NjU1MzI6MCAvanVpY2Utc2hvcCAuICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjUtMDktMDRUMDU6NDI6MjcuMjU0NDI3NTk2WiIsImNyZWF0ZWRfYnkiOiJVU0VSIDY1NTMyIiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNS0wOS0wNFQwNTo0MjoyNy4yNTQ0Mjc1OTZaIiwiY3JlYXRlZF9ieSI6IkVYUE9TRSBtYXBbMzAwMC90Y3A6e31dIiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNS0wOS0wNFQwNTo0MjoyNy4yNTQ0Mjc1OTZaIiwiY3JlYXRlZF9ieSI6IkNNRCBbXCIvanVpY2Utc2hvcC9idWlsZC9hcHAuanNcIl0iLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfV0sIm9zIjoibGludXgiLCJyb290ZnMiOnsidHlwZSI6ImxheWVycyIsImRpZmZfaWRzIjpbInNoYTI1NjpmNDY0YWY0YjliMjUxZWJlOGE3YzJmMTg2YWZmNjU2ZjA4OTJmNmNiMTU5ODM3YTZjZThmZDYzODQyZTgzZTM1Iiwic2hhMjU2OjhmYTEwYzAxOTRkZjliN2MwNTRjOTBkYmU0ODI1ODVmNzY4YTU0NDI4ZmM5MGE1Yjc4YTAwNjZhMTIzYjFiYmEiLCJzaGEyNTY6NDhjMGZiNjczODZlZDcxMzkyMWZjYzA0NjhiZTIzMjMxZDA4NzJmYTY3Y2NjOGVhMzkyOWRmNDY1NmI2ZGRmYyIsInNoYTI1NjoxMTRkZGUwZmVmZWJiY2ExMzE2NWQwZGE5YzUwMGE2NjE5MGU0OTdhODJhNTNkY2FhYmMzMTcyZDYzMGJlMWU5Iiwic2hhMjU2OjRkMDQ5ZjgzZDljZjIxZDFmNWNjMGUxMWRlYWYzNmRmMDI3OTBkMGU2MGMxYTM4Mjk1MzhmYjRiNjE2ODUzNjgiLCJzaGEyNTY6YWY1YWE5N2ViZTZjZTE2MDQ3NDdlYzFlMjFhZjcxMzZkZWQzOTFiY2FiZTRhY2VmODgyZTcxOGE4N2M4NmJjYyIsInNoYTI1Njo2ZjFjZGNlYjZhMzE0NmYwY2NiOTg2NTIxMTU2YmVmOGE0MjJjZGJiMDg2MzM5NmY3Zjc1MWY1NzViYTMwOGY0Iiwic2hhMjU2OmJiYjZjYWNiOGM4MmU0ZGE0ZTgxNDNlMDMzNTFlOTM5ZWFiNWUyMWNlMGVmMzMzYzQyZTYzN2FmODZjNTIxN2IiLCJzaGEyNTY6MmE5MmQ2YWM5ZTRmY2MyNzRkNTE2OGIyMTdjYTQ0NThhOWZlYzZmMDk0ZWFkNjhkOTljNzcwNzNmMDhjYWFjMSIsInNoYTI1NjoxYTczYjU0ZjU1NmI0NzdmMGE4YjkzOWQxM2M1MDRhM2I0ZjRkYjcxZjdhMDljNjNhZmJjMTBhY2IzZGU1ODQ5Iiwic2hhMjU2OmY0YWVlOWU1M2M0MmEyMmVkODI0NTEyMThjM2VhMDNkMWVlYThkNmNhOGZiZThlYjRlOTUwMzA0YmE4YThiYjMiLCJzaGEyNTY6YmZlOTEzN2ExYjA0NGU4MDk3Y2RmY2I2ODk5MTM3YThhOTg0ZWQ3MDkzMWVkMWU4ZWYwY2Y3ZTAyM2ExMzlmYyIsInNoYTI1NjpkNWEzZTAxNDE2MWJiNjAyZDg3YzIzMTJlMzcxYWQyZWE2ZjgwMGM3ZjdhZjI2MWFmNGZhYTY3MzAyYjUzYzg4Iiwic2hhMjU2OjJlNDk4M2M3NjFjZTQ5MzNlY2VjMjNjMzExNzNmZWQ1NTFhMjM3YzhkMGJhMzU5YjY5N2RlNjRiZDk1M2E3YzMiLCJzaGEyNTY6NzA5NTQxMjQxN2QyZGNlMjg5Yjc3ZjdhOGM2MzJhMDdjODJiNzA3ZmU0M2NmZWY3MzY4YzNiNjVjOGQyNTM4YSIsInNoYTI1NjoyNDAxYzVlYTMyYTc1NDUyYmM0YjAyYTY2NGM4MGNmNjNmMTk3NzA0NjUzOTI2ZmNhMTllMjJlNmNiYzg1NjUyIiwic2hhMjU2OjY4MTlhMWFmMDk3ZGY1NDNkNThkYzMwYjUxZjczN2U1NWYzZjQyYTlhMDRlNjQxZjE3NTgzNGE1NWJmMDYyOWMiLCJzaGEyNTY6YzNhYmFlNDQyMzY4ZGM0NDdmMTVjNDY4OTMzODQzYzM2MWYyMjdmNWQ4N2IyYmI4NjUxNWI0OWY0MDU4M2VkOSIsInNoYTI1NjoyZjUyMzljN2IyYmZiZGEzZTI3NWEwNTNjYTA4NjVmYzRjYjhhYWQ2ZDFmZDVhY2EyMmQzZTFlNTRmMzJkZjk5Iiwic2hhMjU2OjNjZDUwY2Y4YjIwNzUzZTM1YmQzZDgyZmI0NWE2YTI0OGFlOTkzZDg4OWUxMDRlMGJlMDJkMzA5ZDJhY2NiZGMiLCJzaGEyNTY6MWU4ZGE2NTRiMmUwNTdlZjQzZjI2Mzg0YWE5YzcxZDJiZGFmZGM0ZGUwMjQ4Y2YxY2ZkNDRjNDg2NzU1OTEyMyJdfX0=","repoDigests":["bkimminich/juice-shop@sha256:2765a26de7647609099a338d5b7f61085d95903c8703bb70f03fcc4b12f0818d"],"architecture":"amd64","os":"linux","labels":{"maintainer":"Bjoern Kimminich ","org.opencontainers.image.authors":"Bjoern Kimminich ","org.opencontainers.image.created":"ΓÇ¥2025-09-04T05:38:11ZΓÇ¥","org.opencontainers.image.description":"Probably the most modern and sophisticated insecure web application","org.opencontainers.image.documentation":"https://help.owasp-juice.shop","org.opencontainers.image.licenses":"MIT","org.opencontainers.image.revision":"36870cb","org.opencontainers.image.source":"https://github.com/juice-shop/juice-shop","org.opencontainers.image.title":"OWASP Juice Shop","org.opencontainers.image.url":"https://owasp-juice.shop","org.opencontainers.image.vendor":"Open Worldwide Application Security Project","org.opencontainers.image.version":"19.0.0"}}},"distro":{"name":"debian","version":"12","idLike":[]},"descriptor":{"name":"grype","version":"0.109.0","configuration":{"output":["json"],"file":"","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":true,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.4","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.4_2026-02-24T00:30:34Z_1771914741.tar.zst?checksum=sha256%3Ab73bad6f7746d6a9b100bfa931c69b6a1fe92188827e5919f3b8ca35d0fa9aa1","built":"2026-02-24T06:32:21Z","path":"/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-02-24T00:30:38Z","input":"xxh64:1dd504698ddc1ccf"},"alpine":{"captured":"2026-02-24T00:30:52Z","input":"xxh64:3b06d7094fb3b33b"},"amazon":{"captured":"2026-02-24T00:30:54Z","input":"xxh64:18553753e13be395"},"arch":{"captured":"2026-02-24T00:30:55Z","input":"xxh64:3e60df2d65969864"},"bitnami":{"captured":"2026-02-24T00:30:51Z","input":"xxh64:632529669ced839f"},"chainguard":{"captured":"2026-02-24T00:30:52Z","input":"xxh64:455d2a23313e57c2"},"chainguard-libraries":{"captured":"2026-02-24T00:30:59Z","input":"xxh64:4f87624ccfa76d03"},"debian":{"captured":"2026-02-24T00:31:30Z","input":"xxh64:023b19fe31456eb3"},"echo":{"captured":"2026-02-24T00:30:53Z","input":"xxh64:d3d132fa080f1061"},"eol":{"captured":"2026-02-24T00:32:03Z","input":"xxh64:06eef905986e3de4"},"epss":{"captured":"2026-02-24T00:30:34Z","input":"xxh64:581a8093ded47125"},"fedora":{"captured":"2026-02-24T00:30:47Z","input":"xxh64:5b319c0fa73681eb"},"github":{"captured":"2026-02-24T00:30:48Z","input":"xxh64:c6f4bb532ddd6802"},"kev":{"captured":"2026-02-24T00:34:43Z","input":"xxh64:be3f0dce0e26d698"},"mariner":{"captured":"2026-02-24T00:30:45Z","input":"xxh64:25605b31905dda4f"},"minimos":{"captured":"2026-02-24T00:30:40Z","input":"xxh64:52188509fbf2fb05"},"nvd":{"captured":"2026-02-24T00:31:44Z","input":"xxh64:72c2724c0237793e"},"oracle":{"captured":"2026-02-24T00:30:45Z","input":"xxh64:e9981478b056e165"},"photon":{"captured":"2026-02-24T00:30:48Z","input":"xxh64:2bc727400299b9b6"},"rhel":{"captured":"2026-02-24T00:31:39Z","input":"xxh64:92ee65d1af44f681"},"secureos":{"captured":"2026-02-24T00:31:05Z","input":"xxh64:99bddf52da61d08e"},"sles":{"captured":"2026-02-24T00:31:19Z","input":"xxh64:f1287f63cdc645bb"},"ubuntu":{"captured":"2026-02-24T00:31:19Z","input":"xxh64:5ebcb0cd75ff784f"},"wolfi":{"captured":"2026-02-24T00:30:37Z","input":"xxh64:1cf26e9be819f07a"}}},"timestamp":"2026-02-24T14:40:22.615408991Z"}}
diff --git a/labs/lab4/syft/grype-vuln-table.txt b/labs/lab4/syft/grype-vuln-table.txt
new file mode 100644
index 00000000..d42967ac
--- /dev/null
+++ b/labs/lab4/syft/grype-vuln-table.txt
@@ -0,0 +1,110 @@
+NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK
+ip 2.0.1 npm GHSA-2p57-rm9w-gvfp High 86.5% (99th) 67.5
+vm2 3.9.17 3.9.18 npm GHSA-whpj-8f3w-67p5 Critical 69.9% (98th) 65.7
+vm2 3.9.17 npm GHSA-g644-9gfx-q4q4 Critical 39.2% (97th) 36.9
+jsonwebtoken 0.1.0 4.2.2 npm GHSA-c7hr-j4mj-j2w6 Critical 32.5% (96th) 29.2
+jsonwebtoken 0.4.0 4.2.2 npm GHSA-c7hr-j4mj-j2w6 Critical 32.5% (96th) 29.2
+vm2 3.9.17 3.10.0 npm GHSA-cchq-frgv-rjh5 Critical 5.0% (89th) 4.7
+moment 2.0.0 2.11.2 npm GHSA-87vv-r9j6-g5qv Medium 4.0% (88th) 2.3
+lodash 2.4.2 4.17.12 npm GHSA-jf85-cpcp-j695 Critical 2.4% (84th) 2.2
+lodash.set 4.3.2 npm GHSA-p6mc-m468-83gw High 2.6% (85th) 1.9
+moment 2.0.0 2.29.2 npm GHSA-8hfj-j24r-96c4 High 1.7% (81st) 1.3
+engine.io 4.1.2 6.2.1 npm GHSA-r7qp-cfhv-p84w Medium 2.1% (83rd) 1.2
+crypto-js 3.3.0 4.2.0 npm GHSA-xwcq-pm8m-c4vf Critical 0.8% (74th) 0.7
+sanitize-html 1.4.2 2.12.1 npm GHSA-rm97-x556-q36h Medium 1.3% (79th) 0.7
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-15467 Critical 0.7% (71st) 0.6
+lodash 2.4.2 4.17.21 npm GHSA-35jh-r3h4-6jhm High 0.7% (72nd) 0.5
+ws 7.4.6 7.5.10 npm GHSA-3h5v-q93c-6h6q High 0.5% (67th) 0.4
+got 8.3.2 11.8.5 npm GHSA-pfrx-2q88-qq97 Medium 0.8% (73rd) 0.4
+sanitize-html 1.4.2 2.7.1 npm GHSA-cgfm-xwp7-2cvr High 0.4% (63rd) 0.3
+vm2 3.9.17 3.9.18 npm GHSA-p5gc-c584-jj6v Medium 0.6% (68th) 0.3
+lodash 2.4.2 4.17.11 npm GHSA-4xc9-xhrj-v574 High 0.3% (56th) 0.3
+tar 4.4.19 6.2.1 npm GHSA-f5x3-32g6-xq36 Medium 0.4% (63rd) 0.3
+moment 2.0.0 2.19.3 npm GHSA-446m-mv8f-q348 High 0.3% (53rd) 0.2
+sanitize-html 1.4.2 1.4.3 npm GHSA-3j7m-hmh3-9jmp Medium 0.3% (55th) 0.2
+notevil 1.3.3 npm GHSA-8g4m-cjm2-96wq Medium 0.3% (53rd) 0.2
+braces 2.3.2 3.0.3 npm GHSA-grv7-fg5c-xmjg High 0.2% (44th) 0.2
+express-jwt 0.1.3 6.0.0 npm GHSA-6g6m-m6h5-w9gf High 0.2% (44th) 0.2
+sanitize-html 1.4.2 2.3.2 npm GHSA-mjxr-4v3x-q3m4 Medium 0.3% (51st) 0.1
+sanitize-html 1.4.2 2.3.1 npm GHSA-rjqq-98f6-6j3r Medium 0.3% (51st) 0.1
+http-cache-semantics 3.8.1 4.1.1 npm GHSA-rc47-6667-2j5j High 0.2% (41st) 0.1
+lodash 2.4.2 4.17.5 npm GHSA-fvqr-27wr-82fm Medium 0.3% (48th) 0.1
+sanitize-html 1.4.2 1.11.4 npm GHSA-xc6g-ggrc-qq4r Medium 0.3% (51st) 0.1
+socket.io-parser 4.0.5 4.2.3 npm GHSA-cqmj-92xf-r6r9 Medium 0.2% (42nd) 0.1
+libc6 2.36-9+deb12u10 deb CVE-2018-20796 Negligible 1.7% (81st) < 0.1
+socket.io 3.1.2 4.6.2 npm GHSA-25hc-qcg6-38wj Medium 0.1% (33rd) < 0.1
+qs 6.13.0 6.14.1 npm GHSA-6rw7-vpxm-498p High < 0.1% (24th) < 0.1
+multer 1.4.5-lts.2 2.0.1 npm GHSA-g5hg-p3ph-g8qg High < 0.1% (23rd) < 0.1
+micromatch 3.1.10 4.0.8 npm GHSA-952p-6rrq-rcjv Medium 0.1% (32nd) < 0.1
+cookie 0.4.2 0.7.0 npm GHSA-pxg6-pf52-xh8x Low 0.2% (42nd) < 0.1
+jsonwebtoken 0.1.0 9.0.0 npm GHSA-8cf7-32gw-wr33 High < 0.1% (21st) < 0.1
+jsonwebtoken 0.4.0 9.0.0 npm GHSA-8cf7-32gw-wr33 High < 0.1% (21st) < 0.1
+validator 13.15.15 13.15.22 npm GHSA-vghf-hv5q-vc2g High < 0.1% (22nd) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-69420 High < 0.1% (21st) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2025-59465 High < 0.1% (21st) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-69421 High < 0.1% (18th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010025 Negligible 0.9% (74th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-9192 Negligible 0.8% (74th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-69419 High < 0.1% (17th) < 0.1
+validator 13.15.15 13.15.20 npm GHSA-9965-vmph-33xx Medium < 0.1% (21st) < 0.1
+libc6 2.36-9+deb12u10 (won't fix) deb CVE-2025-15281 High < 0.1% (16th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2026-22796 Medium < 0.1% (21st) < 0.1
+multer 1.4.5-lts.2 2.0.0 npm GHSA-44fp-w29j-9vj5 High < 0.1% (14th) < 0.1
+minimatch 3.0.5 10.2.1 npm GHSA-3ppc-4f35-3m26 High < 0.1% (12th) < 0.1
+minimatch 3.0.8 10.2.1 npm GHSA-3ppc-4f35-3m26 High < 0.1% (12th) < 0.1
+minimatch 3.1.2 10.2.1 npm GHSA-3ppc-4f35-3m26 High < 0.1% (12th) < 0.1
+minimatch 5.1.6 10.2.1 npm GHSA-3ppc-4f35-3m26 High < 0.1% (12th) < 0.1
+minimatch 9.0.5 10.2.1 npm GHSA-3ppc-4f35-3m26 High < 0.1% (12th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010024 Negligible 0.6% (70th) < 0.1
+jsonwebtoken 0.1.0 9.0.0 npm GHSA-hjrf-2m68-5959 Medium < 0.1% (18th) < 0.1
+jsonwebtoken 0.4.0 9.0.0 npm GHSA-hjrf-2m68-5959 Medium < 0.1% (18th) < 0.1
+glob 10.4.5 10.5.0 npm GHSA-5j98-mcp5-4vw2 High < 0.1% (11th) < 0.1
+vm2 3.9.17 3.10.2 npm GHSA-99p7-6v5w-7xg8 Critical < 0.1% (8th) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2026-21637 High < 0.1% (10th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.17-1~deb12u3 deb CVE-2025-9230 High < 0.1% (8th) < 0.1
+sanitize-html 1.4.2 2.0.0-beta npm GHSA-qhxp-v273-g94h Medium < 0.1% (12th) < 0.1
+tar-fs 2.1.3 2.1.4 npm GHSA-vj76-c3g6-qr5v High < 0.1% (7th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.17-1~deb12u3 deb CVE-2025-9232 Medium < 0.1% (11th) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2025-55131 High < 0.1% (7th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2010-4756 Negligible 0.4% (59th) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2025-59466 High < 0.1% (6th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010023 Negligible 0.3% (54th) < 0.1
+lodash 4.17.21 4.17.23 npm GHSA-xxjr-mmjv-4gpg Medium < 0.1% (6th) < 0.1
+libc6 2.36-9+deb12u10 (won't fix) deb CVE-2026-0915 High < 0.1% (4th) < 0.1
+libc6 2.36-9+deb12u10 2.36-9+deb12u11 deb CVE-2025-4802 High < 0.1% (3rd) < 0.1
+js-yaml 3.14.1 3.14.2 npm GHSA-mh29-5h37-fv8m Medium < 0.1% (4th) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2025-55130 Critical < 0.1% (1st) < 0.1
+jsonwebtoken 0.1.0 9.0.0 npm GHSA-qwph-4952-7xr6 Medium < 0.1% (3rd) < 0.1
+jsonwebtoken 0.4.0 9.0.0 npm GHSA-qwph-4952-7xr6 Medium < 0.1% (3rd) < 0.1
+tar 4.4.19 7.5.8 npm GHSA-83g3-92jg-28cx High < 0.1% (2nd) < 0.1
+tar 6.2.1 7.5.8 npm GHSA-83g3-92jg-28cx High < 0.1% (2nd) < 0.1
+tar 7.4.3 7.5.8 npm GHSA-83g3-92jg-28cx High < 0.1% (2nd) < 0.1
+tar 4.4.19 7.5.7 npm GHSA-34x7-hfp2-rc4v High < 0.1% (1st) < 0.1
+tar 6.2.1 7.5.7 npm GHSA-34x7-hfp2-rc4v High < 0.1% (1st) < 0.1
+tar 7.4.3 7.5.7 npm GHSA-34x7-hfp2-rc4v High < 0.1% (1st) < 0.1
+multer 1.4.5-lts.2 2.0.2 npm GHSA-fjgf-rc76-4x9p High < 0.1% (1st) < 0.1
+multer 1.4.5-lts.2 2.0.0 npm GHSA-4pg4-qvpc-4q3h High < 0.1% (1st) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2026-22795 Medium < 0.1% (3rd) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-68160 Medium < 0.1% (2nd) < 0.1
+jws 0.2.6 3.2.3 npm GHSA-869p-cjfg-cm3x High < 0.1% (0th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010022 Negligible 0.1% (32nd) < 0.1
+qs 6.13.0 6.14.2 npm GHSA-w7fw-mjwx-w883 Low < 0.1% (4th) < 0.1
+diff 4.0.2 4.0.4 npm GHSA-73rr-hh4g-fpgx Low < 0.1% (4th) < 0.1
+tar 4.4.19 7.5.4 npm GHSA-r6q2-hw4h-h46w High < 0.1% (0th) < 0.1
+tar 6.2.1 7.5.4 npm GHSA-r6q2-hw4h-h46w High < 0.1% (0th) < 0.1
+tar 7.4.3 7.5.4 npm GHSA-r6q2-hw4h-h46w High < 0.1% (0th) < 0.1
+libc6 2.36-9+deb12u10 (won't fix) deb CVE-2026-0861 High < 0.1% (0th) < 0.1
+tar 4.4.19 7.5.3 npm GHSA-8qq5-rm4j-mr97 High < 0.1% (0th) < 0.1
+tar 6.2.1 7.5.3 npm GHSA-8qq5-rm4j-mr97 High < 0.1% (0th) < 0.1
+tar 7.4.3 7.5.3 npm GHSA-8qq5-rm4j-mr97 High < 0.1% (0th) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2025-55132 Medium < 0.1% (0th) < 0.1
+libc6 2.36-9+deb12u10 2.36-9+deb12u13 deb CVE-2025-8058 Medium < 0.1% (0th) < 0.1
+libssl3 3.0.17-1~deb12u2 deb CVE-2025-27587 Negligible < 0.1% (15th) < 0.1
+gcc-12-base 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+libgcc-s1 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+libgomp1 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+libstdc++6 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-69418 Medium < 0.1% (0th) < 0.1
+marsdb 0.6.11 npm GHSA-5mrr-rgp6-x4gr Critical N/A N/A
+jws 0.2.6 3.0.0 npm GHSA-gjcw-v447-2w7q High N/A N/A
+base64url 0.0.6 3.0.0 npm GHSA-rvg8-pwq2-xj7q Medium N/A N/A
diff --git a/labs/lab4/syft/juice-shop-syft-native.json b/labs/lab4/syft/juice-shop-syft-native.json
new file mode 100644
index 00000000..c861af52
--- /dev/null
+++ b/labs/lab4/syft/juice-shop-syft-native.json
@@ -0,0 +1 @@
+{"artifacts":[{"id":"3cea2309a653e6ed","name":"1to2","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/nan/tools/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/nan/tools/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/nan/tools/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/nan/tools/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:nodejs:1to2:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:1to2:1to2:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/1to2@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"1to2","version":"1.0.0","author":"Benjamin Byholm (https://github.com/kkoopa/), Mathias Küsel (https://github.com/mathiask88/)","homepage":"","description":"NAN 1 -> 2 Migration Script","url":"git://github.com/nodejs/nan.git","private":false}},{"id":"08449108469244be","name":"@adraffy/ens-normalize","version":"1.10.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@adraffy\\/ens-normalize:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens-normalize:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens_normalize:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens_normalize:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:adraffy:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:adraffy:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40adraffy/ens-normalize@1.10.1","metadataType":"javascript-npm-package","metadata":{"name":"@adraffy/ens-normalize","version":"1.10.1","author":"raffy.eth (http://raffy.antistupid.com)","homepage":"https://github.com/adraffy/ens-normalize.js#readme","description":"Ethereum Name Service (ENS) Name Normalizer","url":"git+https://github.com/adraffy/ens-normalize.js.git","private":false}},{"id":"27b0de0facbfc672","name":"@babel/helper-string-parser","version":"7.27.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/helper-string-parser:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-string-parser:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string_parser:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string_parser:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-string:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-string:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/helper-string-parser@7.27.1","metadataType":"javascript-npm-package","metadata":{"name":"@babel/helper-string-parser","version":"7.27.1","author":"The Babel Team (https://babel.dev/team)","homepage":"https://babel.dev/docs/en/next/babel-helper-string-parser","description":"A utility package to parse strings","url":"https://github.com/babel/babel.git","private":false}},{"id":"d07675d36f7c1136","name":"@babel/helper-validator-identifier","version":"7.27.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator-identifier:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator-identifier:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator_identifier:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator_identifier:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/helper-validator-identifier@7.27.1","metadataType":"javascript-npm-package","metadata":{"name":"@babel/helper-validator-identifier","version":"7.27.1","author":"The Babel Team (https://babel.dev/team)","homepage":"","description":"Validate identifier/keywords name","url":"https://github.com/babel/babel.git","private":false}},{"id":"489d0f5c79137732","name":"@babel/parser","version":"7.28.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/parser:\\@babel\\/parser:7.28.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/parser:7.28.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/parser@7.28.3","metadataType":"javascript-npm-package","metadata":{"name":"@babel/parser","version":"7.28.3","author":"The Babel Team (https://babel.dev/team)","homepage":"https://babel.dev/docs/en/next/babel-parser","description":"A JavaScript parser","url":"https://github.com/babel/babel.git","private":false}},{"id":"045074f58c58eebb","name":"@babel/types","version":"7.28.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/types/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/types/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/types:\\@babel\\/types:7.28.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/types:7.28.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/types@7.28.2","metadataType":"javascript-npm-package","metadata":{"name":"@babel/types","version":"7.28.2","author":"The Babel Team (https://babel.dev/team)","homepage":"https://babel.dev/docs/en/next/babel-types","description":"Babel Types is a Lodash-esque utility library for AST nodes","url":"https://github.com/babel/babel.git","private":false}},{"id":"2aaa7cc50004f91b","name":"@colors/colors","version":"1.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@colors\\/colors:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DABH:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40colors/colors@1.6.0","metadataType":"javascript-npm-package","metadata":{"name":"@colors/colors","version":"1.6.0","author":"DABH, DABH (https://github.com/DABH)","homepage":"https://github.com/DABH/colors.js","description":"get colors in your node.js console","url":"http://github.com/DABH/colors.js.git","private":false}},{"id":"3b8ecc6044fe8e57","name":"@colors/colors","version":"1.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@colors\\/colors:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DABH:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40colors/colors@1.6.0","metadataType":"javascript-npm-package","metadata":{"name":"@colors/colors","version":"1.6.0","author":"DABH, DABH (https://github.com/DABH)","homepage":"https://github.com/DABH/colors.js","description":"get colors in your node.js console","url":"http://github.com/DABH/colors.js.git","private":false}},{"id":"22bb15b4ca9d4d3f","name":"@dabh/diagnostics","version":"2.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@dabh/diagnostics/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@dabh/diagnostics/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@dabh/diagnostics/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@dabh/diagnostics/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@dabh\\/diagnostics:\\@dabh\\/diagnostics:2.0.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:3rd-Eden:\\@dabh\\/diagnostics:2.0.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40dabh/diagnostics@2.0.3","metadataType":"javascript-npm-package","metadata":{"name":"@dabh/diagnostics","version":"2.0.3","author":"Arnout Kazemier, Martijn Swaagman (https://github.com/swaagie), Jarrett Cruger (https://github.com/jcrugzz), Sevastos (https://github.com/sevastos)","homepage":"https://github.com/3rd-Eden/diagnostics","description":"Tools for debugging your node.js modules and event loop","url":"git://github.com/3rd-Eden/diagnostics.git","private":false}},{"id":"2b283938a1553b38","name":"@ethereumjs/rlp","version":"4.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MPL-2.0","spdxExpression":"MPL-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@ethereumjs\\/rlp:\\@ethereumjs\\/rlp:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ethereumjs:\\@ethereumjs\\/rlp:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40ethereumjs/rlp@4.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@ethereumjs/rlp","version":"4.0.1","author":"martin becze , Alex Beregszaszi , Holger Drewes , Paul Miller ","homepage":"https://github.com/ethereumjs/ethereumjs-monorepo/tree/master/packages/rlp#readme","description":"Recursive Length Prefix Encoding Module","url":"https://github.com/ethereumjs/ethereumjs-monorepo.git","private":false}},{"id":"e264462c29df43ed","name":"@ethereumjs/rlp","version":"5.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MPL-2.0","spdxExpression":"MPL-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@ethereumjs\\/rlp:\\@ethereumjs\\/rlp:5.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ethereumjs:\\@ethereumjs\\/rlp:5.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40ethereumjs/rlp@5.0.2","metadataType":"javascript-npm-package","metadata":{"name":"@ethereumjs/rlp","version":"5.0.2","author":"martin becze , Alex Beregszaszi , Holger Drewes , Paul Miller ","homepage":"https://github.com/ethereumjs/ethereumjs-monorepo/tree/master/packages/rlp#readme","description":"Recursive Length Prefix Encoding Module","url":"https://github.com/ethereumjs/ethereumjs-monorepo.git","private":false}},{"id":"8e41d6aa1fe261a3","name":"@gar/promisify","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@gar/promisify/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@gar/promisify/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@gar/promisify/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@gar/promisify/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@gar\\/promisify:\\@gar\\/promisify:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:wraithgar:\\@gar\\/promisify:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40gar/promisify@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"@gar/promisify","version":"1.1.3","author":"Gar ","homepage":"","description":"Promisify an entire class or object","url":"https://github.com/wraithgar/gar-promisify.git","private":false}},{"id":"1b734807f495fb6f","name":"@isaacs/cliui","version":"8.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@isaacs\\/cliui:\\@isaacs\\/cliui:8.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40isaacs/cliui@8.0.2","metadataType":"javascript-npm-package","metadata":{"name":"@isaacs/cliui","version":"8.0.2","author":"Ben Coe ","homepage":"","description":"easily create complex multi-column command-line-interfaces","url":"yargs/cliui","private":false}},{"id":"0ab257647e45f4d4","name":"@isaacs/fs-minipass","version":"4.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@isaacs\\/fs-minipass:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs-minipass:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs_minipass:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs_minipass:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40isaacs/fs-minipass@4.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@isaacs/fs-minipass","version":"4.0.1","author":"Isaac Z. Schlueter","homepage":"","description":"fs read and write streams based on minipass","url":"https://github.com/npm/fs-minipass.git","private":false}},{"id":"e38f30a540597121","name":"@my-scope/package-a","version":"0.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@my-scope\\/package-a:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package-a:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_a:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_a:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40my-scope/package-a@0.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@my-scope/package-a","version":"0.0.0","author":"","homepage":"","description":"","url":"","private":true}},{"id":"7c30bf5441790ef5","name":"@my-scope/package-b","version":"0.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@my-scope\\/package-b:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package-b:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_b:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_b:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40my-scope/package-b@0.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@my-scope/package-b","version":"0.0.0","author":"","homepage":"","description":"","url":"","private":true}},{"id":"49cbc756c02b244b","name":"@nlpjs/core","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/core:\\@nlpjs\\/core:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/core@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/core","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"52af61e4284d993b","name":"@nlpjs/core-loader","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/core-loader:\\@nlpjs\\/core-loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core-loader:\\@nlpjs\\/core_loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core_loader:\\@nlpjs\\/core-loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core_loader:\\@nlpjs\\/core_loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core:\\@nlpjs\\/core-loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core:\\@nlpjs\\/core_loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/core-loader@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/core-loader","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"19329a82b3c04a97","name":"@nlpjs/evaluator","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/evaluator:\\@nlpjs\\/evaluator:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/evaluator@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/evaluator","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Evaluator","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"3b35c82860541774","name":"@nlpjs/lang-en","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang-en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang_en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang-en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang_en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang-en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang_en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/lang-en@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/lang-en","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"f478f743a248aca5","name":"@nlpjs/lang-en-min","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en-min:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en-min:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en_min:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en_min:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/lang-en-min@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/lang-en-min","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"ca1d4c9cc3d649fe","name":"@nlpjs/language","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/language/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/language/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/language:\\@nlpjs\\/language:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/language@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/language","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Language guesser","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"49713e5e64515107","name":"@nlpjs/language-min","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/language-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language-min/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/language-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language-min/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/language-min:\\@nlpjs\\/language-min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language-min:\\@nlpjs\\/language_min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language_min:\\@nlpjs\\/language-min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language_min:\\@nlpjs\\/language_min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language:\\@nlpjs\\/language-min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language:\\@nlpjs\\/language_min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/language-min@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/language-min","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Language guesser","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"3bf94ec08da3b281","name":"@nlpjs/ner","version":"4.27.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/ner/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/ner/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/ner/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/ner/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/ner:\\@nlpjs\\/ner:4.27.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/ner@4.27.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/ner","version":"4.27.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Named Entity Recognition","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"d2908794d58fc9bc","name":"@nlpjs/neural","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/neural/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/neural/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/neural/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/neural/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/neural:\\@nlpjs\\/neural:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/neural@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/neural","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Neural Network","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"d41f6d4e68e9c43d","name":"@nlpjs/nlg","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlg/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlg/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/nlg:\\@nlpjs\\/nlg:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/nlg@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/nlg","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Natural Language Generation","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"f85c5456d515aafd","name":"@nlpjs/nlp","version":"4.27.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlp/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlp/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/nlp:\\@nlpjs\\/nlp:4.27.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/nlp@4.27.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/nlp","version":"4.27.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Natural Language Processing","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"c449b8b8cc6afd27","name":"@nlpjs/nlu","version":"4.27.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlu/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlu/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlu/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlu/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/nlu:\\@nlpjs\\/nlu:4.27.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/nlu@4.27.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/nlu","version":"4.27.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Natural Language Understanding","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"8d993f0ba3c63bb7","name":"@nlpjs/request","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/request/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/request/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/request:\\@nlpjs\\/request:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/request@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/request","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Request","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"1b3eb8c3cb77af23","name":"@nlpjs/sentiment","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/sentiment:\\@nlpjs\\/sentiment:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/sentiment@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/sentiment","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Sentiment Analysis","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"203a7b556fc354dd","name":"@nlpjs/similarity","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/similarity/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/similarity/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/similarity/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/similarity/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/similarity:\\@nlpjs\\/similarity:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/similarity@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/similarity","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Similarity","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"6b6febefa6106c5d","name":"@nlpjs/slot","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/slot/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/slot/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/slot/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/slot/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/slot:\\@nlpjs\\/slot:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/slot@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/slot","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Slot filling manager","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"2a40db3b54912cbf","name":"@noble/curves","version":"1.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/curves:\\@noble\\/curves:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:paulmillr:\\@noble\\/curves:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/curves@1.2.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/curves","version":"1.2.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal JS implementation of elliptic curve cryptography","url":"https://github.com/paulmillr/noble-curves.git","private":false}},{"id":"a86e0237429a5827","name":"@noble/curves","version":"1.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/curves:\\@noble\\/curves:1.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/curves@1.4.2","metadataType":"javascript-npm-package","metadata":{"name":"@noble/curves","version":"1.4.2","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal JS implementation of elliptic curve cryptography","url":"git+https://github.com/paulmillr/noble-curves.git","private":false}},{"id":"306de5e5675f2410","name":"@noble/curves","version":"1.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/curves:\\@noble\\/curves:1.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/curves@1.4.2","metadataType":"javascript-npm-package","metadata":{"name":"@noble/curves","version":"1.4.2","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal JS implementation of elliptic curve cryptography","url":"git+https://github.com/paulmillr/noble-curves.git","private":false}},{"id":"46670510cb133f58","name":"@noble/hashes","version":"1.3.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:paulmillr:\\@noble\\/hashes:1.3.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.3.2","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.3.2","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA2, SHA3, RIPEMD, BLAKE2/3, HMAC, HKDF, PBKDF2, Scrypt","url":"https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"749573321ee941d7","name":"@noble/hashes","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.4.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF & Scrypt","url":"git+https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"a3139241ec1643e6","name":"@noble/hashes","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.4.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF & Scrypt","url":"git+https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"c2a39289ece0eefe","name":"@noble/hashes","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.4.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF & Scrypt","url":"git+https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"114921a3f2bc9d12","name":"@npmcli/agent","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/agent:\\@npmcli\\/agent:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:\\@npmcli\\/agent:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/agent@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/agent","version":"3.0.0","author":"GitHub Inc.","homepage":"https://github.com/npm/agent#readme","description":"the http/https agent used by the npm cli","url":"git+https://github.com/npm/agent.git","private":false}},{"id":"644572bbb1e01679","name":"@npmcli/fs","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/fs:\\@npmcli\\/fs:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/fs@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/fs","version":"1.1.1","author":"GitHub Inc.","homepage":"","description":"filesystem utilities for the npm cli","url":"","private":false}},{"id":"2f7974422b4dc793","name":"@npmcli/fs","version":"4.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/fs:\\@npmcli\\/fs:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/fs@4.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/fs","version":"4.0.0","author":"GitHub Inc.","homepage":"","description":"filesystem utilities for the npm cli","url":"git+https://github.com/npm/fs.git","private":false}},{"id":"a988a9e98434d4e0","name":"@npmcli/move-file","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/move-file/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/move-file/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/move-file/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/move-file/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/move-file:\\@npmcli\\/move-file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move-file:\\@npmcli\\/move_file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move_file:\\@npmcli\\/move-file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move_file:\\@npmcli\\/move_file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move:\\@npmcli\\/move-file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move:\\@npmcli\\/move_file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/move-file@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/move-file","version":"1.1.2","author":"","homepage":"","description":"move a file (fork of move-file)","url":"git+https://github.com/npm/move-file","private":false}},{"id":"80ec3c5b78ad0cd1","name":"@otplib/core","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/core/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/core/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/core:\\@otplib\\/core:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/core:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/core@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/core","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"core method for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-core","private":false}},{"id":"a30b3113039a0207","name":"@otplib/plugin-crypto","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-crypto:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-crypto:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_crypto:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_crypto:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/plugin-crypto@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/plugin-crypto","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"node crypto plugin for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-plugin-crypto","private":false}},{"id":"e9e61a8a5751393d","name":"@otplib/plugin-thirty-two","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty-two:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty-two:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty_two:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty_two:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/plugin-thirty-two@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/plugin-thirty-two","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"thirty-two plugin for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-plugin-thirty-two","private":false}},{"id":"8171b09a48e9d93f","name":"@otplib/preset-default","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/preset-default/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-default/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/preset-default/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-default/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/preset-default:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset-default:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_default:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_default:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/preset-default@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/preset-default","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"basic preset for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-preset-default","private":false}},{"id":"1aa44437b113ebed","name":"@otplib/preset-v11","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/preset-v11/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-v11/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/preset-v11/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-v11/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/preset-v11:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset-v11:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_v11:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_v11:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/preset-v11@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/preset-v11","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"v11.x compatible interface preset for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-preset-v11","private":false}},{"id":"80ef1a2248d5a920","name":"@pkgjs/parseargs","version":"0.11.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@pkgjs\\/parseargs:\\@pkgjs\\/parseargs:0.11.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pkgjs:\\@pkgjs\\/parseargs:0.11.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40pkgjs/parseargs@0.11.0","metadataType":"javascript-npm-package","metadata":{"name":"@pkgjs/parseargs","version":"0.11.0","author":"","homepage":"https://github.com/pkgjs/parseargs#readme","description":"Polyfill of future proposal for `util.parseArgs()`","url":"git@github.com:pkgjs/parseargs.git","private":false}},{"id":"19e6077d1014f2df","name":"@scarf/scarf","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scarf/scarf/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scarf/scarf/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"Apache-2.0","spdxExpression":"Apache-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scarf/scarf/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scarf/scarf/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scarf\\/scarf:\\@scarf\\/scarf:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:scarf-sh:\\@scarf\\/scarf:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scarf/scarf@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@scarf/scarf","version":"1.4.0","author":"Scarf Systems","homepage":"https://github.com/scarf-sh/scarf-js","description":"Scarf is like Google Analytics for your npm packages. Gain insights into how your packages are installed and used, and by which companies.","url":"git+https://github.com/scarf-sh/scarf-js.git","private":false}},{"id":"8a8c401a9f2b2c51","name":"@scure/base","version":"1.1.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scure\\/base:\\@scure\\/base:1.1.9:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scure/base@1.1.9","metadataType":"javascript-npm-package","metadata":{"name":"@scure/base","version":"1.1.9","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/#scure","description":"Secure, audited & 0-dep implementation of base64, bech32, base58, base32 & base16","url":"git+https://github.com/paulmillr/scure-base.git","private":false}},{"id":"5f4817f39b8e1c4d","name":"@scure/bip32","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scure\\/bip32:\\@scure\\/bip32:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scure/bip32@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@scure/bip32","version":"1.4.0","author":"Paul Miller (https://paulmillr.com), Patricio Palladino , Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/#scure","description":"Secure, audited & minimal implementation of BIP32 hierarchical deterministic (HD) wallets over secp256k1","url":"git+https://github.com/paulmillr/scure-bip32.git","private":false}},{"id":"0f92a1c1ac31f6b0","name":"@scure/bip39","version":"1.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip39/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip39/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scure\\/bip39:\\@scure\\/bip39:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scure/bip39@1.3.0","metadataType":"javascript-npm-package","metadata":{"name":"@scure/bip39","version":"1.3.0","author":"Paul Miller (https://paulmillr.com), Patricio Palladino , Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/","description":"Secure, audited & minimal implementation of BIP39 mnemonic phrases","url":"git+https://github.com/paulmillr/scure-bip39.git","private":false}},{"id":"a29ebe9c01a24b05","name":"@sindresorhus/is","version":"0.7.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@sindresorhus/is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@sindresorhus/is/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@sindresorhus/is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@sindresorhus/is/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@sindresorhus\\/is:\\@sindresorhus\\/is:0.7.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40sindresorhus/is@0.7.0","metadataType":"javascript-npm-package","metadata":{"name":"@sindresorhus/is","version":"0.7.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Type check values: `is.string('🦄') //=> true`","url":"sindresorhus/is","private":false}},{"id":"079d0d4fdf762801","name":"@swc/helpers","version":"0.3.17","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@swc/helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@swc/helpers/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@swc/helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@swc/helpers/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@swc\\/helpers:\\@swc\\/helpers:0.3.17:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40swc/helpers@0.3.17","metadataType":"javascript-npm-package","metadata":{"name":"@swc/helpers","version":"0.3.17","author":"강동윤 ","homepage":"https://swc.rs","description":"External helpers for the swc project.","url":"git+https://github.com/swc-project/swc.git","private":false}},{"id":"43352d2f6855caf1","name":"@tokenizer/token","version":"0.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@tokenizer/token/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tokenizer/token/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@tokenizer/token/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tokenizer/token/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@tokenizer\\/token:\\@tokenizer\\/token:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:Borewit:\\@tokenizer\\/token:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40tokenizer/token@0.3.0","metadataType":"javascript-npm-package","metadata":{"name":"@tokenizer/token","version":"0.3.0","author":"Borewit (https://github.com/Borewit)","homepage":"","description":"TypeScript definition for strtok3 token","url":"https://github.com/Borewit/tokenizer-token.git","private":false}},{"id":"c5d7a329145ffcc6","name":"@tootallnate/once","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@tootallnate\\/once:\\@tootallnate\\/once:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:\\@tootallnate\\/once:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40tootallnate/once@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"@tootallnate/once","version":"1.1.2","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Creates a Promise that waits for a single event","url":"git://github.com/TooTallNate/once.git","private":false}},{"id":"f544b09023665970","name":"@tootallnate/once","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@tootallnate\\/once:\\@tootallnate\\/once:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:\\@tootallnate\\/once:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40tootallnate/once@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@tootallnate/once","version":"2.0.0","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Creates a Promise that waits for a single event","url":"git://github.com/TooTallNate/once.git","private":false}},{"id":"ae93160dfc27d07c","name":"@types/component-emitter","version":"1.2.14","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/component-emitter/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/component-emitter/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/component-emitter:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component-emitter:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component_emitter:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component_emitter:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/component-emitter@1.2.14","metadataType":"javascript-npm-package","metadata":{"name":"@types/component-emitter","version":"1.2.14","author":"Peter Snider (https://github.com/psnider)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/component-emitter","description":"TypeScript definitions for component-emitter","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"1339467e13b5c752","name":"@types/cookie","version":"0.4.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/cookie:0.4.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/cookie:\\@types\\/cookie:0.4.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/cookie@0.4.1","metadataType":"javascript-npm-package","metadata":{"name":"@types/cookie","version":"0.4.1","author":"Pine Mizune (https://github.com/pine), Piotr Błażejewicz (https://github.com/peterblazejewicz)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/cookie","description":"TypeScript definitions for cookie","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"bc4bb778990d4ea4","name":"@types/cors","version":"2.8.19","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/cors:2.8.19:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/cors:\\@types\\/cors:2.8.19:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/cors@2.8.19","metadataType":"javascript-npm-package","metadata":{"name":"@types/cors","version":"2.8.19","author":"Alan Plum (https://github.com/pluma), Gaurav Sharma (https://github.com/gtpan77), Sebastian Beltran (https://github.com/bjohansebas)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/cors","description":"TypeScript definitions for cors","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"6c978939ffb311b0","name":"@types/debug","version":"4.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/debug:4.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/debug:\\@types\\/debug:4.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/debug@4.1.12","metadataType":"javascript-npm-package","metadata":{"name":"@types/debug","version":"4.1.12","author":"Seon-Wook Park (https://github.com/swook), Gal Talmor (https://github.com/galtalmor), John McLaughlin (https://github.com/zamb3zi), Brasten Sager (https://github.com/brasten), Nicolas Penin (https://github.com/npenin), Kristian Brünn (https://github.com/kristianmitk), Caleb Gregory (https://github.com/calebgregory)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/debug","description":"TypeScript definitions for debug","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"495a18008d72fd0f","name":"@types/ms","version":"2.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/ms/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ms/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/ms/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ms/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/ms:2.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/ms:\\@types\\/ms:2.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/ms@2.1.0","metadataType":"javascript-npm-package","metadata":{"name":"@types/ms","version":"2.1.0","author":"Zhiyuan Wang (https://github.com/danny8002)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/ms","description":"TypeScript definitions for ms","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"1a396f39fa44decd","name":"@types/node","version":"20.19.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/node:20.19.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/node:\\@types\\/node:20.19.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/node@20.19.12","metadataType":"javascript-npm-package","metadata":{"name":"@types/node","version":"20.19.12","author":"Microsoft TypeScript (https://github.com/Microsoft), Alberto Schiabel (https://github.com/jkomyno), Andrew Makarov (https://github.com/r3nya), Benjamin Toueg (https://github.com/btoueg), David Junger (https://github.com/touffy), Mohsen Azimi (https://github.com/mohsen1), Nikita Galkin (https://github.com/galkin), Sebastian Silbermann (https://github.com/eps1lon), Wilco Bakker (https://github.com/WilcoBakker), Marcin Kopacz (https://github.com/chyzwar), Trivikram Kamat (https://github.com/trivikr), Junxiao Shi (https://github.com/yoursunny), Ilia Baryshnikov (https://github.com/qwelias), ExE Boss (https://github.com/ExE-Boss), Piotr Błażejewicz (https://github.com/peterblazejewicz), Anna Henningsen (https://github.com/addaleax), Victor Perin (https://github.com/victorperin), NodeJS Contributors (https://github.com/NodeJS), Linus Unnebäck (https://github.com/LinusU), wafuwafu13 (https://github.com/wafuwafu13), Matteo Collina (https://github.com/mcollina), Dmitry Semigradsky (https://github.com/Semigradsky)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node","description":"TypeScript definitions for node","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"6fe716e8b0927a9d","name":"@types/node","version":"22.7.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/node:22.7.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/node:\\@types\\/node:22.7.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/node@22.7.5","metadataType":"javascript-npm-package","metadata":{"name":"@types/node","version":"22.7.5","author":"Microsoft TypeScript (https://github.com/Microsoft), Alberto Schiabel (https://github.com/jkomyno), Alvis HT Tang (https://github.com/alvis), Andrew Makarov (https://github.com/r3nya), Benjamin Toueg (https://github.com/btoueg), Chigozirim C. (https://github.com/smac89), David Junger (https://github.com/touffy), Deividas Bakanas (https://github.com/DeividasBakanas), Eugene Y. Q. Shen (https://github.com/eyqs), Hannes Magnusson (https://github.com/Hannes-Magnusson-CK), Huw (https://github.com/hoo29), Kelvin Jin (https://github.com/kjin), Klaus Meinhardt (https://github.com/ajafff), Lishude (https://github.com/islishude), Mariusz Wiktorczyk (https://github.com/mwiktorczyk), Mohsen Azimi (https://github.com/mohsen1), Nikita Galkin (https://github.com/galkin), Parambir Singh (https://github.com/parambirs), Sebastian Silbermann (https://github.com/eps1lon), Thomas den Hollander (https://github.com/ThomasdenH), Wilco Bakker (https://github.com/WilcoBakker), wwwy3y3 (https://github.com/wwwy3y3), Samuel Ainsworth (https://github.com/samuela), Kyle Uehlein (https://github.com/kuehlein), Thanik Bhongbhibhat (https://github.com/bhongy), Marcin Kopacz (https://github.com/chyzwar), Trivikram Kamat (https://github.com/trivikr), Junxiao Shi (https://github.com/yoursunny), Ilia Baryshnikov (https://github.com/qwelias), ExE Boss (https://github.com/ExE-Boss), Piotr Błażejewicz (https://github.com/peterblazejewicz), Anna Henningsen (https://github.com/addaleax), Victor Perin (https://github.com/victorperin), Yongsheng Zhang (https://github.com/ZYSzys), NodeJS Contributors (https://github.com/NodeJS), Linus Unnebäck (https://github.com/LinusU), wafuwafu13 (https://github.com/wafuwafu13), Matteo Collina (https://github.com/mcollina), Dmitry Semigradsky (https://github.com/Semigradsky)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node","description":"TypeScript definitions for node","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"d3c68c4be4da21f8","name":"@types/strip-bom","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/strip-bom/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-bom/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/strip-bom/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-bom/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/strip-bom:\\@types\\/strip-bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-bom:\\@types\\/strip_bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_bom:\\@types\\/strip-bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_bom:\\@types\\/strip_bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip-bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip_bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/strip-bom@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@types/strip-bom","version":"3.0.0","author":"Mohamed Hegazy ","homepage":"","description":"TypeScript definitions for strip-bom","url":"https://www.github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"a1b120935894d604","name":"@types/strip-json-comments","version":"0.0.30","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/strip-json-comments/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-json-comments/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/strip-json-comments/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-json-comments/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/strip-json-comments:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-json-comments:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json_comments:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json_comments:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-json:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-json:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/strip-json-comments@0.0.30","metadataType":"javascript-npm-package","metadata":{"name":"@types/strip-json-comments","version":"0.0.30","author":"Dylan R. E. Moonfire (https://github.com/dmoonfire)","homepage":"","description":"TypeScript definitions for strip-json-comments","url":"https://www.github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"3e3be5c397de8382","name":"@types/triple-beam","version":"1.3.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/triple-beam/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/triple-beam/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/triple-beam/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/triple-beam/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/triple-beam:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple-beam:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple_beam:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple_beam:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/triple-beam@1.3.5","metadataType":"javascript-npm-package","metadata":{"name":"@types/triple-beam","version":"1.3.5","author":"Daniel Byrne (https://github.com/danwbyrne)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/triple-beam","description":"TypeScript definitions for triple-beam","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"28a4e010c7ae7198","name":"@types/validator","version":"13.15.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/validator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/validator/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/validator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/validator/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/validator:\\@types\\/validator:13.15.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/validator:13.15.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/validator@13.15.3","metadataType":"javascript-npm-package","metadata":{"name":"@types/validator","version":"13.15.3","author":"tgfjt (https://github.com/tgfjt), Ilya Mochalov (https://github.com/chrootsu), Ayman Nedjmeddine (https://github.com/IOAyman), Louay Alakkad (https://github.com/louy), Bonggyun Lee (https://github.com/deptno), Naoto Yokoyama (https://github.com/builtinnya), Philipp Katz (https://github.com/qqilihq), Jace Warren (https://github.com/keatz55), Munif Tanjim (https://github.com/MunifTanjim), Vlad Poluch (https://github.com/vlapo), Piotr Błażejewicz (https://github.com/peterblazejewicz), Matteo Nista (https://github.com/Mattewn99), Daniel Freire (https://github.com/dcfreire), Rik Smale (https://github.com/WikiRik)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/validator","description":"TypeScript definitions for validator","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"bc7a53b52d363adb","name":"@types/ws","version":"8.5.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/ws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ws/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/ws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ws/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/ws:8.5.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/ws:\\@types\\/ws:8.5.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/ws@8.5.3","metadataType":"javascript-npm-package","metadata":{"name":"@types/ws","version":"8.5.3","author":"Paul Loyd (https://github.com/loyd), Margus Lamp (https://github.com/mlamp), Philippe D'Alva (https://github.com/TitaneBoy), reduckted (https://github.com/reduckted), teidesu (https://github.com/teidesu), Bartosz Wojtkowiak (https://github.com/wojtkowiak), Kyle Hensel (https://github.com/k-yle), Samuel Skeen (https://github.com/cwadrupldijjit)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/ws","description":"TypeScript definitions for ws","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"7797aed52ef29847","name":"abbrev","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:abbrev:abbrev:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:abbrev:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abbrev@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"abbrev","version":"1.1.1","author":"Isaac Z. Schlueter ","homepage":"","description":"Like ruby's abbrev module, but in js","url":"http://github.com/isaacs/abbrev-js","private":false}},{"id":"bfcf5eaa5daa3133","name":"abbrev","version":"3.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:abbrev:abbrev:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abbrev@3.0.1","metadataType":"javascript-npm-package","metadata":{"name":"abbrev","version":"3.0.1","author":"GitHub Inc.","homepage":"","description":"Like ruby's abbrev module, but in js","url":"git+https://github.com/npm/abbrev-js.git","private":false}},{"id":"663ac1c9b870ce8a","name":"abitype","version":"0.7.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/abitype/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abitype/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/abitype/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abitype/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:wagmi-dev:abitype:0.7.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abitype:abitype:0.7.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abitype@0.7.1","metadataType":"javascript-npm-package","metadata":{"name":"abitype","version":"0.7.1","author":"","homepage":"","description":"Strict TypeScript types for Ethereum ABIs","url":"https://github.com/wagmi-dev/abitype.git","private":false}},{"id":"7832aa1cacf310b2","name":"abort-controller","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/abort-controller/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abort-controller/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/abort-controller/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abort-controller/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:abort-controller:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort-controller:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort_controller:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort_controller:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mysticatea:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mysticatea:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abort-controller@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"abort-controller","version":"3.0.0","author":"Toru Nagashima (https://github.com/mysticatea)","homepage":"https://github.com/mysticatea/abort-controller#readme","description":"An implementation of WHATWG AbortController interface.","url":"git+https://github.com/mysticatea/abort-controller.git","private":false}},{"id":"fe1f2ff03fb9475c","name":"accepts","version":"1.3.8","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/accepts/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/accepts/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/accepts/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/accepts/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:accepts:accepts:1.3.8:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/accepts@1.3.8","metadataType":"javascript-npm-package","metadata":{"name":"accepts","version":"1.3.8","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com)","homepage":"","description":"Higher-level content negotiation","url":"jshttp/accepts","private":false}},{"id":"c0f7127acbceb420","name":"acorn","version":"7.4.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:acornjs:acorn:7.4.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn:7.4.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/acorn@7.4.1","metadataType":"javascript-npm-package","metadata":{"name":"acorn","version":"7.4.1","author":"Marijn Haverbeke , Ingvar Stepanyan , Adrian Heine","homepage":"https://github.com/acornjs/acorn","description":"ECMAScript parser","url":"https://github.com/acornjs/acorn.git","private":false}},{"id":"facfba058a0afa86","name":"acorn","version":"8.15.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:acornjs:acorn:8.15.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn:8.15.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/acorn@8.15.0","metadataType":"javascript-npm-package","metadata":{"name":"acorn","version":"8.15.0","author":"Marijn Haverbeke , Ingvar Stepanyan , Adrian Heine","homepage":"https://github.com/acornjs/acorn","description":"ECMAScript parser","url":"git+https://github.com/acornjs/acorn.git","private":false}},{"id":"dbdb98fb9b57cb53","name":"acorn-walk","version":"8.3.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/acorn-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn-walk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/acorn-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn-walk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:acorn-walk:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn-walk:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn_walk:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn_walk:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acornjs:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acornjs:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/acorn-walk@8.3.4","metadataType":"javascript-npm-package","metadata":{"name":"acorn-walk","version":"8.3.4","author":"Marijn Haverbeke , Ingvar Stepanyan , Adrian Heine","homepage":"https://github.com/acornjs/acorn","description":"ECMAScript (ESTree) AST walker","url":"https://github.com/acornjs/acorn.git","private":false}},{"id":"6ad4b0036eebc3a0","name":"aes-js","version":"4.0.0-beta.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/aes-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aes-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/aes-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aes-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:aes-js:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes-js:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes_js:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes_js:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ricmoo:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ricmoo:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/aes-js@4.0.0-beta.5","metadataType":"javascript-npm-package","metadata":{"name":"aes-js","version":"4.0.0-beta.5","author":"Richard Moore ","homepage":"","description":"A pure JavaScript implementation of the AES block cipher and all common modes of operation.","url":"git://github.com/ricmoo/aes-js.git","private":false}},{"id":"aeef16c972765f3c","name":"agent-base","version":"6.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agent-base@6.0.2","metadataType":"javascript-npm-package","metadata":{"name":"agent-base","version":"6.0.2","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Turn a function into an `http.Agent` instance","url":"git://github.com/TooTallNate/node-agent-base.git","private":false}},{"id":"96ecb0353e427e76","name":"agent-base","version":"7.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agent-base@7.1.4","metadataType":"javascript-npm-package","metadata":{"name":"agent-base","version":"7.1.4","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Turn a function into an `http.Agent` instance","url":"https://github.com/TooTallNate/proxy-agents.git","private":false}},{"id":"89a76184ab2e6db2","name":"agent-base","version":"7.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agent-base@7.1.4","metadataType":"javascript-npm-package","metadata":{"name":"agent-base","version":"7.1.4","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Turn a function into an `http.Agent` instance","url":"https://github.com/TooTallNate/proxy-agents.git","private":false}},{"id":"c6a7724321f5beae","name":"agentkeepalive","version":"4.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/agentkeepalive/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agentkeepalive/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/agentkeepalive/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agentkeepalive/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:agentkeepalive:agentkeepalive:4.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:node-modules:agentkeepalive:4.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agentkeepalive@4.6.0","metadataType":"javascript-npm-package","metadata":{"name":"agentkeepalive","version":"4.6.0","author":"fengmk2 (https://github.com/fengmk2)","homepage":"","description":"Missing keepalive http.Agent","url":"git://github.com/node-modules/agentkeepalive.git","private":false}},{"id":"7cedce27af4fa8d6","name":"aggregate-error","version":"3.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/aggregate-error/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aggregate-error/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/aggregate-error/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aggregate-error/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:aggregate-error:aggregate-error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate-error:aggregate_error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate_error:aggregate-error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate_error:aggregate_error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate:aggregate-error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate:aggregate_error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/aggregate-error@3.1.0","metadataType":"javascript-npm-package","metadata":{"name":"aggregate-error","version":"3.1.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Create an error from multiple errors","url":"sindresorhus/aggregate-error","private":false}},{"id":"ba5607392e56dee9","name":"ansi-regex","version":"2.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:2.1.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@2.1.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"2.1.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"2b280fc78a93d0b1","name":"ansi-regex","version":"2.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:2.1.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@2.1.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"2.1.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"b93db3f55b850b14","name":"ansi-regex","version":"2.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:2.1.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@2.1.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"2.1.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"dddd120589f7009b","name":"ansi-regex","version":"3.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:3.0.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@3.0.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"3.0.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"215b7da2acde9858","name":"ansi-regex","version":"5.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:5.0.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@5.0.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"5.0.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"3f33beb59e12eb10","name":"ansi-regex","version":"6.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:6.2.0:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@6.2.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"6.2.0","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"c7daa267534d8282","name":"ansi-regex","version":"6.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:6.2.0:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@6.2.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"6.2.0","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"65b4c3eb14b71ee6","name":"ansi-styles","version":"2.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@2.2.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"2.2.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"f879ff424c2ec284","name":"ansi-styles","version":"3.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@3.2.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"3.2.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"c3f3679aac65318b","name":"ansi-styles","version":"4.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@4.3.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"4.3.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"c365b03d53f8ca80","name":"ansi-styles","version":"4.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@4.3.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"4.3.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"f3dee5a49bb85e72","name":"ansi-styles","version":"4.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@4.3.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"4.3.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"8270a49368d729a2","name":"ansi-styles","version":"6.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@6.2.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"6.2.1","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"1fdc06fdab01441e","name":"anymatch","version":"3.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/anymatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/anymatch/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/anymatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/anymatch/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:anymatch:3.1.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/anymatch@3.1.3","metadataType":"javascript-npm-package","metadata":{"name":"anymatch","version":"3.1.3","author":"Elan Shanker (https://github.com/es128)","homepage":"https://github.com/micromatch/anymatch","description":"Matches strings against configurable strings, globs, regular expressions, and/or functions","url":"https://github.com/micromatch/anymatch","private":false}},{"id":"40d1f9967f309c48","name":"append-field","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/append-field/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/append-field/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/append-field/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/append-field/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:append-field:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append-field:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append_field:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append_field:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:LinusU:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:LinusU:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/append-field@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"append-field","version":"1.0.0","author":"Linus Unnebäck ","homepage":"","description":"","url":"http://github.com/LinusU/node-append-field.git","private":false}},{"id":"81de4b22dbb401d0","name":"aproba","version":"1.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/aproba/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aproba/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/aproba/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aproba/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:aproba:aproba:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:aproba:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/aproba@1.2.0","metadataType":"javascript-npm-package","metadata":{"name":"aproba","version":"1.2.0","author":"Rebecca Turner ","homepage":"https://github.com/iarna/aproba","description":"A ridiculously light-weight argument validator (now browser friendly)","url":"https://github.com/iarna/aproba","private":false}},{"id":"3fb8ce78823b4311","name":"archive-type","version":"4.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archive-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archive-type/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archive-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archive-type/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:archive-type:archive-type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive-type:archive_type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive_type:archive-type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive_type:archive_type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive:archive-type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive:archive_type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/archive-type@4.0.0","metadataType":"javascript-npm-package","metadata":{"name":"archive-type","version":"4.0.0","author":"Kevin Mårtensson (https://github.com/kevva)","homepage":"","description":"Detect the archive type of a Buffer/Uint8Array","url":"kevva/archive-type","private":false}},{"id":"dec4b5088a113d49","name":"archiver","version":"1.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:archiverjs:archiver:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver:archiver:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/archiver@1.3.0","metadataType":"javascript-npm-package","metadata":{"name":"archiver","version":"1.3.0","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/node-archiver","description":"a streaming interface for archive generation","url":"https://github.com/archiverjs/node-archiver.git","private":false}},{"id":"35ab1a4a9ad1f907","name":"archiver-utils","version":"1.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:archiver-utils:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver-utils:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver_utils:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver_utils:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/archiver-utils@1.3.0","metadataType":"javascript-npm-package","metadata":{"name":"archiver-utils","version":"1.3.0","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/archiver-utils#readme","description":"utility functions for archiver","url":"https://github.com/archiverjs/archiver-utils.git","private":false}},{"id":"38e39a5c3788e5c4","name":"are-we-there-yet","version":"1.1.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:are-we-there-yet:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there-yet:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/are-we-there-yet@1.1.7","metadataType":"javascript-npm-package","metadata":{"name":"are-we-there-yet","version":"1.1.7","author":"Rebecca Turner (http://re-becca.org)","homepage":"https://github.com/iarna/are-we-there-yet","description":"Keep track of the overall completion of many disparate processes","url":"https://github.com/iarna/are-we-there-yet.git","private":false}},{"id":"a1e5dbdcb445cc0b","name":"are-we-there-yet","version":"3.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:are-we-there-yet:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there-yet:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/are-we-there-yet@3.0.1","metadataType":"javascript-npm-package","metadata":{"name":"are-we-there-yet","version":"3.0.1","author":"GitHub Inc.","homepage":"https://github.com/npm/are-we-there-yet","description":"Keep track of the overall completion of many disparate processes","url":"https://github.com/npm/are-we-there-yet.git","private":false}},{"id":"1d7fb08b7a508a14","name":"arg","version":"4.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arg/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arg/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:arg:arg:4.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arg@4.1.3","metadataType":"javascript-npm-package","metadata":{"name":"arg","version":"4.1.3","author":"Josh Junon ","homepage":"","description":"Another simple argument parser","url":"zeit/arg","private":false}},{"id":"d60313d70eaae47d","name":"argparse","version":"1.0.10","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/argparse/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/argparse/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/argparse/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/argparse/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:argparse:argparse:1.0.10:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/argparse@1.0.10","metadataType":"javascript-npm-package","metadata":{"name":"argparse","version":"1.0.10","author":"Eugene Shkuropat, Paul Jacobson","homepage":"","description":"Very powerful CLI arguments parser. Native port of argparse - python's options parsing library","url":"nodeca/argparse","private":false}},{"id":"79c9f00f6f2bc886","name":"arr-diff","version":"4.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arr-diff/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-diff/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arr-diff/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-diff/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-diff:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-diff:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_diff:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_diff:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arr-diff@4.0.0","metadataType":"javascript-npm-package","metadata":{"name":"arr-diff","version":"4.0.0","author":"Jon Schlinkert (https://github.com/jonschlinkert), Jon Schlinkert (http://twitter.com/jonschlinkert), Paul Miller (paulmillr.com)","homepage":"https://github.com/jonschlinkert/arr-diff","description":"Returns an array with only the unique values from the first array, by excluding all values from additional arrays using strict equality for comparisons.","url":"jonschlinkert/arr-diff","private":false}},{"id":"af48b36479290ede","name":"arr-flatten","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arr-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-flatten/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arr-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-flatten/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-flatten:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-flatten:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_flatten:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_flatten:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arr-flatten@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"arr-flatten","version":"1.1.0","author":"Jon Schlinkert (https://github.com/jonschlinkert), Jon Schlinkert (http://twitter.com/jonschlinkert), Luke Edwards (https://lukeed.com)","homepage":"https://github.com/jonschlinkert/arr-flatten","description":"Recursively flatten an array or arrays.","url":"jonschlinkert/arr-flatten","private":false}},{"id":"93ff899831bd49b7","name":"arr-union","version":"3.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arr-union/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-union/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arr-union/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-union/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-union:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-union:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_union:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_union:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arr-union@3.1.0","metadataType":"javascript-npm-package","metadata":{"name":"arr-union","version":"3.1.0","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/arr-union","description":"Combines a list of arrays, returning a single array with unique values, using strict equality for comparisons.","url":"jonschlinkert/arr-union","private":false}},{"id":"f2867470e7b27597","name":"array-buffer-byte-length","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-buffer-byte-length/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-buffer-byte-length/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-buffer-byte-length/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-buffer-byte-length/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:array-buffer-byte-length:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer-byte-length:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte_length:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte_length:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer-byte:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer-byte:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-buffer-byte-length@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"array-buffer-byte-length","version":"1.0.2","author":"Jordan Harband ","homepage":"https://github.com/inspect-js/array-buffer-byte-length#readme","description":"Get the byte length of an ArrayBuffer, even in engines without a `.byteLength` method.","url":"git+https://github.com/inspect-js/array-buffer-byte-length.git","private":false}},{"id":"7aadb2fc6095104c","name":"array-each","version":"1.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-each/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-each/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-each/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-each/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-each:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-each:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_each:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_each:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-each@1.0.1","metadataType":"javascript-npm-package","metadata":{"name":"array-each","version":"1.0.1","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/array-each","description":"Loop over each item in an array and call the given function on every element.","url":"jonschlinkert/array-each","private":false}},{"id":"5041c141565d0833","name":"array-flatten","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-flatten/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-flatten/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:array-flatten:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-flatten:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_flatten:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_flatten:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:blakeembrey:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:blakeembrey:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-flatten@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"array-flatten","version":"1.1.1","author":"Blake Embrey (http://blakeembrey.me)","homepage":"https://github.com/blakeembrey/array-flatten","description":"Flatten an array of nested arrays into a single flat array","url":"git://github.com/blakeembrey/array-flatten.git","private":false}},{"id":"a261f10f751ab469","name":"array-slice","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-slice/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-slice/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-slice/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-slice/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-slice:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-slice:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_slice:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_slice:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-slice@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"array-slice","version":"1.1.0","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/array-slice","description":"Array-slice method. Slices `array` from the `start` index up to, but not including, the `end` index.","url":"jonschlinkert/array-slice","private":false}},{"id":"9bb35b54a028e73b","name":"array-unique","version":"0.3.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-unique/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-unique/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-unique/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-unique/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-unique:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-unique:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_unique:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_unique:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-unique@0.3.2","metadataType":"javascript-npm-package","metadata":{"name":"array-unique","version":"0.3.2","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/array-unique","description":"Remove duplicate values from an array. Fastest ES5 implementation.","url":"jonschlinkert/array-unique","private":false}},{"id":"1c54e38011c51e5b","name":"asap","version":"2.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/asap/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/asap/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/asap/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/asap/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:kriskowal:asap:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:asap:asap:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/asap@2.0.6","metadataType":"javascript-npm-package","metadata":{"name":"asap","version":"2.0.6","author":"","homepage":"","description":"High-priority task queue for Node.js and browsers","url":"https://github.com/kriskowal/asap.git","private":false}},{"id":"e57cc97cb7061a4e","name":"assert-never","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/assert-never/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assert-never/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/assert-never/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assert-never/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:assert-never:assert-never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert-never:assert_never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert_never:assert-never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert_never:assert_never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert:assert-never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert:assert_never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/assert-never@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"assert-never","version":"1.4.0","author":"Daniel Lytkin ","homepage":"","description":"Helper function for exhaustive checks of discriminated unions in TypeScript","url":"aikoven/assert-never","private":false}},{"id":"e6db49d199a690ef","name":"assign-symbols","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/assign-symbols/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assign-symbols/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/assign-symbols/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assign-symbols/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:assign-symbols:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign-symbols:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign_symbols:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign_symbols:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/assign-symbols@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"assign-symbols","version":"1.0.0","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/assign-symbols","description":"Assign the enumerable es6 Symbol properties from an object (or objects) to the first object passed on the arguments. Can be used as a supplement to other extend, assign or merge methods as a polyfill for the Symbols part of the es6 Object.assign method.","url":"jonschlinkert/assign-symbols","private":false}},{"id":"50f2f4c26ff2ccab","name":"async","version":"2.6.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/async/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/async/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:caolan:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:async:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/async@2.6.4","metadataType":"javascript-npm-package","metadata":{"name":"async","version":"2.6.4","author":"Caolan McMahon","homepage":"https://caolan.github.io/async/","description":"Higher-order functions and common patterns for asynchronous code","url":"https://github.com/caolan/async.git","private":false}},{"id":"5aa21ddd678e2c5a","name":"async","version":"2.6.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:caolan:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:async:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/async@2.6.4","metadataType":"javascript-npm-package","metadata":{"name":"async","version":"2.6.4","author":"Caolan McMahon","homepage":"https://caolan.github.io/async/","description":"Higher-order functions and common patterns for asynchronous code","url":"https://github.com/caolan/async.git","private":false}},{"id":"6753e2a5837ba461","name":"async","version":"3.2.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/async/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/async/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:caolan:async:3.2.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:async:async:3.2.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/async@3.2.6","metadataType":"javascript-npm-package","metadata":{"name":"async","version":"3.2.6","author":"Caolan McMahon","homepage":"https://caolan.github.io/async/","description":"Higher-order functions and common patterns for asynchronous code","url":"https://github.com/caolan/async.git","private":false}},{"id":"dd9e19320bbf0929","name":"at-least-node","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/at-least-node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/at-least-node/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/at-least-node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/at-least-node/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:at-least-node:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at-least-node:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least_node:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least_node:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at-least:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at-least:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:RyanZim:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:RyanZim:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/at-least-node@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"at-least-node","version":"1.0.0","author":"Ryan Zimmerman ","homepage":"https://github.com/RyanZim/at-least-node#readme","description":"Lightweight Node.js version sniffing/comparison","url":"git+https://github.com/RyanZim/at-least-node.git","private":false}},{"id":"27aacb47fbbddd97","name":"atob","version":"2.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/atob/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/atob/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"(MIT OR Apache-2.0)","spdxExpression":"(MIT OR Apache-2.0)","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/atob/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/atob/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:atob_project:atob:2.1.2:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/atob@2.1.2","metadataType":"javascript-npm-package","metadata":{"name":"atob","version":"2.1.2","author":"AJ ONeal (https://coolaj86.com)","homepage":"https://git.coolaj86.com/coolaj86/atob.js.git","description":"atob for Node.JS and Linux / Mac / Windows CLI (it's a one-liner)","url":"git://git.coolaj86.com/coolaj86/atob.js.git","private":false}},{"id":"91c13e4c18804052","name":"available-typed-arrays","version":"1.0.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/available-typed-arrays/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/available-typed-arrays/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/available-typed-arrays/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/available-typed-arrays/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:available-typed-arrays:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available-typed-arrays:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed_arrays:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed_arrays:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available-typed:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available-typed:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/available-typed-arrays@1.0.7","metadataType":"javascript-npm-package","metadata":{"name":"available-typed-arrays","version":"1.0.7","author":"Jordan Harband ","homepage":"https://github.com/inspect-js/available-typed-arrays#readme","description":"Returns an array of Typed Array names that are available in the current environment","url":"git+https://github.com/inspect-js/available-typed-arrays.git","private":false}},{"id":"716281520579424d","name":"babel-walk","version":"3.0.0-canary-5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/babel-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/babel-walk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/babel-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/babel-walk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:babel-walk:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel-walk:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel_walk:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel_walk:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pugjs:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pugjs:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/babel-walk@3.0.0-canary-5","metadataType":"javascript-npm-package","metadata":{"name":"babel-walk","version":"3.0.0-canary-5","author":"Timothy Gu ","homepage":"","description":"Lightweight Babel AST traversal","url":"https://github.com/pugjs/babel-walk.git","private":false}},{"id":"956658d078dc7d57","name":"balanced-match","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/balanced-match/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/balanced-match/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/balanced-match/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/balanced-match/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:balanced-match:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced-match:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced_match:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced_match:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/balanced-match@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"balanced-match","version":"1.0.2","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/balanced-match","description":"Match balanced character pairs, like \"{\" and \"}\"","url":"git://github.com/juliangruber/balanced-match.git","private":false}},{"id":"1921674c9fb6eba8","name":"base","version":"0.11.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:node-base:base:0.11.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base:base:0.11.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base@0.11.2","metadataType":"javascript-npm-package","metadata":{"name":"base","version":"0.11.2","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), John O'Donnell (https://github.com/criticalmash), Jon Schlinkert (http://twitter.com/jonschlinkert), tunnckoCore (https://i.am.charlike.online), , Brian Woodward (https://github.com/doowb), Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/node-base/base","description":"base is the foundation for creating modular, unit testable and highly pluggable node.js applications, starting with a handful of common methods, like `set`, `get`, `del` and `use`.","url":"node-base/base","private":false}},{"id":"c91bc2e84142f428","name":"base-files","version":"12.4+deb12u11","type":"deb","foundBy":"dpkg-db-cataloger","locations":[{"path":"/var/lib/dpkg/status.d/base-files","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/var/lib/dpkg/status.d/base-files","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/base-files/copyright","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/usr/share/doc/base-files/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/base-files.md5sums","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/var/lib/dpkg/status.d/base-files.md5sums","annotations":{"evidence":"supporting"}}],"licenses":[{"value":"GPL","spdxExpression":"","type":"declared","urls":[],"locations":[{"path":"/usr/share/doc/base-files/copyright","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/usr/share/doc/base-files/copyright"}]}],"language":"","cpes":[{"cpe":"cpe:2.3:a:base-files:base-files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base-files:base_files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base_files:base-files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base_files:base_files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base:base-files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base:base_files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:deb/debian/base-files@12.4%2Bdeb12u11?arch=amd64&distro=debian-12","metadataType":"dpkg-db-entry","metadata":{"package":"base-files","source":"","version":"12.4+deb12u11","sourceVersion":"","architecture":"amd64","maintainer":"Santiago Vila ","installedSize":341,"provides":["base"],"preDepends":["awk"],"files":[{"path":"/usr/lib/os-release","digest":{"algorithm":"md5","value":"07d31e7e63800ab1b7966980709c51eb"},"isConfigFile":false},{"path":"/usr/share/base-files/dot.bashrc","digest":{"algorithm":"md5","value":"0a540d50c157ed0070459b82c358a05a"},"isConfigFile":false},{"path":"/usr/share/base-files/dot.profile","digest":{"algorithm":"md5","value":"d68ce7c7d7d2bb7d48aeb2f137b828e4"},"isConfigFile":false},{"path":"/usr/share/base-files/dot.profile.md5sums","digest":{"algorithm":"md5","value":"6db82730e03aaeeecb8fee76b73d96d4"},"isConfigFile":false},{"path":"/usr/share/base-files/info.dir","digest":{"algorithm":"md5","value":"f9128f409878ce10d54d06488e3ce136"},"isConfigFile":false},{"path":"/usr/share/base-files/motd","digest":{"algorithm":"md5","value":"9830e3dbb6a828f2cc824db8db0ceaf7"},"isConfigFile":false},{"path":"/usr/share/base-files/profile","digest":{"algorithm":"md5","value":"48a30a427d1794feb49f102b87ddce2b"},"isConfigFile":false},{"path":"/usr/share/base-files/profile.md5sums","digest":{"algorithm":"md5","value":"9be77181dd5dcc2b87956e3d45ed191d"},"isConfigFile":false},{"path":"/usr/share/base-files/staff-group-for-usr-local","digest":{"algorithm":"md5","value":"f3b332b9a376a0567236f54d7d87f85e"},"isConfigFile":false},{"path":"/usr/share/common-licenses/Apache-2.0","digest":{"algorithm":"md5","value":"3b83ef96387f14655fc854ddc3c6bd57"},"isConfigFile":false},{"path":"/usr/share/common-licenses/Artistic","digest":{"algorithm":"md5","value":"f921793d03cc6d63ec4b15e9be8fd3f8"},"isConfigFile":false},{"path":"/usr/share/common-licenses/BSD","digest":{"algorithm":"md5","value":"3775480a712fc46a69647678acb234cb"},"isConfigFile":false},{"path":"/usr/share/common-licenses/CC0-1.0","digest":{"algorithm":"md5","value":"65d3616852dbf7b1a6d4b53b00626032"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GFDL-1.2","digest":{"algorithm":"md5","value":"cfe2a5472d5eaa226eae091d4114ce29"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GFDL-1.3","digest":{"algorithm":"md5","value":"a22d0be1ce2284b67950a4d1673dd1b0"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GPL-1","digest":{"algorithm":"md5","value":"5b122a36d0f6dc55279a0ebc69f3c60b"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GPL-2","digest":{"algorithm":"md5","value":"b234ee4d69f5fce4486a80fdaf4a4263"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GPL-3","digest":{"algorithm":"md5","value":"1ebbd3e34237af26da5dc08a4e440464"},"isConfigFile":false},{"path":"/usr/share/common-licenses/LGPL-2","digest":{"algorithm":"md5","value":"4cf66a4984120007c9881cc871cf49db"},"isConfigFile":false},{"path":"/usr/share/common-licenses/LGPL-2.1","digest":{"algorithm":"md5","value":"4fbd65380cdd255951079008b364516c"},"isConfigFile":false},{"path":"/usr/share/common-licenses/LGPL-3","digest":{"algorithm":"md5","value":"3000208d539ec061b899bce1d9ce9404"},"isConfigFile":false},{"path":"/usr/share/common-licenses/MPL-1.1","digest":{"algorithm":"md5","value":"0c5913925d40b124fb52ce84c5deb3f3"},"isConfigFile":false},{"path":"/usr/share/common-licenses/MPL-2.0","digest":{"algorithm":"md5","value":"815ca599c9df247a0c7f619bab123dad"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/README","digest":{"algorithm":"md5","value":"af032ddc1821dfc3eb1dbb5883910119"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/README.FHS","digest":{"algorithm":"md5","value":"fbd937e067f0a83fb9422713a6b84a8a"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/changelog.gz","digest":{"algorithm":"md5","value":"3fa5ee8dc0d994cdc2c4f7022606f81e"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/copyright","digest":{"algorithm":"md5","value":"1b8bb96d42614948cb7de2882e191734"},"isConfigFile":false},{"path":"/usr/share/lintian/overrides/base-files","digest":{"algorithm":"md5","value":"9dbaaf7a8333c30200f3d11e831acb82"},"isConfigFile":false}]}},{"id":"7b4063d10599bfae","name":"base64-arraybuffer","version":"0.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64-arraybuffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-arraybuffer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64-arraybuffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-arraybuffer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:base64-arraybuffer:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-arraybuffer:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_arraybuffer:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_arraybuffer:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:niklasvh:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:niklasvh:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64-arraybuffer@0.1.4","metadataType":"javascript-npm-package","metadata":{"name":"base64-arraybuffer","version":"0.1.4","author":"Niklas von Hertzen (http://hertzen.com)","homepage":"https://github.com/niklasvh/base64-arraybuffer","description":"Encode/decode base64 data into ArrayBuffers","url":"https://github.com/niklasvh/base64-arraybuffer","private":false}},{"id":"6f1f1a7796cb63d0","name":"base64-js","version":"0.0.8","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:beatgammit:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beatgammit:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64-js@0.0.8","metadataType":"javascript-npm-package","metadata":{"name":"base64-js","version":"0.0.8","author":"T. Jameson Little ","homepage":"","description":"Base64 encoding/decoding in pure JS","url":"git://github.com/beatgammit/base64-js.git","private":false}},{"id":"c493a9a41b36da0b","name":"base64-js","version":"1.5.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:beatgammit:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beatgammit:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64-js@1.5.1","metadataType":"javascript-npm-package","metadata":{"name":"base64-js","version":"1.5.1","author":"T. Jameson Little ","homepage":"https://github.com/beatgammit/base64-js","description":"Base64 encoding/decoding in pure JS","url":"git://github.com/beatgammit/base64-js.git","private":false}},{"id":"d1750eb90689f1a4","name":"base64id","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64id/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64id/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64id/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64id/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:base64id:base64id:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:faeldt:base64id:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64id@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"base64id","version":"2.0.0","author":"Kristian Faeldt ","homepage":"","description":"Generates a base64 id","url":"https://github.com/faeldt/base64id.git","private":false}},{"id":"2f8a9d6c7656ba10","name":"base64url","version":"0.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64url/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64url/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64url/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64url/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brianloveswords:base64url:0.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64url:base64url:0.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64url@0.0.6","metadataType":"javascript-npm-package","metadata":{"name":"base64url","version":"0.0.6","author":"Brian J Brennan","homepage":"","description":"For encoding to/from base64urls","url":"git://github.com/brianloveswords/base64url.git","private":false}},{"id":"580ca5f2beaae938","name":"basic-auth","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:basic-auth:basic-auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic-auth:basic_auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic_auth:basic-auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic_auth:basic_auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic:basic-auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic:basic_auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/basic-auth@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"basic-auth","version":"2.0.1","author":"","homepage":"","description":"node.js basic auth parser","url":"jshttp/basic-auth","private":false}},{"id":"344c43aaf43bb8dc","name":"batch","version":"0.6.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/batch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/batch/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/batch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/batch/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:visionmedia:batch:0.6.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:batch:batch:0.6.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/batch@0.6.1","metadataType":"javascript-npm-package","metadata":{"name":"batch","version":"0.6.1","author":"TJ Holowaychuk ","homepage":"","description":"Simple async batch with concurrency control and progress reporting.","url":"https://github.com/visionmedia/batch.git","private":false}},{"id":"99a08ef6ddd74ba7","name":"baz","version":"UNKNOWN","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/baz/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/baz/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:baz:baz:*:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/baz","metadataType":"javascript-npm-package","metadata":{"name":"baz","version":"","author":"","homepage":"","description":"","url":"","private":false}},{"id":"ac8f35c9bc6d4edc","name":"beep-boop","version":"1.2.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/github-from-package/example/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/github-from-package/example/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:beep-boop:beep-boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep-boop:beep_boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep_boop:beep-boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep_boop:beep_boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep:beep-boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep:beep_boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/beep-boop@1.2.3","metadataType":"javascript-npm-package","metadata":{"name":"beep-boop","version":"1.2.3","author":"","homepage":"","description":"","url":"git@github.com:substack/beep-boop.git","private":false}},{"id":"6efaee3d2e9117ff","name":"big-integer","version":"1.6.52","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/big-integer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/big-integer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"Unlicense","spdxExpression":"Unlicense","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/big-integer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/big-integer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:big-integer:big-integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big-integer:big_integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big_integer:big-integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big_integer:big_integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big:big-integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big:big_integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/big-integer@1.6.52","metadataType":"javascript-npm-package","metadata":{"name":"big-integer","version":"1.6.52","author":"Peter Olson ","homepage":"","description":"An arbitrary length integer library for Javascript","url":"git@github.com:peterolson/BigInteger.js.git","private":false}},{"id":"aac28aacec14e6f2","name":"binary","version":"0.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/binary/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/binary/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:substack:binary:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary:binary:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/binary@0.3.0","metadataType":"javascript-npm-package","metadata":{"name":"binary","version":"0.3.0","author":"James Halliday (http://substack.net)","homepage":"","description":"Unpack multibyte binary values from buffers","url":"http://github.com/substack/node-binary.git","private":false}},{"id":"cdea7c486a93d741","name":"binary-extensions","version":"2.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/binary-extensions/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary-extensions/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/binary-extensions/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary-extensions/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:binary-extensions:binary-extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary-extensions:binary_extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary_extensions:binary-extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary_extensions:binary_extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary:binary-extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary:binary_extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/binary-extensions@2.3.0","metadataType":"javascript-npm-package","metadata":{"name":"binary-extensions","version":"2.3.0","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"List of binary file extensions","url":"sindresorhus/binary-extensions","private":false}},{"id":"848e919a5348c76e","name":"bindings","version":"1.5.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bindings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bindings/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bindings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bindings/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:bindings:1.5.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bindings:bindings:1.5.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bindings@1.5.0","metadataType":"javascript-npm-package","metadata":{"name":"bindings","version":"1.5.0","author":"Nathan Rajlich (http://tootallnate.net)","homepage":"https://github.com/TooTallNate/node-bindings","description":"Helper module for loading your native module's .node file","url":"git://github.com/TooTallNate/node-bindings.git","private":false}},{"id":"db53f4ebaee4e2cf","name":"bintrees","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bintrees/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bintrees/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bintrees/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bintrees/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:bintrees:bintrees:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:vadimg:bintrees:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bintrees@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"bintrees","version":"1.0.2","author":"Vadim Graboys ","homepage":"","description":"Binary Search Trees","url":"git://github.com/vadimg/js_bintrees.git","private":false}},{"id":"1d71c68896a44c86","name":"bl","version":"1.2.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bl/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bl/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:rvagg:bl:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bl:bl:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bl@1.2.3","metadataType":"javascript-npm-package","metadata":{"name":"bl","version":"1.2.3","author":"Rod Vagg (https://github.com/rvagg), Matteo Collina (https://github.com/mcollina), Jarett Cruger (https://github.com/jcrugzz)","homepage":"https://github.com/rvagg/bl","description":"Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!","url":"https://github.com/rvagg/bl.git","private":false}},{"id":"846a0edd607229fd","name":"bl","version":"4.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:rvagg:bl:4.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bl:bl:4.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bl@4.1.0","metadataType":"javascript-npm-package","metadata":{"name":"bl","version":"4.1.0","author":"Rod Vagg (https://github.com/rvagg), Matteo Collina (https://github.com/mcollina), Jarett Cruger (https://github.com/jcrugzz)","homepage":"https://github.com/rvagg/bl","description":"Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!","url":"https://github.com/rvagg/bl.git","private":false}},{"id":"441b568aa058ddd4","name":"bluebird","version":"3.4.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:petkaantonov:bluebird:3.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bluebird:bluebird:3.4.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bluebird@3.4.7","metadataType":"javascript-npm-package","metadata":{"name":"bluebird","version":"3.4.7","author":"Petka Antonov (http://github.com/petkaantonov/)","homepage":"https://github.com/petkaantonov/bluebird","description":"Full featured Promises/A+ implementation with exceptionally good performance","url":"git://github.com/petkaantonov/bluebird.git","private":false}},{"id":"45ec017cc93f373c","name":"bluebird","version":"3.7.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:petkaantonov:bluebird:3.7.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bluebird:bluebird:3.7.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bluebird@3.7.2","metadataType":"javascript-npm-package","metadata":{"name":"bluebird","version":"3.7.2","author":"Petka Antonov (http://github.com/petkaantonov/)","homepage":"https://github.com/petkaantonov/bluebird","description":"Full featured Promises/A+ implementation with exceptionally good performance","url":"git://github.com/petkaantonov/bluebird.git","private":false}},{"id":"d8348f0566c46229","name":"body-parser","version":"1.20.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/body-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/body-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:openjsf:body-parser:1.20.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/body-parser@1.20.3","metadataType":"javascript-npm-package","metadata":{"name":"body-parser","version":"1.20.3","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com)","homepage":"","description":"Node.js body parsing middleware","url":"expressjs/body-parser","private":false}},{"id":"2c560d35b75226b0","name":"bower-config","version":"1.4.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bower-config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bower-config/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bower-config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bower-config/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:bower-config:bower-config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower-config:bower_config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower_config:bower-config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower_config:bower_config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower:bower-config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower:bower_config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bower-config@1.4.3","metadataType":"javascript-npm-package","metadata":{"name":"bower-config","version":"1.4.3","author":"Twitter","homepage":"http://bower.io","description":"The Bower config reader and writer.","url":"https://github.com/bower/bower/tree/master/packages/bower-config","private":false}},{"id":"79ca6b57cb6da8f4","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"edfc435f78ffbb1c","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"38ff028c7c458475","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"c861e69821b6b8fe","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"70266c742ac992ba","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"e9b43263265b984a","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"28fb5bb71047516a","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"098d823421bc1197","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"17d5b1f1f2c265c0","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"ec01b45e50a80fc7","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"204df6e1c0323307","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"1fcda56aa7b9b39c","name":"brace-expansion","version":"2.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@2.0.2","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"2.0.2","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"e18c817c2057c675","name":"braces","version":"2.3.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:2.3.2:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"},{"cpe":"cpe:2.3:a:jonschlinkert:braces:2.3.2:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@2.3.2","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"2.3.2","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"1fea4d70444c02f0","name":"braces","version":"3.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"},{"cpe":"cpe:2.3:a:jonschlinkert:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@3.0.3","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"3.0.3","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"05e4a42f1d20184c","name":"braces","version":"3.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"},{"cpe":"cpe:2.3:a:jonschlinkert:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@3.0.3","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"3.0.3","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"7300fec6ea68a472","name":"braces","version":"3.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"},{"cpe":"cpe:2.3:a:jonschlinkert:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@3.0.3","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"3.0.3","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"470bc485996d4bbe","name":"brotli","version":"1.3.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/brotli/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brotli/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/brotli/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brotli/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:devongovett:brotli:1.3.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brotli:brotli:1.3.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brotli@1.3.3","metadataType":"javascript-npm-package","metadata":{"name":"brotli","version":"1.3.3","author":"Devon Govett ","homepage":"https://github.com/devongovett/brotli.js","description":"A port of the Brotli compression algorithm as used in WOFF2","url":"https://github.com/devongovett/brotli.js.git","private":false}},{"id":"0ec800aec91252a5","name":"browser_field","version":"UNKNOWN","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/browser_field/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/browser_field/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:browser-field:browser-field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser-field:browser_field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser_field:browser-field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser_field:browser_field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser:browser-field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser:browser_field:*:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/browser_field","metadataType":"javascript-npm-package","metadata":{"name":"browser_field","version":"","author":"","homepage":"","description":"","url":"","private":false}},{"id":"8160d61272f16fc2","name":"buffer","version":"5.7.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer:buffer:5.7.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:feross:buffer:5.7.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer@5.7.1","metadataType":"javascript-npm-package","metadata":{"name":"buffer","version":"5.7.1","author":"Feross Aboukhadijeh (https://feross.org), Romain Beauxis , James Halliday ","homepage":"https://github.com/feross/buffer","description":"Node.js Buffer API, for the browser","url":"git://github.com/feross/buffer.git","private":false}},{"id":"b34920cb2184e6ad","name":"buffer","version":"6.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer:buffer:6.0.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:feross:buffer:6.0.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer@6.0.3","metadataType":"javascript-npm-package","metadata":{"name":"buffer","version":"6.0.3","author":"Feross Aboukhadijeh (https://feross.org), Romain Beauxis , James Halliday ","homepage":"https://github.com/feross/buffer","description":"Node.js Buffer API, for the browser","url":"git://github.com/feross/buffer.git","private":false}},{"id":"0215db4a4aa6cd05","name":"buffer-alloc","version":"1.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-alloc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-alloc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-alloc:buffer-alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc:buffer_alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer-alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer_alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-alloc@1.2.0","metadataType":"javascript-npm-package","metadata":{"name":"buffer-alloc","version":"1.2.0","author":"","homepage":"","description":"","url":"LinusU/buffer-alloc","private":false}},{"id":"72525885a05217f9","name":"buffer-alloc-unsafe","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-alloc-unsafe:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc-unsafe:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc_unsafe:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc_unsafe:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-alloc-unsafe@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"buffer-alloc-unsafe","version":"1.1.0","author":"","homepage":"","description":"","url":"LinusU/buffer-alloc-unsafe","private":false}},{"id":"018e707480d9a394","name":"buffer-crc32","version":"0.2.13","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-crc32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-crc32/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-crc32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-crc32/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brianloveswords:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brianloveswords:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-crc32:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-crc32:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_crc32:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_crc32:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-crc32@0.2.13","metadataType":"javascript-npm-package","metadata":{"name":"buffer-crc32","version":"0.2.13","author":"Brian J. Brennan , Vladimir Kuznetsov","homepage":"https://github.com/brianloveswords/buffer-crc32","description":"A pure javascript CRC32 algorithm that plays nice with binary data","url":"git://github.com/brianloveswords/buffer-crc32.git","private":false}},{"id":"b5b4b05d23ef0590","name":"buffer-fill","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-fill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-fill/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-fill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-fill/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-fill:buffer-fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-fill:buffer_fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_fill:buffer-fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_fill:buffer_fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-fill@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"buffer-fill","version":"1.0.0","author":"","homepage":"","description":"","url":"LinusU/buffer-fill","private":false}},{"id":"d2869a97005ddd30","name":"buffer-from","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-from/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-from/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-from/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-from/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-from:buffer-from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-from:buffer_from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_from:buffer-from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_from:buffer_from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-from@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"buffer-from","version":"1.1.2","author":"","homepage":"","description":"","url":"LinusU/buffer-from","private":false}},{"id":"08bc6bd9a895200f","name":"buffer-indexof-polyfill","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-indexof-polyfill:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-indexof-polyfill:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof_polyfill:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof_polyfill:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-indexof:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-indexof:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sarosia:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sarosia:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-indexof-polyfill@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"buffer-indexof-polyfill","version":"1.0.2","author":"https://github.com/sarosia","homepage":"https://github.com/sarosia/buffer-indexof-polyfill#readme","description":"This is a polyfill for Buffer#indexOf introduced in NodeJS 4.0.","url":"git+https://github.com/sarosia/buffer-indexof-polyfill.git","private":false}},{"id":"fd60bbd17e6803d8","name":"buffers","version":"0.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffers/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:substack:buffers:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffers:buffers:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffers@0.1.1","metadataType":"javascript-npm-package","metadata":{"name":"buffers","version":"0.1.1","author":"James Halliday (http://substack.net)","homepage":"","description":"Treat a collection of Buffers as a single contiguous partially mutable Buffer.","url":"http://github.com/substack/node-buffers.git","private":false}},{"id":"72b84630ff8aade7","name":"busboy","version":"1.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/busboy/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/busboy/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/busboy/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/busboy/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:busboy:busboy:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mscdex:busboy:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/busboy@1.6.0","metadataType":"javascript-npm-package","metadata":{"name":"busboy","version":"1.6.0","author":"Brian White ","homepage":"","description":"A streaming parser for HTML form data for node.js","url":"http://github.com/mscdex/busboy.git","private":false}},{"id":"1db66371bc7880de","name":"byline","version":"4.2.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/byline/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/byline/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/byline/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/byline/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jahewson:byline:4.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:byline:byline:4.2.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/byline@4.2.2","metadataType":"javascript-npm-package","metadata":{"name":"byline","version":"4.2.2","author":"John Hewson","homepage":"https://github.com/jahewson/node-byline","description":"simple line-by-line stream reader","url":"https://github.com/jahewson/node-byline","private":false}},{"id":"1d0cce2090c4dc09","name":"bytes","version":"3.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bytes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bytes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bytes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bytes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:bytes:bytes:3.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bytes@3.1.2","metadataType":"javascript-npm-package","metadata":{"name":"bytes","version":"3.1.2","author":"TJ Holowaychuk (http://tjholowaychuk.com), Jed Watson , Théo FIDRY ","homepage":"","description":"Utility to parse a string bytes to bytes and vice-versa","url":"visionmedia/bytes.js","private":false}},{"id":"f5c0681a2e946e2d","name":"cacache","version":"15.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cacache:cacache:15.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:cacache:15.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cacache@15.3.0","metadataType":"javascript-npm-package","metadata":{"name":"cacache","version":"15.3.0","author":"","homepage":"","description":"Fast, fault-tolerant, cross-platform, disk-based, data-agnostic, content-addressable cache.","url":"https://github.com/npm/cacache","private":false}},{"id":"ace0af3ce948f36b","name":"cacache","version":"19.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cacache:cacache:19.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cacache@19.0.1","metadataType":"javascript-npm-package","metadata":{"name":"cacache","version":"19.0.1","author":"GitHub Inc.","homepage":"","description":"Fast, fault-tolerant, cross-platform, disk-based, data-agnostic, content-addressable cache.","url":"git+https://github.com/npm/cacache.git","private":false}},{"id":"baaa5d54fe4a3c13","name":"cache-base","version":"1.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cache-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cache-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cache-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cache-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cache-base_project:cache-base:1.0.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/cache-base@1.0.1","metadataType":"javascript-npm-package","metadata":{"name":"cache-base","version":"1.0.1","author":"Jon Schlinkert (https://github.com/jonschlinkert), Jon Schlinkert (http://twitter.com/jonschlinkert), ","homepage":"https://github.com/jonschlinkert/cache-base","description":"Basic object cache with `get`, `set`, `del`, and `has` methods for node.js/javascript projects.","url":"jonschlinkert/cache-base","private":false}},{"id":"346e1627c1f72870","name":"cacheable-request","version":"2.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cacheable-request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacheable-request/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cacheable-request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacheable-request/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cacheable-request:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable-request:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable_request:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable_request:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cacheable-request@2.1.4","metadataType":"javascript-npm-package","metadata":{"name":"cacheable-request","version":"2.1.4","author":"Luke Childs (http://lukechilds.co.uk)","homepage":"https://github.com/lukechilds/cacheable-request","description":"Wrap native HTTP requests with RFC compliant cache support","url":"git+https://github.com/lukechilds/cacheable-request.git","private":false}},{"id":"b538562043029461","name":"call-bind","version":"1.0.8","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/call-bind/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/call-bind/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:call-bind:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/call-bind@1.0.8","metadataType":"javascript-npm-package","metadata":{"name":"call-bind","version":"1.0.8","author":"Jordan Harband ","homepage":"https://github.com/ljharb/call-bind#readme","description":"Robustly `.call.bind()` a function","url":"git+https://github.com/ljharb/call-bind.git","private":false}},{"id":"0d18b02f5378691f","name":"call-bind-apply-helpers","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:call-bind-apply-helpers:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind-apply-helpers:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply_helpers:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply_helpers:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind-apply:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind-apply:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/call-bind-apply-helpers@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"call-bind-apply-helpers","version":"1.0.2","author":"Jordan Harband ","homepage":"https://github.com/ljharb/call-bind-apply-helpers#readme","description":"Helper functions around Function call/apply/bind, for use in `call-bind`","url":"git+https://github.com/ljharb/call-bind-apply-helpers.git","private":false}},{"id":"44af6e189fe32d87","name":"call-bound","version":"1.0.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/call-bound/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bound/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/call-bound/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bound/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:call-bound:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bound:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bound:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bound:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/call-bound@1.0.4","metadataType":"javascript-npm-package","metadata":{"name":"call-bound","version":"1.0.4","author":"Jordan Harband ","homepage":"https://github.com/ljharb/call-bound#readme","description":"Robust call-bound JavaScript intrinsics, using `call-bind` and `get-intrinsic`.","url":"git+https://github.com/ljharb/call-bound.git","private":false}},{"id":"92e4f8e8e365d6ef","name":"camelcase","version":"5.3.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/camelcase/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/camelcase/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/camelcase/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/camelcase/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:camelcase:camelcase:5.3.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/camelcase@5.3.1","metadataType":"javascript-npm-package","metadata":{"name":"camelcase","version":"5.3.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Convert a dash/dot/underscore/space separated string to camelCase or PascalCase: `foo-bar` → `fooBar`","url":"sindresorhus/camelcase","private":false}},{"id":"6e4c3d3622249d54","name":"chainsaw","version":"0.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chainsaw/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chainsaw/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT/X11","spdxExpression":"","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chainsaw/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chainsaw/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chainsaw:chainsaw:0.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:substack:chainsaw:0.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chainsaw@0.1.0","metadataType":"javascript-npm-package","metadata":{"name":"chainsaw","version":"0.1.0","author":"James Halliday (http://substack.net)","homepage":"","description":"Build chainable fluent interfaces the easy way... with a freakin' chainsaw!","url":"http://github.com/substack/node-chainsaw.git","private":false}},{"id":"af9826c69b6847f8","name":"chalk","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chalk:chalk:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chalk@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"chalk","version":"1.1.3","author":"Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Terminal string styling done right. Much color.","url":"chalk/chalk","private":false}},{"id":"015bdd0e54562d25","name":"chalk","version":"2.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chalk:chalk:2.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chalk@2.4.2","metadataType":"javascript-npm-package","metadata":{"name":"chalk","version":"2.4.2","author":"","homepage":"","description":"Terminal string styling done right","url":"chalk/chalk","private":false}},{"id":"7fe24d7225fc8b9a","name":"chalk","version":"4.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chalk:chalk:4.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chalk@4.1.2","metadataType":"javascript-npm-package","metadata":{"name":"chalk","version":"4.1.2","author":"","homepage":"","description":"Terminal string styling done right","url":"chalk/chalk","private":false}},{"id":"34bd9ccc72e70b6f","name":"character-parser","version":"2.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/character-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/character-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/character-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/character-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:character-parser:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character-parser:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character_parser:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character_parser:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ForbesLindesay:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ForbesLindesay:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/character-parser@2.2.0","metadataType":"javascript-npm-package","metadata":{"name":"character-parser","version":"2.2.0","author":"ForbesLindesay","homepage":"","description":"Parse JavaScript one character at a time to look for snippets in Templates. This is not a validator, it's just designed to allow you to have sections of JavaScript delimited by brackets robustly.","url":"https://github.com/ForbesLindesay/character-parser.git","private":false}},{"id":"0eb2e961c16ff8ae","name":"check-dependencies","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/check-dependencies/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-dependencies/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/check-dependencies/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-dependencies/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:check-dependencies:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-dependencies:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_dependencies:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_dependencies:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mgol:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mgol:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/check-dependencies@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"check-dependencies","version":"1.1.1","author":"Michał Gołębiowski-Owczarek ","homepage":"https://github.com/mgol/check-dependencies","description":"Checks if currently installed npm/bower dependencies are installed in the exact same versions that are specified in package.json/bower.json","url":"https://github.com/mgol/check-dependencies.git","private":false}},{"id":"c843870ea5cc0a9b","name":"check-internet-connected","version":"2.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/check-internet-connected/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-internet-connected/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/check-internet-connected/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-internet-connected/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:check-internet-connected:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-internet-connected:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet_connected:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet_connected:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-internet:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-internet:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aankur:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aankur:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/check-internet-connected@2.0.6","metadataType":"javascript-npm-package","metadata":{"name":"check-internet-connected","version":"2.0.6","author":"Ankur Deep Jaiswal ","homepage":"https://github.com/aankur/check-internet-connected","description":"Utility to check if internet is connected or not","url":"aankur/check-internet-connected","private":false}},{"id":"85b9eff83ffcd831","name":"check-types","version":"6.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/check-types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-types/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/check-types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-types/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:check-types:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-types:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_types:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_types:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:philbooth:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:philbooth:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/check-types@6.0.0","metadataType":"javascript-npm-package","metadata":{"name":"check-types","version":"6.0.0","author":"Phil Booth (https://github.com/philbooth)","homepage":"https://github.com/philbooth/check-types.js","description":"A little library for asserting types and values.","url":"https://github.com/philbooth/check-types.js.git","private":false}},{"id":"4d185a05cefa7d0a","name":"chokidar","version":"3.5.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chokidar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chokidar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:paulmillr:chokidar:3.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:chokidar:chokidar:3.5.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chokidar@3.5.1","metadataType":"javascript-npm-package","metadata":{"name":"chokidar","version":"3.5.1","author":"Paul Miller (https://paulmillr.com), Paul Miller (https://paulmillr.com), Elan Shanker","homepage":"https://github.com/paulmillr/chokidar","description":"Minimal and efficient cross-platform file watching library","url":"git+https://github.com/paulmillr/chokidar.git","private":false}},{"id":"7ebcfb2902378122","name":"chownr","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"1.1.4","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"671f64716b19d5fb","name":"chownr","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"1.1.4","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"3189617deb2bc884","name":"chownr","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"2.0.0","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"fffff6468e7930c0","name":"chownr","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"BlueOak-1.0.0","spdxExpression":"BlueOak-1.0.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"3.0.0","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"6cef1d3c36e6024e","name":"clarinet","version":"0.12.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clarinet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clarinet/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"BSD-2-Clause","spdxExpression":"BSD-2-Clause","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clarinet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clarinet/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clarinet:clarinet:0.12.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:dscape:clarinet:0.12.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clarinet@0.12.6","metadataType":"javascript-npm-package","metadata":{"name":"clarinet","version":"0.12.6","author":"Nuno Job (http://nunojob.com/), Jann Horn (https://github.com/thejh), Justin Makeig (http://www.audiblepop.com), Roly Fentanes (http://about.me/roly), John Lancaster (http://jlank.com)","homepage":"https://github.com/dscape/clarinet","description":"SAX based evented streaming JSON parser in JavaScript (browser and node)","url":"http://github.com/dscape/clarinet.git","private":false}},{"id":"a7e36e39ff61aea5","name":"class-utils","version":"0.3.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/class-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/class-utils/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/class-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/class-utils/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class-utils:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class-utils:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class_utils:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class_utils:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/class-utils@0.3.6","metadataType":"javascript-npm-package","metadata":{"name":"class-utils","version":"0.3.6","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Jon Schlinkert (http://twitter.com/jonschlinkert), ","homepage":"https://github.com/jonschlinkert/class-utils","description":"Utils for working with JavaScript classes and prototype methods.","url":"jonschlinkert/class-utils","private":false}},{"id":"08eaf1d1a1378cc5","name":"clean-stack","version":"2.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clean-stack/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clean-stack/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clean-stack/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clean-stack/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clean-stack:clean-stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean-stack:clean_stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean_stack:clean-stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean_stack:clean_stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean:clean-stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean:clean_stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clean-stack@2.2.0","metadataType":"javascript-npm-package","metadata":{"name":"clean-stack","version":"2.2.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Clean up error stack traces","url":"sindresorhus/clean-stack","private":false}},{"id":"6fb115e3b5d5d3f2","name":"cliui","version":"6.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cliui:cliui:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yargs:cliui:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cliui@6.0.0","metadataType":"javascript-npm-package","metadata":{"name":"cliui","version":"6.0.0","author":"Ben Coe ","homepage":"","description":"easily create complex multi-column command-line-interfaces","url":"http://github.com/yargs/cliui.git","private":false}},{"id":"080e255664d33bc7","name":"clone","version":"2.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clone/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clone/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clone:clone:2.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pvorb:clone:2.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clone@2.1.2","metadataType":"javascript-npm-package","metadata":{"name":"clone","version":"2.1.2","author":"Paul Vorbach (http://paul.vorba.ch/), Blake Miner (http://www.blakeminer.com/), Tian You (http://blog.axqd.net/), George Stagas (http://stagas.com/), Tobiasz Cudnik (https://github.com/TobiaszCudnik), Pavel Lang (https://github.com/langpavel), Dan MacTough (http://yabfog.com/), w1nk (https://github.com/w1nk), Hugh Kennedy (http://twitter.com/hughskennedy), Dustin Diaz (http://dustindiaz.com), Ilya Shaisultanov (https://github.com/diversario), Nathan MacInnes (http://macinn.es/), Benjamin E. Coe (https://twitter.com/benjamincoe), Nathan Zadoks (https://github.com/nathan7), Róbert Oroszi (https://github.com/oroce), Aurélio A. Heckert (http://softwarelivre.org/aurium), Guy Ellis (http://www.guyellisrocks.com/), fscherwi (https://fscherwi.github.io), rictic (https://github.com/rictic), Martin Jurča (https://github.com/jurca), Misery Lee (https://github.com/miserylee), Clemens Wolff (https://github.com/c-w)","homepage":"","description":"deep cloning of objects and arrays","url":"git://github.com/pvorb/node-clone.git","private":false}},{"id":"1ca687973f79cd5a","name":"clone-response","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clone-response/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone-response/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clone-response/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone-response/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clone-response:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone-response:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone_response:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone_response:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clone-response@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"clone-response","version":"1.0.2","author":"Luke Childs (http://lukechilds.co.uk)","homepage":"https://github.com/lukechilds/clone-response","description":"Clone a Node.js HTTP response stream","url":"git+https://github.com/lukechilds/clone-response.git","private":false}},{"id":"15db8f5283662b54","name":"code-point-at","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/code-point-at/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/code-point-at/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/code-point-at/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/code-point-at/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:code-point-at:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code-point-at:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point_at:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point_at:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code-point:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code-point:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/code-point-at@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"code-point-at","version":"1.1.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ES2015 `String#codePointAt()` ponyfill","url":"sindresorhus/code-point-at","private":false}},{"id":"d87950bd24d66a30","name":"collection-visit","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/collection-visit/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/collection-visit/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/collection-visit/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/collection-visit/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:collection-visit:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection-visit:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection_visit:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection_visit:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/collection-visit@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"collection-visit","version":"1.0.0","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/collection-visit","description":"Visit a method over the items in an object, or map visit over the objects in an array.","url":"jonschlinkert/collection-visit","private":false}},{"id":"2774fa6f21932145","name":"color","version":"3.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color:color:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color@3.2.1","metadataType":"javascript-npm-package","metadata":{"name":"color","version":"3.2.1","author":"Josh Junon , Heather Arthur , Maxime Thirouin","homepage":"","description":"Color conversion and manipulation with CSS string support","url":"Qix-/color","private":false}},{"id":"832fbb197a382df6","name":"color-convert","version":"1.9.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@1.9.3","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"1.9.3","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"ad73ceb607fdd321","name":"color-convert","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"2.0.1","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"c216a258a2dd7fdf","name":"color-convert","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"2.0.1","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"d7906a8074d4b4f9","name":"color-convert","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"2.0.1","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"92662d8a3adbe0c9","name":"color-name","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:dfcreative:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:dfcreative:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.3","author":"DY ","homepage":"https://github.com/dfcreative/color-name","description":"A list of color names and its values","url":"git@github.com:dfcreative/color-name.git","private":false}},{"id":"a184510682ce4734","name":"color-name","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.4","author":"DY ","homepage":"https://github.com/colorjs/color-name","description":"A list of color names and its values","url":"git@github.com:colorjs/color-name.git","private":false}},{"id":"a80b99ad61e48555","name":"color-name","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.4","author":"DY ","homepage":"https://github.com/colorjs/color-name","description":"A list of color names and its values","url":"git@github.com:colorjs/color-name.git","private":false}},{"id":"01c750f52978cfc6","name":"color-name","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.4","author":"DY ","homepage":"https://github.com/colorjs/color-name","description":"A list of color names and its values","url":"git@github.com:colorjs/color-name.git","private":false}},{"id":"7e888fa51e3748f2","name":"color-string","version":"1.9.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-string/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-string/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-string/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-string/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-string_project:color-string:1.9.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/color-string@1.9.1","metadataType":"javascript-npm-package","metadata":{"name":"color-string","version":"1.9.1","author":"Heather Arthur , Maxime Thirouin, Dyma Ywanov , Josh Junon","homepage":"","description":"Parser and generator for CSS color strings","url":"Qix-/color-string","private":false}},{"id":"a1e232528ce637f4","name":"color-support","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-support/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-support/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-support/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-support/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-support:color-support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-support:color_support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_support:color-support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_support:color_support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-support@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"color-support","version":"1.1.3","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"A module which will endeavor to guess your terminal's level of color support.","url":"git+https://github.com/isaacs/color-support.git","private":false}},{"id":"774e316934f12a96","name":"colors","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:colors:colors:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:Marak:colors:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/colors@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"colors","version":"1.1.2","author":"Marak Squires","homepage":"https://github.com/Marak/colors.js","description":"get colors in your node.js console","url":"http://github.com/Marak/colors.js.git","private":false}},{"id":"ba9f99e8572f2682","name":"colors","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:colors:colors:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:Marak:colors:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/colors@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"colors","version":"1.4.0","author":"Marak Squires, DABH (https://github.com/DABH)","homepage":"https://github.com/Marak/colors.js","description":"get colors in your node.js console","url":"http://github.com/Marak/colors.js.git","private":false}},{"id":"84bcfa432cfdd0d0","name":"colorspace","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/colorspace/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colorspace/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/colorspace/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colorspace/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:colorspace:colorspace:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:3rd-Eden:colorspace:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/colorspace@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"colorspace","version":"1.1.4","author":"Arnout Kazemier","homepage":"https://github.com/3rd-Eden/colorspace","description":"Generate HEX colors for a given namespace.","url":"https://github.com/3rd-Eden/colorspace","private":false}},{"id":"23da7748c749bc68","name":"commander","version":"2.20.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:commander:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:tj:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/commander@2.20.3","metadataType":"javascript-npm-package","metadata":{"name":"commander","version":"2.20.3","author":"TJ Holowaychuk ","homepage":"","description":"the complete solution for node.js command-line programs","url":"https://github.com/tj/commander.js.git","private":false}},{"id":"3facda85b5f59f2a","name":"commander","version":"2.20.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:commander:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:tj:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/commander@2.20.3","metadataType":"javascript-npm-package","metadata":{"name":"commander","version":"2.20.3","author":"TJ Holowaychuk ","homepage":"","description":"the complete solution for node.js command-line programs","url":"https://github.com/tj/commander.js.git","private":false}},{"id":"ebc8491ac18b63ae","name":"component-emitter","version":"1.3.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-emitter/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-emitter/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:component-emitter:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component-emitter:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_emitter:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_emitter:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sindresorhus:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sindresorhus:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/component-emitter@1.3.1","metadataType":"javascript-npm-package","metadata":{"name":"component-emitter","version":"1.3.1","author":"","homepage":"","description":"Event emitter","url":"https://github.com/sindresorhus/component-emitter.git","private":false}},{"id":"e91a1227114ad372","name":"component-type","version":"1.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/component-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-type/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/component-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-type/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:component-type:component-type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component-type:component_type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_type:component-type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_type:component_type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component-type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component_type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/component-type@1.2.1","metadataType":"javascript-npm-package","metadata":{"name":"component-type","version":"1.2.1","author":"","homepage":"","description":"Cross-browser type assertions (less broken typeof)","url":"https://github.com/component/type.git","private":false}},{"id":"798bc97add5e6f68","name":"compress-commons","version":"1.2.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/compress-commons/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compress-commons/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/compress-commons/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compress-commons/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:compress-commons:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress-commons:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress_commons:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress_commons:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/compress-commons@1.2.2","metadataType":"javascript-npm-package","metadata":{"name":"compress-commons","version":"1.2.2","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/node-compress-commons","description":"a library that defines a common interface for working with archive formats within node","url":"https://github.com/archiverjs/node-compress-commons.git","private":false}},{"id":"d33659b98b525c44","name":"compressible","version":"2.0.18","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/compressible/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compressible/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/compressible/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compressible/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:compressible:compressible:2.0.18:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/compressible@2.0.18","metadataType":"javascript-npm-package","metadata":{"name":"compressible","version":"2.0.18","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com), Jeremiah Senkpiel (https://searchbeam.jit.su)","homepage":"","description":"Compressible Content-Type / mime checking","url":"jshttp/compressible","private":false}},{"id":"828f0284d303f177","name":"compression","version":"1.8.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/compression/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compression/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/compression/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compression/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:compression:compression:1.8.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/compression@1.8.1","metadataType":"javascript-npm-package","metadata":{"name":"compression","version":"1.8.1","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com)","homepage":"","description":"Node.js compression middleware","url":"expressjs/compression","private":false}},{"id":"e899cd35e0ecfcf6","name":"concat-map","version":"0.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/concat-map/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-map/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/concat-map/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-map/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:concat-map:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat-map:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_map:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_map:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:substack:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:substack:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/concat-map@0.0.1","metadataType":"javascript-npm-package","metadata":{"name":"concat-map","version":"0.0.1","author":"James Halliday (http://substack.net)","homepage":"","description":"concatenative mapdashery","url":"git://github.com/substack/node-concat-map.git","private":false}},{"id":"3cf686e52af98b9c","name":"concat-stream","version":"1.6.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/concat-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-stream/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/concat-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-stream/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:concat-stream:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat-stream:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_stream:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_stream:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:maxogden:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:maxogden:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/concat-stream@1.6.2","metadataType":"javascript-npm-package","metadata":{"name":"concat-stream","version":"1.6.2","author":"Max Ogden ","homepage":"","description":"writable stream that concatenates strings or binary data and calls a callback with the result","url":"http://github.com/maxogden/concat-stream.git","private":false}},{"id":"f5d30e88e089520d","name":"config","version":"3.3.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/config/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/config/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:node-config:config:3.3.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:config:config:3.3.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/config@3.3.12","metadataType":"javascript-npm-package","metadata":{"name":"config","version":"3.3.12","author":"Loren West ","homepage":"http://github.com/node-config/node-config.git","description":"Configuration control for production node deployments","url":"http://github.com/node-config/node-config.git","private":false}},{"id":"62af6322c8da5d46","name":"console-control-strings","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/console-control-strings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/console-control-strings/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/console-control-strings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/console-control-strings/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:console-control-strings:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console-control-strings:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control_strings:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control_strings:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console-control:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console-control:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/console-control-strings@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"console-control-strings","version":"1.1.0","author":"Rebecca Turner (http://re-becca.org/)","homepage":"","description":"A library of cross-platform tested terminal/console command strings for doing things like color and cursor positioning. This is a subset of both ansi and vt100. All control codes included work on both Windows & Unix-like OSes, except where noted.","url":"https://github.com/iarna/console-control-strings","private":false}},{"id":"64ecabe801d13657","name":"constantinople","version":"4.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/constantinople/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/constantinople/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/constantinople/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/constantinople/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ForbesLindesay:constantinople:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:constantinople:constantinople:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/constantinople@4.0.1","metadataType":"javascript-npm-package","metadata":{"name":"constantinople","version":"4.0.1","author":"ForbesLindesay","homepage":"","description":"Determine whether a JavaScript expression evaluates to a constant","url":"https://github.com/ForbesLindesay/constantinople.git","private":false}},{"id":"6d99ffbaf9a3dbf2","name":"content-disposition","version":"0.5.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/content-disposition/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-disposition/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/content-disposition/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-disposition/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:content-disposition:content-disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content-disposition:content_disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_disposition:content-disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_disposition:content_disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content-disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content_disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/content-disposition@0.5.4","metadataType":"javascript-npm-package","metadata":{"name":"content-disposition","version":"0.5.4","author":"Douglas Christopher Wilson ","homepage":"","description":"Create and parse Content-Disposition header","url":"jshttp/content-disposition","private":false}},{"id":"1e680466175b93f0","name":"content-type","version":"1.0.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/content-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-type/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/content-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-type/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:content-type:content-type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content-type:content_type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_type:content-type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_type:content_type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content-type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content_type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/content-type@1.0.5","metadataType":"javascript-npm-package","metadata":{"name":"content-type","version":"1.0.5","author":"Douglas Christopher Wilson ","homepage":"","description":"Create and parse HTTP Content-Type header","url":"jshttp/content-type","private":false}},{"id":"299182936c2fe78a","name":"cookie","version":"0.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie:cookie:0.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie@0.4.2","metadataType":"javascript-npm-package","metadata":{"name":"cookie","version":"0.4.2","author":"Roman Shtylman , Douglas Christopher Wilson ","homepage":"","description":"HTTP server cookie parsing and serialization","url":"jshttp/cookie","private":false}},{"id":"5f1423a9340f2ecc","name":"cookie","version":"0.7.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/express/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/express/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie:cookie:0.7.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie@0.7.1","metadataType":"javascript-npm-package","metadata":{"name":"cookie","version":"0.7.1","author":"Roman Shtylman , Douglas Christopher Wilson ","homepage":"","description":"HTTP server cookie parsing and serialization","url":"jshttp/cookie","private":false}},{"id":"f30613fbb68ad643","name":"cookie","version":"0.7.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie:cookie:0.7.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie@0.7.2","metadataType":"javascript-npm-package","metadata":{"name":"cookie","version":"0.7.2","author":"Roman Shtylman , Douglas Christopher Wilson ","homepage":"","description":"HTTP server cookie parsing and serialization","url":"jshttp/cookie","private":false}},{"id":"52b0adc8ff09f017","name":"cookie-parser","version":"1.4.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cookie-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cookie-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie-parser:cookie-parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie-parser:cookie_parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie_parser:cookie-parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie_parser:cookie_parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie:cookie-parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie:cookie_parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie-parser@1.4.7","metadataType":"javascript-npm-package","metadata":{"name":"cookie-parser","version":"1.4.7","author":"TJ Holowaychuk (http://tjholowaychuk.com), Douglas Christopher Wilson ","homepage":"","description":"Parse HTTP request cookies","url":"expressjs/cookie-parser","private":false}},{"id":"f7961879936cc1c0","name":"cookie-signature","version":"1.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cookie-signature/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-signature/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cookie-signature/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-signature/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie-signature_project:cookie-signature:1.0.6:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/cookie-signature@1.0.6","metadataType":"javascript-npm-package","metadata":{"name":"cookie-signature","version":"1.0.6","author":"TJ Holowaychuk ","homepage":"","description":"Sign and unsign cookies","url":"https://github.com/visionmedia/node-cookie-signature.git","private":false}},{"id":"84bc1ef1a454e04d","name":"copy-descriptor","version":"0.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/copy-descriptor/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/copy-descriptor/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/copy-descriptor/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/copy-descriptor/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:copy-descriptor:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy-descriptor:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy_descriptor:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy_descriptor:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/copy-descriptor@0.1.1","metadataType":"javascript-npm-package","metadata":{"name":"copy-descriptor","version":"0.1.1","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/copy-descriptor","description":"Copy a descriptor from object A to object B","url":"jonschlinkert/copy-descriptor","private":false}},{"id":"36ced86f8d381680","name":"core-util-is","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/core-util-is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/core-util-is/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/core-util-is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/core-util-is/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:core-util-is:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core-util-is:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util_is:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util_is:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core-util:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core-util:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/core-util-is@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"core-util-is","version":"1.0.2","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"The `util.is*` functions introduced in Node v0.12.","url":"git://github.com/isaacs/core-util-is","private":false}},{"id":"9f4d3a70130c3163","name":"cors","version":"2.8.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cors:cors:2.8.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cors@2.8.5","metadataType":"javascript-npm-package","metadata":{"name":"cors","version":"2.8.5","author":"Troy Goode (https://github.com/troygoode/)","homepage":"","description":"Node.js CORS middleware","url":"expressjs/cors","private":false}},{"id":"5e060917a7b152aa","name":"crc","version":"3.8.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:alexgorbatchev:crc:3.8.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc:crc:3.8.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crc@3.8.0","metadataType":"javascript-npm-package","metadata":{"name":"crc","version":"3.8.0","author":"Alex Gorbatchev (https://github.com/alexgorbatchev)","homepage":"https://github.com/alexgorbatchev/node-crc","description":"Module for calculating Cyclic Redundancy Check (CRC) for Node.js and the Browser.","url":"git://github.com/alexgorbatchev/node-crc.git","private":false}},{"id":"65ce75ba55690187","name":"crc-32","version":"1.2.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crc-32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc-32/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"Apache-2.0","spdxExpression":"Apache-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crc-32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc-32/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:SheetJS:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:SheetJS:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc-32:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc-32:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc_32:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc_32:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crc-32@1.2.2","metadataType":"javascript-npm-package","metadata":{"name":"crc-32","version":"1.2.2","author":"sheetjs","homepage":"https://sheetjs.com/","description":"Pure-JS CRC-32","url":"git://github.com/SheetJS/js-crc32.git","private":false}},{"id":"828196a2c6a9e027","name":"crc32-stream","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crc32-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc32-stream/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crc32-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc32-stream/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:crc32-stream:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32-stream:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32_stream:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32_stream:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crc32-stream@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"crc32-stream","version":"2.0.0","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/node-crc32-stream","description":"a streaming CRC32 checksumer","url":"https://github.com/archiverjs/node-crc32-stream.git","private":false}},{"id":"fbc0fafe2877b078","name":"create-require","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/create-require/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/create-require/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/create-require/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/create-require/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:create-require:create-require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create-require:create_require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create_require:create-require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create_require:create_require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create:create-require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create:create_require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/create-require@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"create-require","version":"1.1.1","author":"Maël Nison , Paul Soporan , Pooya Parsa ","homepage":"","description":"Polyfill for Node.js module.createRequire (<= v12.2.0)","url":"nuxt-contrib/create-require","private":false}},{"id":"28238b546a501760","name":"cross-fetch","version":"4.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cross-fetch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cross-fetch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cross-fetch_project:cross-fetch:4.1.0:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/cross-fetch@4.1.0","metadataType":"javascript-npm-package","metadata":{"name":"cross-fetch","version":"4.1.0","author":"Leonardo Quixada ","homepage":"https://github.com/lquixada/cross-fetch","description":"Universal WHATWG Fetch API for Node, Browsers and React Native","url":"https://github.com/lquixada/cross-fetch.git","private":false}},{"id":"50b42809242de976","name":"cross-fetch-polyfill","version":"0.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cross-fetch-polyfill:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-fetch-polyfill:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch_polyfill:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch_polyfill:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-fetch:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-fetch:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cross-fetch-polyfill@0.0.0","metadataType":"javascript-npm-package","metadata":{"name":"cross-fetch-polyfill","version":"0.0.0","author":"","homepage":"","description":"","url":"","private":false}},{"id":"1b99c2dc3022043f","name":"cross-spawn","version":"7.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cross-spawn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-spawn/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cross-spawn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-spawn/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cross-spawn:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-spawn:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_spawn:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_spawn:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:moxystudio:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:moxystudio:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cross-spawn@7.0.6","metadataType":"javascript-npm-package","metadata":{"name":"cross-spawn","version":"7.0.6","author":"André Cruz ","homepage":"https://github.com/moxystudio/node-cross-spawn","description":"Cross platform child_process#spawn and child_process#spawnSync","url":"git@github.com:moxystudio/node-cross-spawn.git","private":false}},{"id":"c00a8b8b043aae72","name":"crypto-js","version":"3.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crypto-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crypto-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crypto-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crypto-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:crypto-js:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto-js:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto_js:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto_js:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brix:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brix:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crypto-js@3.3.0","metadataType":"javascript-npm-package","metadata":{"name":"crypto-js","version":"3.3.0","author":"Evan Vosberg (http://github.com/evanvosberg)","homepage":"http://github.com/brix/crypto-js","description":"JavaScript library of crypto standards.","url":"http://github.com/brix/crypto-js.git","private":false}},{"id":"a64626d34d414995","name":"dateformat","version":"4.6.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/dateformat/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/dateformat/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/dateformat/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/dateformat/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:dateformat:dateformat:4.6.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:felixge:dateformat:4.6.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/dateformat@4.6.3","metadataType":"javascript-npm-package","metadata":{"name":"dateformat","version":"4.6.3","author":"Steven Levithan, Steven Levithan, Felix Geisendörfer , Christoph Tavan , Jon Schlinkert (https://github.com/jonschlinkert), Felix Geisendörfer ","homepage":"https://github.com/felixge/node-dateformat","description":"A node.js package for Steven Levithan's excellent dateFormat() function.","url":"https://github.com/felixge/node-dateformat.git","private":false}},{"id":"13ce5d31ef865754","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich (http://n8.io), Andrew Rhyne ","homepage":"","description":"small debugging utility","url":"git://github.com/visionmedia/debug.git","private":false}},{"id":"07994462f17337cd","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/compression/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compression/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/compression/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compression/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich (http://n8.io), Andrew Rhyne ","homepage":"","description":"small debugging utility","url":"git://github.com/visionmedia/debug.git","private":false}},{"id":"18b6649e0a78c9a1","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/expand-brackets/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/expand-brackets/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/expand-brackets/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/expand-brackets/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich (http://n8.io), Andrew Rhyne ","homepage":"","description":"small debugging utility","url":"git://github.com/visionmedia/debug.git","private":false}},{"id":"36ba4b44e6e4cfc1","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/express/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/express/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich (http://n8.io), Andrew Rhyne ","homepage":"","description":"small debugging utility","url":"git://github.com/visionmedia/debug.git","private":false}},{"id":"7ef811ee564508d1","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/finalhandler/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/finalhandler/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/finalhandler/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/finalhandler/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich (http://n8.io), Andrew Rhyne ","homepage":"","description":"small debugging utility","url":"git://github.com/visionmedia/debug.git","private":false}},{"id":"1eaad6013e183bbc","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/morgan/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/morgan/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/morgan/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/morgan/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich