diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md
new file mode 100644
index 00000000..2b51ab46
--- /dev/null
+++ b/.github/pull_request_template.md
@@ -0,0 +1,28 @@
+## Goal
+
+
+## Changes
+
+-
+-
+-
+
+## Testing
+
+- [ ] Application runs locally
+- [ ] Commands executed successfully
+- [ ] Documentation reviewed for accuracy
+
+## Artifacts & Screenshots
+
+- Screenshots:
+ -
+ -
+
+---
+
+### Checklist
+- [ ] PR title is clear and descriptive
+- [ ] Documentation updated (if applicable)
+- [ ] No secrets, credentials, or large temporary files committed
+
diff --git a/labs/lab2/baseline/data-asset-diagram.png b/labs/lab2/baseline/data-asset-diagram.png
new file mode 100644
index 00000000..4457d768
Binary files /dev/null and b/labs/lab2/baseline/data-asset-diagram.png differ
diff --git a/labs/lab2/baseline/data-flow-diagram.png b/labs/lab2/baseline/data-flow-diagram.png
new file mode 100644
index 00000000..a8803816
Binary files /dev/null and b/labs/lab2/baseline/data-flow-diagram.png differ
diff --git a/labs/lab2/baseline/report.pdf b/labs/lab2/baseline/report.pdf
new file mode 100644
index 00000000..369376fe
Binary files /dev/null and b/labs/lab2/baseline/report.pdf differ
diff --git a/labs/lab2/baseline/risks.json b/labs/lab2/baseline/risks.json
new file mode 100644
index 00000000..7e917d5d
--- /dev/null
+++ b/labs/lab2/baseline/risks.json
@@ -0,0 +1,410 @@
+[
+ {
+ "category": "missing-hardening",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 3,
+ "exploitation_impact": 1,
+ "title": "Missing Hardening risk at Juice Shop Application",
+ "synthetic_id": "missing-hardening@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "missing-hardening",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 3,
+ "exploitation_impact": 1,
+ "title": "Missing Hardening risk at Persistent Storage",
+ "synthetic_id": "missing-hardening@persistent-storage",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "persistent-storage",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": [
+ "persistent-storage"
+ ]
+ },
+ {
+ "category": "missing-build-infrastructure",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 2,
+ "title": "Missing Build Infrastructure in the threat model (referencing asset Juice Shop Application as an example)",
+ "synthetic_id": "missing-build-infrastructure@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": []
+ },
+ {
+ "category": "server-side-request-forgery",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 3,
+ "exploitation_impact": 1,
+ "title": "Server-Side Request Forgery (SSRF) risk at Juice Shop Application server-side web-requesting the target Webhook Endpoint via To Challenge WebHook",
+ "synthetic_id": "server-side-request-forgery@juice-shop@webhook-endpoint@juice-shop>to-challenge-webhook",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "juice-shop>to-challenge-webhook",
+ "data_breach_probability": 2,
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "server-side-request-forgery",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 3,
+ "exploitation_impact": 1,
+ "title": "Server-Side Request Forgery (SSRF) risk at Reverse Proxy server-side web-requesting the target Juice Shop Application via To App",
+ "synthetic_id": "server-side-request-forgery@reverse-proxy@juice-shop@reverse-proxy>to-app",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "reverse-proxy",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "reverse-proxy>to-app",
+ "data_breach_probability": 2,
+ "data_breach_technical_assets": [
+ "reverse-proxy"
+ ]
+ },
+ {
+ "category": "unnecessary-data-transfer",
+ "risk_status": "unchecked",
+ "severity": 1,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 1,
+ "title": "Unnecessary Data Transfer of Tokens & Sessions data at User Browser from/to Juice Shop Application",
+ "synthetic_id": "unnecessary-data-transfer@tokens-sessions@user-browser@juice-shop",
+ "most_relevant_data_asset": "tokens-sessions",
+ "most_relevant_technical_asset": "user-browser",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": [
+ "user-browser"
+ ]
+ },
+ {
+ "category": "unnecessary-data-transfer",
+ "risk_status": "unchecked",
+ "severity": 1,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 1,
+ "title": "Unnecessary Data Transfer of Tokens & Sessions data at User Browser from/to Reverse Proxy",
+ "synthetic_id": "unnecessary-data-transfer@tokens-sessions@user-browser@reverse-proxy",
+ "most_relevant_data_asset": "tokens-sessions",
+ "most_relevant_technical_asset": "user-browser",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": [
+ "user-browser"
+ ]
+ },
+ {
+ "category": "unnecessary-technical-asset",
+ "risk_status": "unchecked",
+ "severity": 1,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 1,
+ "title": "Unnecessary Technical Asset named Persistent Storage",
+ "synthetic_id": "unnecessary-technical-asset@persistent-storage",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "persistent-storage",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": [
+ "persistent-storage"
+ ]
+ },
+ {
+ "category": "unnecessary-technical-asset",
+ "risk_status": "unchecked",
+ "severity": 1,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 1,
+ "title": "Unnecessary Technical Asset named User Browser",
+ "synthetic_id": "unnecessary-technical-asset@user-browser",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "user-browser",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": [
+ "user-browser"
+ ]
+ },
+ {
+ "category": "cross-site-scripting",
+ "risk_status": "unchecked",
+ "severity": 4,
+ "exploitation_likelihood": 3,
+ "exploitation_impact": 2,
+ "title": "Cross-Site Scripting (XSS) risk at Juice Shop Application",
+ "synthetic_id": "cross-site-scripting@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": 2,
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "cross-site-request-forgery",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 4,
+ "exploitation_impact": 1,
+ "title": "Cross-Site Request Forgery (CSRF) risk at Juice Shop Application via Direct to App (no proxy) from User Browser",
+ "synthetic_id": "cross-site-request-forgery@juice-shop@user-browser>direct-to-app-no-proxy",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "user-browser>direct-to-app-no-proxy",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "cross-site-request-forgery",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 4,
+ "exploitation_impact": 1,
+ "title": "Cross-Site Request Forgery (CSRF) risk at Juice Shop Application via To App from Reverse Proxy",
+ "synthetic_id": "cross-site-request-forgery@juice-shop@reverse-proxy>to-app",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "reverse-proxy>to-app",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "missing-waf",
+ "risk_status": "unchecked",
+ "severity": 1,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 1,
+ "title": "Missing Web Application Firewall (WAF) risk at Juice Shop Application",
+ "synthetic_id": "missing-waf@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "unencrypted-communication",
+ "risk_status": "unchecked",
+ "severity": 4,
+ "exploitation_likelihood": 3,
+ "exploitation_impact": 3,
+ "title": "Unencrypted Communication named Direct to App (no proxy) between User Browser and Juice Shop Application transferring authentication data (like credentials, token, session-id, etc.)",
+ "synthetic_id": "unencrypted-communication@user-browser>direct-to-app-no-proxy@user-browser@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "user-browser",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "user-browser>direct-to-app-no-proxy",
+ "data_breach_probability": 2,
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "unencrypted-communication",
+ "risk_status": "unchecked",
+ "severity": 4,
+ "exploitation_likelihood": 3,
+ "exploitation_impact": 2,
+ "title": "Unencrypted Communication named To App between Reverse Proxy and Juice Shop Application",
+ "synthetic_id": "unencrypted-communication@reverse-proxy>to-app@reverse-proxy@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "reverse-proxy",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "reverse-proxy>to-app",
+ "data_breach_probability": 2,
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "missing-authentication",
+ "risk_status": "unchecked",
+ "severity": 4,
+ "exploitation_likelihood": 3,
+ "exploitation_impact": 2,
+ "title": "Missing Authentication covering communication link To App from Reverse Proxy to Juice Shop Application",
+ "synthetic_id": "missing-authentication@reverse-proxy>to-app@reverse-proxy@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "reverse-proxy>to-app",
+ "data_breach_probability": 2,
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "missing-authentication-second-factor",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 2,
+ "title": "Missing Two-Factor Authentication covering communication link Direct to App (no proxy) from User Browser to Juice Shop Application",
+ "synthetic_id": "missing-authentication-second-factor@user-browser>direct-to-app-no-proxy@user-browser@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "user-browser>direct-to-app-no-proxy",
+ "data_breach_probability": 2,
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "missing-authentication-second-factor",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 2,
+ "title": "Missing Two-Factor Authentication covering communication link To App from User Browser forwarded via Reverse Proxy to Juice Shop Application",
+ "synthetic_id": "missing-authentication-second-factor@reverse-proxy>to-app@reverse-proxy@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "reverse-proxy>to-app",
+ "data_breach_probability": 2,
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "container-baseimage-backdooring",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 2,
+ "title": "Container Base Image Backdooring risk at Juice Shop Application",
+ "synthetic_id": "container-baseimage-backdooring@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "probable",
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "unencrypted-asset",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 2,
+ "title": "Unencrypted Technical Asset named Juice Shop Application",
+ "synthetic_id": "unencrypted-asset@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": [
+ "juice-shop"
+ ]
+ },
+ {
+ "category": "unencrypted-asset",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 2,
+ "title": "Unencrypted Technical Asset named Persistent Storage",
+ "synthetic_id": "unencrypted-asset@persistent-storage",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "persistent-storage",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": [
+ "persistent-storage"
+ ]
+ },
+ {
+ "category": "missing-vault",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 2,
+ "title": "Missing Vault (Secret Storage) in the threat model (referencing asset Juice Shop Application as an example)",
+ "synthetic_id": "missing-vault@juice-shop",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "juice-shop",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": []
+ },
+ {
+ "category": "missing-identity-store",
+ "risk_status": "unchecked",
+ "severity": 2,
+ "exploitation_likelihood": 1,
+ "exploitation_impact": 2,
+ "title": "Missing Identity Store in the threat model (referencing asset Reverse Proxy as an example)",
+ "synthetic_id": "missing-identity-store@reverse-proxy",
+ "most_relevant_data_asset": "",
+ "most_relevant_technical_asset": "reverse-proxy",
+ "most_relevant_trust_boundary": "",
+ "most_relevant_shared_runtime": "",
+ "most_relevant_communication_link": "",
+ "data_breach_probability": "improbable",
+ "data_breach_technical_assets": []
+ }
+]
diff --git a/labs/lab2/baseline/stats.json b/labs/lab2/baseline/stats.json
new file mode 100644
index 00000000..88cd78be
--- /dev/null
+++ b/labs/lab2/baseline/stats.json
@@ -0,0 +1 @@
+{"risks":{"critical":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"elevated":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":4},"high":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"low":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":5},"medium":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":14}}}
\ No newline at end of file
diff --git a/labs/lab2/baseline/technical-assets.json b/labs/lab2/baseline/technical-assets.json
new file mode 100644
index 00000000..45457f1e
--- /dev/null
+++ b/labs/lab2/baseline/technical-assets.json
@@ -0,0 +1 @@
+{"juice-shop":{"Id":"juice-shop","Title":"Juice Shop Application","Description":"OWASP Juice Shop server (Node.js/Express, v19.0.0).","Usage":0,"Type":1,"Size":2,"Technology":6,"Machine":2,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":true,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"In-scope web application (contains all business logic and vulnerabilities by design).","Tags":["app","nodejs"],"DataAssetsProcessed":["user-accounts","orders","product-catalog","tokens-sessions"],"DataAssetsStored":["logs"],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"juice-shop\u003eto-challenge-webhook","SourceId":"juice-shop","TargetId":"webhook-endpoint","Title":"To Challenge WebHook","Description":"Optional outbound callback (HTTP POST) to external WebHook when a challenge is solved.","Protocol":2,"Tags":["egress"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["orders"],"DataAssetsReceived":null,"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":70.02881844380403},"persistent-storage":{"Id":"persistent-storage","Title":"Persistent Storage","Description":"Host-mounted volume for database, file uploads, and logs.","Usage":1,"Type":2,"Size":3,"Technology":10,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Local disk storage for the container – not directly exposed, but if compromised it contains sensitive data (database and logs).","Tags":["storage","volume"],"DataAssetsProcessed":[],"DataAssetsStored":["logs","user-accounts","orders","product-catalog"],"DataFormatsAccepted":[3],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":100},"reverse-proxy":{"Id":"reverse-proxy","Title":"Reverse Proxy","Description":"Optional reverse proxy (e.g., Nginx) for TLS termination and adding security headers.","Usage":0,"Type":1,"Size":2,"Technology":20,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":1,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Not exposed to internet directly; improves security of inbound traffic.","Tags":["optional","proxy"],"DataAssetsProcessed":["product-catalog","tokens-sessions"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"reverse-proxy\u003eto-app","SourceId":"reverse-proxy","TargetId":"juice-shop","Title":"To App","Description":"Proxy forwarding to app (HTTP on 3000 internally).","Protocol":1,"Tags":[],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":9.623538157950035},"user-browser":{"Id":"user-browser","Title":"User Browser","Description":"End-user web browser (client).","Usage":0,"Type":0,"Size":0,"Technology":2,"Machine":1,"Internet":true,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":true,"Encryption":0,"JustificationOutOfScope":"","Owner":"External User","Confidentiality":0,"Integrity":1,"Availability":1,"JustificationCiaRating":"Client controlled by end user (potentially an attacker).","Tags":["actor","user"],"DataAssetsProcessed":[],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"user-browser\u003eto-reverse-proxy-preferred","SourceId":"user-browser","TargetId":"reverse-proxy","Title":"To Reverse Proxy (preferred)","Description":"User browser to reverse proxy (HTTPS on 443).","Protocol":2,"Tags":["primary"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true},{"Id":"user-browser\u003edirect-to-app-no-proxy","SourceId":"user-browser","TargetId":"juice-shop","Title":"Direct to App (no proxy)","Description":"Direct browser access to app (HTTP on 3000).","Protocol":1,"Tags":["direct"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":25.859639506459924},"webhook-endpoint":{"Id":"webhook-endpoint","Title":"Webhook Endpoint","Description":"External WebHook service (3rd-party, if configured for integrations).","Usage":0,"Type":0,"Size":0,"Technology":14,"Machine":1,"Internet":true,"MultiTenant":true,"Redundant":true,"CustomDevelopedParts":false,"OutOfScope":true,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"Third-party service to receive notifications (not under our control).","Owner":"Third-Party","Confidentiality":1,"Integrity":1,"Availability":1,"JustificationCiaRating":"External service that receives data (like order or challenge info). Treated as a trusted integration point but could be abused if misconfigured.","Tags":["saas","webhook"],"DataAssetsProcessed":["orders"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":1}}
\ No newline at end of file
diff --git a/labs/lab2/secure/data-asset-diagram.png b/labs/lab2/secure/data-asset-diagram.png
new file mode 100644
index 00000000..aacf4016
Binary files /dev/null and b/labs/lab2/secure/data-asset-diagram.png differ
diff --git a/labs/lab2/secure/data-flow-diagram.png b/labs/lab2/secure/data-flow-diagram.png
new file mode 100644
index 00000000..5ead09e2
Binary files /dev/null and b/labs/lab2/secure/data-flow-diagram.png differ
diff --git a/labs/lab2/secure/report.pdf b/labs/lab2/secure/report.pdf
new file mode 100644
index 00000000..66ddc3f2
Binary files /dev/null and b/labs/lab2/secure/report.pdf differ
diff --git a/labs/lab2/secure/risks.json b/labs/lab2/secure/risks.json
new file mode 100644
index 00000000..0988f32e
--- /dev/null
+++ b/labs/lab2/secure/risks.json
@@ -0,0 +1 @@
+[{"category":"missing-authentication","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Authentication\u003c/b\u003e covering communication link \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eReverse Proxy\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"unnecessary-data-transfer","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Transfer\u003c/b\u003e of \u003cb\u003eTokens \u0026 Sessions\u003c/b\u003e data at \u003cb\u003eUser Browser\u003c/b\u003e from/to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unnecessary-data-transfer@tokens-sessions@user-browser@juice-shop","most_relevant_data_asset":"tokens-sessions","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"unnecessary-data-transfer","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Transfer\u003c/b\u003e of \u003cb\u003eTokens \u0026 Sessions\u003c/b\u003e data at \u003cb\u003eUser Browser\u003c/b\u003e from/to \u003cb\u003eReverse Proxy\u003c/b\u003e","synthetic_id":"unnecessary-data-transfer@tokens-sessions@user-browser@reverse-proxy","most_relevant_data_asset":"tokens-sessions","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"missing-waf","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eMissing Web Application Firewall (WAF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-waf@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-identity-store","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Identity Store\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eReverse Proxy\u003c/b\u003e as an example)","synthetic_id":"missing-identity-store@reverse-proxy","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"missing-authentication-second-factor","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Two-Factor Authentication\u003c/b\u003e covering communication link \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication-second-factor@user-browser\u003edirect-to-app-no-proxy@user-browser@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"missing-authentication-second-factor","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Two-Factor Authentication\u003c/b\u003e covering communication link \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e forwarded via \u003cb\u003eReverse Proxy\u003c/b\u003e to \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-authentication-second-factor@reverse-proxy\u003eto-app@reverse-proxy@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"container-baseimage-backdooring","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eContainer Base Image Backdooring\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"container-baseimage-backdooring@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"probable","data_breach_technical_assets":["juice-shop"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003eUser Browser\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@user-browser","most_relevant_data_asset":"","most_relevant_technical_asset":"user-browser","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["user-browser"]},{"category":"cross-site-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"very-likely","exploitation_impact":"low","title":"\u003cb\u003eCross-Site Request Forgery (CSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eDirect to App (no proxy)\u003c/b\u003e from \u003cb\u003eUser Browser\u003c/b\u003e","synthetic_id":"cross-site-request-forgery@juice-shop@user-browser\u003edirect-to-app-no-proxy","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"user-browser\u003edirect-to-app-no-proxy","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"cross-site-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"very-likely","exploitation_impact":"low","title":"\u003cb\u003eCross-Site Request Forgery (CSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eTo App\u003c/b\u003e from \u003cb\u003eReverse Proxy\u003c/b\u003e","synthetic_id":"cross-site-request-forgery@juice-shop@reverse-proxy\u003eto-app","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-build-infrastructure","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Build Infrastructure\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eJuice Shop Application\u003c/b\u003e as an example)","synthetic_id":"missing-build-infrastructure@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"missing-vault","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Vault (Secret Storage)\u003c/b\u003e in the threat model (referencing asset \u003cb\u003eJuice Shop Application\u003c/b\u003e as an example)","synthetic_id":"missing-vault@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":[]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"unencrypted-asset@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"cross-site-scripting","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"cross-site-scripting@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"server-side-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eServer-Side Request Forgery (SSRF)\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e server-side web-requesting the target \u003cb\u003eWebhook Endpoint\u003c/b\u003e via \u003cb\u003eTo Challenge WebHook\u003c/b\u003e","synthetic_id":"server-side-request-forgery@juice-shop@webhook-endpoint@juice-shop\u003eto-challenge-webhook","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"juice-shop\u003eto-challenge-webhook","data_breach_probability":"possible","data_breach_technical_assets":["juice-shop"]},{"category":"server-side-request-forgery","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eServer-Side Request Forgery (SSRF)\u003c/b\u003e risk at \u003cb\u003eReverse Proxy\u003c/b\u003e server-side web-requesting the target \u003cb\u003eJuice Shop Application\u003c/b\u003e via \u003cb\u003eTo App\u003c/b\u003e","synthetic_id":"server-side-request-forgery@reverse-proxy@juice-shop@reverse-proxy\u003eto-app","most_relevant_data_asset":"","most_relevant_technical_asset":"reverse-proxy","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"reverse-proxy\u003eto-app","data_breach_probability":"possible","data_breach_technical_assets":["reverse-proxy"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003eJuice Shop Application\u003c/b\u003e","synthetic_id":"missing-hardening@juice-shop","most_relevant_data_asset":"","most_relevant_technical_asset":"juice-shop","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["juice-shop"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003ePersistent Storage\u003c/b\u003e","synthetic_id":"missing-hardening@persistent-storage","most_relevant_data_asset":"","most_relevant_technical_asset":"persistent-storage","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["persistent-storage"]}]
\ No newline at end of file
diff --git a/labs/lab2/secure/stats.json b/labs/lab2/secure/stats.json
new file mode 100644
index 00000000..c19a18a6
--- /dev/null
+++ b/labs/lab2/secure/stats.json
@@ -0,0 +1 @@
+{"risks":{"critical":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"elevated":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":2},"high":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":0},"low":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":5},"medium":{"accepted":0,"false-positive":0,"in-discussion":0,"in-progress":0,"mitigated":0,"unchecked":13}}}
\ No newline at end of file
diff --git a/labs/lab2/secure/technical-assets.json b/labs/lab2/secure/technical-assets.json
new file mode 100644
index 00000000..a082acb4
--- /dev/null
+++ b/labs/lab2/secure/technical-assets.json
@@ -0,0 +1 @@
+{"juice-shop":{"Id":"juice-shop","Title":"Juice Shop Application","Description":"OWASP Juice Shop server (Node.js/Express, v19.0.0).","Usage":0,"Type":1,"Size":2,"Technology":6,"Machine":2,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":true,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"In-scope web application (contains all business logic and vulnerabilities by design).","Tags":["app","nodejs"],"DataAssetsProcessed":["user-accounts","orders","product-catalog","tokens-sessions"],"DataAssetsStored":["logs"],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"juice-shop\u003eto-challenge-webhook","SourceId":"juice-shop","TargetId":"webhook-endpoint","Title":"To Challenge WebHook","Description":"Optional outbound callback (HTTP POST) to external WebHook when a challenge is solved.","Protocol":2,"Tags":["egress"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["orders"],"DataAssetsReceived":null,"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":70.02881844380403},"persistent-storage":{"Id":"persistent-storage","Title":"Persistent Storage","Description":"Host-mounted volume for database, file uploads, and logs.","Usage":1,"Type":2,"Size":3,"Technology":10,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":1,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Local disk storage for the container – not directly exposed, but if compromised it contains sensitive data (database and logs).","Tags":["storage","volume"],"DataAssetsProcessed":[],"DataAssetsStored":["logs","user-accounts","orders","product-catalog"],"DataFormatsAccepted":[3],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":100},"reverse-proxy":{"Id":"reverse-proxy","Title":"Reverse Proxy","Description":"Optional reverse proxy (e.g., Nginx) for TLS termination and adding security headers.","Usage":0,"Type":1,"Size":2,"Technology":20,"Machine":1,"Internet":false,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":false,"Encryption":1,"JustificationOutOfScope":"","Owner":"Lab Owner","Confidentiality":1,"Integrity":2,"Availability":2,"JustificationCiaRating":"Not exposed to internet directly; improves security of inbound traffic.","Tags":["optional","proxy"],"DataAssetsProcessed":["product-catalog","tokens-sessions"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"reverse-proxy\u003eto-app","SourceId":"reverse-proxy","TargetId":"juice-shop","Title":"To App","Description":"Proxy forwarding to app (HTTP on 3000 internally).","Protocol":2,"Tags":[],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":0,"Authorization":0,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":9.623538157950035},"user-browser":{"Id":"user-browser","Title":"User Browser","Description":"End-user web browser (client).","Usage":0,"Type":0,"Size":0,"Technology":2,"Machine":1,"Internet":true,"MultiTenant":false,"Redundant":false,"CustomDevelopedParts":false,"OutOfScope":false,"UsedAsClientByHuman":true,"Encryption":0,"JustificationOutOfScope":"","Owner":"External User","Confidentiality":0,"Integrity":1,"Availability":1,"JustificationCiaRating":"Client controlled by end user (potentially an attacker).","Tags":["actor","user"],"DataAssetsProcessed":[],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[{"Id":"user-browser\u003eto-reverse-proxy-preferred","SourceId":"user-browser","TargetId":"reverse-proxy","Title":"To Reverse Proxy (preferred)","Description":"User browser to reverse proxy (HTTPS on 443).","Protocol":2,"Tags":["primary"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true},{"Id":"user-browser\u003edirect-to-app-no-proxy","SourceId":"user-browser","TargetId":"juice-shop","Title":"Direct to App (no proxy)","Description":"Direct browser access to app (HTTP on 3000).","Protocol":2,"Tags":["direct"],"VPN":false,"IpFiltered":false,"Readonly":false,"Authentication":2,"Authorization":2,"Usage":0,"DataAssetsSent":["tokens-sessions"],"DataAssetsReceived":["product-catalog"],"DiagramTweakWeight":1,"DiagramTweakConstraint":true}],"DiagramTweakOrder":0,"RAA":25.859639506459924},"webhook-endpoint":{"Id":"webhook-endpoint","Title":"Webhook Endpoint","Description":"External WebHook service (3rd-party, if configured for integrations).","Usage":0,"Type":0,"Size":0,"Technology":14,"Machine":1,"Internet":true,"MultiTenant":true,"Redundant":true,"CustomDevelopedParts":false,"OutOfScope":true,"UsedAsClientByHuman":false,"Encryption":0,"JustificationOutOfScope":"Third-party service to receive notifications (not under our control).","Owner":"Third-Party","Confidentiality":1,"Integrity":1,"Availability":1,"JustificationCiaRating":"External service that receives data (like order or challenge info). Treated as a trusted integration point but could be abused if misconfigured.","Tags":["saas","webhook"],"DataAssetsProcessed":["orders"],"DataAssetsStored":[],"DataFormatsAccepted":[0],"CommunicationLinks":[],"DiagramTweakOrder":0,"RAA":1}}
\ No newline at end of file
diff --git a/labs/lab2/threagile-model.secure.yaml b/labs/lab2/threagile-model.secure.yaml
new file mode 100644
index 00000000..4bfdf2fd
--- /dev/null
+++ b/labs/lab2/threagile-model.secure.yaml
@@ -0,0 +1,429 @@
+threagile_version: 1.0.0
+
+title: OWASP Juice Shop — Local Lab Threat Model
+date: 2025-02-16
+
+author:
+ name: Daniel Gevorgyan
+ homepage: https://example.edu
+
+management_summary_comment: >
+ Threat model for a local OWASP Juice Shop setup. Users access the app
+ either directly via HTTP on port 3000 or through an optional reverse proxy that
+ terminates TLS and adds security headers. The app runs in a container
+ and writes data to a host-mounted volume (for database, uploads, logs).
+ Optional outbound notifications (e.g., a challenge-solution WebHook) can be configured for integrations.
+
+business_criticality: important # archive, operational, important, critical, mission-critical
+
+business_overview:
+ description: >
+ Training environment for DevSecOps. This model covers a deliberately vulnerable
+ web application (OWASP Juice Shop) running locally in a Docker container. The focus is on a minimal architecture, STRIDE threat analysis, and actionable mitigations for the identified risks.
+
+ images:
+ # - dfd.png: Data Flow Diagram (if exported from the tool)
+
+technical_overview:
+ description: >
+ A user’s web browser connects to the Juice Shop application (Node.js/Express server) either directly on **localhost:3000** (HTTP) or via a **reverse proxy** on ports 80/443 (with HTTPS). The Juice Shop server may issue outbound requests to external services (e.g., a configured **WebHook** for solved challenge notifications). All application data (the SQLite database, file uploads, logs) is stored on the host’s filesystem via a mounted volume. Key trust boundaries include the **Internet** (user & external services) → **Host** (local machine/VM) → **Container Network** (isolated app container).
+ images: []
+
+questions:
+ Do you expose port 3000 beyond localhost?: ""
+ Do you use a reverse proxy with TLS and security headers?: ""
+ Are any outbound integrations (webhooks) configured?: ""
+ Is any sensitive data stored in logs or files?: ""
+
+abuse_cases:
+ Credential Stuffing / Brute Force: >
+ Attackers attempt repeated login attempts to guess credentials or exhaust system resources.
+ Stored XSS via Product Reviews: >
+ Malicious scripts are inserted into product reviews, getting stored and executed in other users’ browsers.
+ SSRF via Outbound Requests: >
+ Server-side requests (e.g. profile image URL fetch or WebHook callback) are abused to access internal network resources.
+
+security_requirements:
+ TLS in transit: Enforce HTTPS for user traffic via a TLS-terminating reverse proxy with strong ciphers and certificate management.
+ AuthZ on sensitive routes: Implement strict server-side authorization checks (role/permission) on admin or sensitive functionalities.
+ Rate limiting & lockouts: Apply rate limiting and account lockout policies to mitigate brute-force and automated attacks on authentication and expensive operations.
+ Secure headers: Add security headers (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, etc.) at the proxy or app to mitigate client-side attacks.
+ Secrets management: Protect secret keys and credentials (JWT signing keys, OAuth client secrets) – keep them out of code repos and avoid logging them.
+
+tags_available:
+ # Relevant technologies and environment tags
+ - docker
+ - nodejs
+ # Data and asset tags
+ - pii
+ - auth
+ - tokens
+ - logs
+ - public
+ - actor
+ - user
+ - optional
+ - proxy
+ - app
+ - storage
+ - volume
+ - saas
+ - webhook
+ # Communication tags
+ - primary
+ - direct
+ - egress
+
+# =========================
+# DATA ASSETS
+# =========================
+data_assets:
+
+ User Accounts:
+ id: user-accounts
+ description: "User profile data, credential hashes, emails."
+ usage: business
+ tags: ["pii", "auth"]
+ origin: user-supplied
+ owner: Lab Owner
+ quantity: many
+ confidentiality: confidential
+ integrity: critical
+ availability: important
+ justification_cia_rating: >
+ Contains personal identifiers and authentication data. High confidentiality is required to protect user privacy, and integrity is critical to prevent account takeovers.
+
+ Orders:
+ id: orders
+ description: "Order history, addresses, and payment metadata (no raw card numbers)."
+ usage: business
+ tags: ["pii"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: confidential
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ Contains users’ personal data and business transaction records. Integrity and confidentiality are important to prevent fraud or privacy breaches.
+
+ Product Catalog:
+ id: product-catalog
+ description: "Product information (names, descriptions, prices) available to all users."
+ usage: business
+ tags: ["public"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: public
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ Product data is intended to be public, but its integrity is important (to avoid defacement or price manipulation that could mislead users).
+
+ Tokens & Sessions:
+ id: tokens-sessions
+ description: "Session identifiers, JWTs for authenticated sessions, CSRF tokens."
+ usage: business
+ tags: ["auth", "tokens"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: confidential
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ If session tokens are compromised, attackers can hijack user sessions. They must be kept confidential and intact; availability is less critical (tokens can be reissued).
+
+ Logs:
+ id: logs
+ description: "Application and access logs (may inadvertently contain PII or secrets)."
+ usage: devops
+ tags: ["logs"]
+ origin: application
+ owner: Lab Owner
+ quantity: many
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: >
+ Logs are for internal use (troubleshooting, monitoring). They should not be exposed publicly, and sensitive data should be sanitized to protect confidentiality.
+
+# =========================
+# TECHNICAL ASSETS
+# =========================
+technical_assets:
+
+ User Browser:
+ id: user-browser
+ description: "End-user web browser (client)."
+ type: external-entity
+ usage: business
+ used_as_client_by_human: true
+ out_of_scope: false
+ justification_out_of_scope:
+ size: system
+ technology: browser
+ tags: ["actor", "user"]
+ internet: true
+ machine: virtual
+ encryption: none
+ owner: External User
+ confidentiality: public
+ integrity: operational
+ availability: operational
+ justification_cia_rating: "Client controlled by end user (potentially an attacker)."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: false
+ data_assets_processed: []
+ data_assets_stored: []
+ data_formats_accepted:
+ - json
+ communication_links:
+ To Reverse Proxy (preferred):
+ target: reverse-proxy
+ description: "User browser to reverse proxy (HTTPS on 443)."
+ protocol: https
+ authentication: session-id
+ authorization: enduser-identity-propagation
+ tags: ["primary"]
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - tokens-sessions
+ data_assets_received:
+ - product-catalog
+ Direct to App (no proxy):
+ target: juice-shop
+ description: "Direct browser access to app (HTTP on 3000)."
+ protocol: https
+ authentication: session-id
+ authorization: enduser-identity-propagation
+ tags: ["direct"]
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - tokens-sessions
+ data_assets_received:
+ - product-catalog
+
+ Reverse Proxy:
+ id: reverse-proxy
+ description: "Optional reverse proxy (e.g., Nginx) for TLS termination and adding security headers."
+ type: process
+ usage: business
+ used_as_client_by_human: false
+ out_of_scope: false
+ justification_out_of_scope:
+ size: application
+ technology: reverse-proxy
+ tags: ["optional", "proxy"]
+ internet: false
+ machine: virtual
+ encryption: transparent
+ owner: Lab Owner
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: "Not exposed to internet directly; improves security of inbound traffic."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: false
+ data_assets_processed:
+ - product-catalog
+ - tokens-sessions
+ data_assets_stored: []
+ data_formats_accepted:
+ - json
+ communication_links:
+ To App:
+ target: juice-shop
+ description: "Proxy forwarding to app (HTTP on 3000 internally)."
+ protocol: https
+ authentication: none
+ authorization: none
+ tags: []
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - tokens-sessions
+ data_assets_received:
+ - product-catalog
+
+ Juice Shop Application:
+ id: juice-shop
+ description: "OWASP Juice Shop server (Node.js/Express, v19.0.0)."
+ type: process
+ usage: business
+ used_as_client_by_human: false
+ out_of_scope: false
+ justification_out_of_scope:
+ size: application
+ technology: web-server
+ tags: ["app", "nodejs"]
+ internet: false
+ machine: container
+ encryption: none
+ owner: Lab Owner
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: "In-scope web application (contains all business logic and vulnerabilities by design)."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: true
+ data_assets_processed:
+ - user-accounts
+ - orders
+ - product-catalog
+ - tokens-sessions
+ data_assets_stored:
+ - logs
+ data_formats_accepted:
+ - json
+ communication_links:
+ To Challenge WebHook:
+ target: webhook-endpoint
+ description: "Optional outbound callback (HTTP POST) to external WebHook when a challenge is solved."
+ protocol: https
+ authentication: none
+ authorization: none
+ tags: ["egress"]
+ vpn: false
+ ip_filtered: false
+ readonly: false
+ usage: business
+ data_assets_sent:
+ - orders
+
+ Persistent Storage:
+ id: persistent-storage
+ description: "Host-mounted volume for database, file uploads, and logs."
+ type: datastore
+ usage: devops
+ used_as_client_by_human: false
+ out_of_scope: false
+ justification_out_of_scope:
+ size: component
+ technology: file-server
+ tags: ["storage", "volume"]
+ internet: false
+ machine: virtual
+ encryption: transparent
+ owner: Lab Owner
+ confidentiality: internal
+ integrity: important
+ availability: important
+ justification_cia_rating: "Local disk storage for the container – not directly exposed, but if compromised it contains sensitive data (database and logs)."
+ multi_tenant: false
+ redundant: false
+ custom_developed_parts: false
+ data_assets_processed: []
+ data_assets_stored:
+ - logs
+ - user-accounts
+ - orders
+ - product-catalog
+ data_formats_accepted:
+ - file
+ communication_links: {}
+
+ Webhook Endpoint:
+ id: webhook-endpoint
+ description: "External WebHook service (3rd-party, if configured for integrations)."
+ type: external-entity
+ usage: business
+ used_as_client_by_human: false
+ out_of_scope: true
+ justification_out_of_scope: "Third-party service to receive notifications (not under our control)."
+ size: system
+ technology: web-service-rest
+ tags: ["saas", "webhook"]
+ internet: true
+ machine: virtual
+ encryption: none
+ owner: Third-Party
+ confidentiality: internal
+ integrity: operational
+ availability: operational
+ justification_cia_rating: "External service that receives data (like order or challenge info). Treated as a trusted integration point but could be abused if misconfigured."
+ multi_tenant: true
+ redundant: true
+ custom_developed_parts: false
+ data_assets_processed:
+ - orders
+ data_assets_stored: []
+ data_formats_accepted:
+ - json
+ communication_links: {}
+
+# =========================
+# TRUST BOUNDARIES
+# =========================
+trust_boundaries:
+
+ Internet:
+ id: internet
+ description: "Untrusted public network (Internet)."
+ type: network-dedicated-hoster
+ tags: []
+ technical_assets_inside:
+ - user-browser
+ - webhook-endpoint
+ trust_boundaries_nested:
+ - host
+
+ Host:
+ id: host
+ description: "Local host machine / VM running the Docker environment."
+ type: network-dedicated-hoster
+ tags: []
+ technical_assets_inside:
+ - reverse-proxy
+ - persistent-storage
+ trust_boundaries_nested:
+ - container-network
+
+ Container Network:
+ id: container-network
+ description: "Docker container network (isolated internal network for containers)."
+ type: network-dedicated-hoster
+ tags: []
+ technical_assets_inside:
+ - juice-shop
+ trust_boundaries_nested: []
+
+# =========================
+# SHARED RUNTIMES
+# =========================
+shared_runtimes:
+
+ Docker Host:
+ id: docker-host
+ description: "Docker Engine and default bridge network on the host."
+ tags: ["docker"]
+ technical_assets_running:
+ - juice-shop
+ # If the reverse proxy is containerized, include it:
+ # - reverse-proxy
+
+# =========================
+# INDIVIDUAL RISK CATEGORIES (optional)
+# =========================
+individual_risk_categories: {}
+
+# =========================
+# RISK TRACKING (optional)
+# =========================
+risk_tracking: {}
+
+# (Optional diagram layout tweaks can be added here)
+#diagram_tweak_edge_layout: spline
+#diagram_tweak_layout_left_to_right: true
diff --git a/labs/lab2/threagile-model.yaml b/labs/lab2/threagile-model.yaml
index 85c01a79..a6092993 100644
--- a/labs/lab2/threagile-model.yaml
+++ b/labs/lab2/threagile-model.yaml
@@ -1,10 +1,10 @@
threagile_version: 1.0.0
title: OWASP Juice Shop — Local Lab Threat Model
-date: 2025-09-18
+date: 2025-02-16
author:
- name: Student Name
+ name: Daniel Gevorgyan
homepage: https://example.edu
management_summary_comment: >
diff --git a/labs/lab4/analysis/sbom-analysis.txt b/labs/lab4/analysis/sbom-analysis.txt
new file mode 100644
index 00000000..15724d2b
--- /dev/null
+++ b/labs/lab4/analysis/sbom-analysis.txt
@@ -0,0 +1,80 @@
+=== SBOM Component Analysis ===
+
+Syft Package Counts:
+ 1 binary
+ 10 deb
+ 1128 npm
+
+Trivy Package Counts:
+ 10 bkimminich/juice-shop:v19.0.0 (debian 12.11) - unknown
+ 1125 Node.js - unknown
+
+=== License Analysis ===
+
+Syft Licenses:
+ 1 0BSD
+ 1 ad-hoc
+ 1 Apache2
+ 15 Apache-2.0
+ 5 Artistic
+ 5 BlueOak-1.0.0
+ 1 BSD
+ 12 BSD-2-Clause
+ 1 (BSD-2-Clause OR MIT OR Apache-2.0)
+ 16 BSD-3-Clause
+ 4 GFDL-1.2
+ 5 GPL
+ 1 GPL-1
+ 1 GPL-1+
+ 6 GPL-2
+ 1 GPL-2.0
+ 4 GPL-3
+ 143 ISC
+ 4 LGPL
+ 1 LGPL-2.1
+ 19 LGPL-3.0
+ 890 MIT
+ 2 (MIT OR Apache-2.0)
+ 1 (MIT OR WTFPL)
+ 2 MIT/X11
+ 2 MPL-2.0
+ 1 public-domain
+ 2 sha256:cb992345949ccd6e8394b2cd6c465f7b897c864f845937dbf64e8997f389e164
+ 2 Unlicense
+ 1 WTFPL
+ 1 WTFPL OR ISC
+ 1 (WTFPL OR MIT)
+
+Trivy Licenses (OS Packages):
+ 1 ad-hoc
+ 1 Apache-2.0
+ 2 Artistic-2.0
+ 1 GFDL-1.2-only
+ 1 GPL-1.0-only
+ 1 GPL-1.0-or-later
+ 3 GPL-2.0-only
+ 2 GPL-2.0-or-later
+ 1 GPL-3.0-only
+ 1 LGPL-2.0-or-later
+ 1 LGPL-2.1-only
+ 1 public-domain
+
+Trivy Licenses (Node.js):
+ 1 0BSD
+ 12 Apache-2.0
+ 5 BlueOak-1.0.0
+ 12 BSD-2-Clause
+ 1 (BSD-2-Clause OR MIT OR Apache-2.0)
+ 14 BSD-3-Clause
+ 1 GPL-2.0-only
+ 143 ISC
+ 19 LGPL-3.0-only
+ 878 MIT
+ 2 (MIT OR Apache-2.0)
+ 1 (MIT OR WTFPL)
+ 2 MIT/X11
+ 2 MPL-2.0
+ 2 Unlicense
+ 1 WTFPL
+ 1 WTFPL OR ISC
+ 1 (WTFPL OR MIT)
diff --git a/labs/lab4/analysis/vulnerability-analysis.txt b/labs/lab4/analysis/vulnerability-analysis.txt
new file mode 100644
index 00000000..50fe6b9f
--- /dev/null
+++ b/labs/lab4/analysis/vulnerability-analysis.txt
@@ -0,0 +1,19 @@
+=== Vulnerability Analysis ===
+
+Grype Vulnerabilities by Severity:
+ 11 Critical
+ 88 High
+ 3 Low
+ 32 Medium
+ 12 Negligible
+
+Trivy Vulnerabilities by Severity:
+ 10 CRITICAL
+ 81 HIGH
+ 18 LOW
+ 34 MEDIUM
+
+=== License Analysis Summary ===
+Tool Comparison:
+- Syft found 32 unique license types
+- Trivy found 28 unique license types
diff --git a/labs/lab4/comparison/accuracy-analysis.txt b/labs/lab4/comparison/accuracy-analysis.txt
new file mode 100644
index 00000000..0939c2c8
--- /dev/null
+++ b/labs/lab4/comparison/accuracy-analysis.txt
@@ -0,0 +1,9 @@
+=== Package Detection Comparison ===
+Packages detected by both tools: 1126
+Packages only detected by Syft: 13
+Packages only detected by Trivy: 9
+
+=== Vulnerability Detection Overlap ===
+CVEs found by Grype: 95
+CVEs found by Trivy: 91
+Common CVEs: 26
diff --git a/labs/lab4/comparison/common-packages.txt b/labs/lab4/comparison/common-packages.txt
new file mode 100644
index 00000000..4c466f8a
--- /dev/null
+++ b/labs/lab4/comparison/common-packages.txt
@@ -0,0 +1,1126 @@
+1to2@1.0.0
+abbrev@1.1.1
+abbrev@3.0.1
+abitype@0.7.1
+abort-controller@3.0.0
+accepts@1.3.8
+acorn@7.4.1
+acorn@8.15.0
+acorn-walk@8.3.4
+@adraffy/ens-normalize@1.10.1
+aes-js@4.0.0-beta.5
+agent-base@6.0.2
+agent-base@7.1.4
+agent-base@7.1.4
+agentkeepalive@4.6.0
+aggregate-error@3.1.0
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@3.0.1
+ansi-regex@5.0.1
+ansi-regex@6.2.0
+ansi-regex@6.2.0
+ansi-styles@2.2.1
+ansi-styles@3.2.1
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@6.2.1
+anymatch@3.1.3
+append-field@1.0.0
+aproba@1.2.0
+archiver@1.3.0
+archiver-utils@1.3.0
+archive-type@4.0.0
+are-we-there-yet@1.1.7
+are-we-there-yet@3.0.1
+arg@4.1.3
+argparse@1.0.10
+array-buffer-byte-length@1.0.2
+array-each@1.0.1
+array-flatten@1.1.1
+array-slice@1.1.0
+array-unique@0.3.2
+arr-diff@4.0.0
+arr-flatten@1.1.0
+arr-union@3.1.0
+asap@2.0.6
+assert-never@1.4.0
+assign-symbols@1.0.0
+async@2.6.4
+async@2.6.4
+async@3.2.6
+at-least-node@1.0.0
+atob@2.1.2
+available-typed-arrays@1.0.7
+@babel/helper-string-parser@7.27.1
+@babel/helper-validator-identifier@7.27.1
+@babel/parser@7.28.3
+@babel/types@7.28.2
+babel-walk@3.0.0-canary-5
+balanced-match@1.0.2
+base@0.11.2
+base64-arraybuffer@0.1.4
+base64id@2.0.0
+base64-js@0.0.8
+base64-js@1.5.1
+base64url@0.0.6
+base-files@12.4+deb12u11
+basic-auth@2.0.1
+batch@0.6.1
+beep-boop@1.2.3
+big-integer@1.6.52
+binary@0.3.0
+binary-extensions@2.3.0
+bindings@1.5.0
+bintrees@1.0.2
+bl@1.2.3
+bl@4.1.0
+bluebird@3.4.7
+bluebird@3.7.2
+body-parser@1.20.3
+bower-config@1.4.3
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@2.0.2
+braces@2.3.2
+braces@3.0.3
+braces@3.0.3
+braces@3.0.3
+brotli@1.3.3
+buffer@5.7.1
+buffer@6.0.3
+buffer-alloc@1.2.0
+buffer-alloc-unsafe@1.1.0
+buffer-crc32@0.2.13
+buffer-fill@1.0.0
+buffer-from@1.1.2
+buffer-indexof-polyfill@1.0.2
+buffers@0.1.1
+busboy@1.6.0
+byline@4.2.2
+bytes@3.1.2
+cacache@15.3.0
+cacache@19.0.1
+cacheable-request@2.1.4
+cache-base@1.0.1
+call-bind@1.0.8
+call-bind-apply-helpers@1.0.2
+call-bound@1.0.4
+camelcase@5.3.1
+chainsaw@0.1.0
+chalk@1.1.3
+chalk@2.4.2
+chalk@4.1.2
+character-parser@2.2.0
+check-dependencies@1.1.1
+check-internet-connected@2.0.6
+check-types@6.0.0
+chokidar@3.5.1
+chownr@1.1.4
+chownr@1.1.4
+chownr@2.0.0
+chownr@3.0.0
+clarinet@0.12.6
+class-utils@0.3.6
+clean-stack@2.2.0
+cliui@6.0.0
+clone@2.1.2
+clone-response@1.0.2
+code-point-at@1.1.0
+collection-visit@1.0.0
+color@3.2.1
+color-convert@1.9.3
+color-convert@2.0.1
+color-convert@2.0.1
+color-convert@2.0.1
+color-name@1.1.3
+color-name@1.1.4
+color-name@1.1.4
+color-name@1.1.4
+colors@1.1.2
+colors@1.4.0
+@colors/colors@1.6.0
+@colors/colors@1.6.0
+colorspace@1.1.4
+color-string@1.9.1
+color-support@1.1.3
+commander@2.20.3
+commander@2.20.3
+component-emitter@1.3.1
+component-type@1.2.1
+compress-commons@1.2.2
+compressible@2.0.18
+compression@1.8.1
+concat-map@0.0.1
+concat-stream@1.6.2
+config@3.3.12
+console-control-strings@1.1.0
+constantinople@4.0.1
+content-disposition@0.5.4
+content-type@1.0.5
+cookie@0.4.2
+cookie@0.7.1
+cookie@0.7.2
+cookie-parser@1.4.7
+cookie-signature@1.0.6
+copy-descriptor@0.1.1
+core-util-is@1.0.2
+cors@2.8.5
+crc-32@1.2.2
+crc32-stream@2.0.0
+crc@3.8.0
+create-require@1.1.1
+cross-fetch@4.1.0
+cross-fetch-polyfill@0.0.0
+cross-spawn@7.0.6
+crypto-js@3.3.0
+@dabh/diagnostics@2.0.3
+dateformat@4.6.3
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@3.2.7
+debug@4.3.7
+decamelize@1.2.0
+decode-uri-component@0.2.2
+decompress@4.2.1
+decompress-response@3.3.0
+decompress-response@4.2.1
+decompress-response@6.0.0
+decompress-response@6.0.0
+decompress-tar@4.1.1
+decompress-tarbz2@4.1.1
+decompress-targz@4.1.1
+decompress-unzip@4.0.1
+deep-equal@2.2.3
+deep-extend@0.6.0
+define-data-property@1.1.4
+define-properties@1.2.1
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@1.0.0
+define-property@1.0.0
+define-property@1.0.0
+define-property@2.0.2
+delegates@1.0.0
+depd@1.1.2
+depd@2.0.0
+destroy@1.2.0
+detect-file@1.0.0
+detect-libc@1.0.3
+detect-libc@2.0.4
+detect-libc@2.0.4
+dfa@1.2.0
+diff@4.0.2
+doctypes@1.1.0
+domelementtype@1.3.1
+domhandler@2.1.0
+domutils@1.1.6
+dottie@2.0.6
+double-ended-queue@0.9.7
+download@8.0.0
+dunder-proto@1.0.1
+duplexer2@0.1.4
+duplexer3@0.1.5
+dynamic-dedupe@0.3.0
+eastasianwidth@0.2.0
+ee-first@1.1.1
+eivindfjeldstad-dot@0.0.1
+emoji-regex@8.0.0
+emoji-regex@9.2.2
+emoji-regex@9.2.2
+enabled@2.0.0
+encodeurl@1.0.2
+encodeurl@2.0.0
+encoding@0.1.13
+end-of-stream@1.4.5
+engine.io@4.1.2
+engine.io-parser@4.0.3
+env-paths@2.2.1
+err-code@1.1.2
+err-code@2.0.3
+errorhandler@1.5.1
+escape-html@1.0.3
+escape-string-regexp@1.0.5
+escodegen@2.1.0
+es-define-property@1.0.1
+es-errors@1.3.0
+es-get-iterator@1.1.3
+es-object-atoms@1.1.1
+esprima@1.0.4
+esprima@4.0.1
+estraverse@5.3.0
+esutils@2.0.3
+etag@1.8.1
+ethereum-cryptography@2.2.1
+@ethereumjs/rlp@4.0.1
+@ethereumjs/rlp@5.0.2
+ethers@6.15.0
+eventemitter2@0.4.14
+eventemitter3@1.1.1
+eventemitter3@5.0.1
+events@3.3.0
+event-target-shim@5.0.1
+exit@0.1.2
+expand-brackets@2.1.4
+expand-template@2.0.3
+expand-tilde@2.0.2
+exponential-backoff@3.1.2
+express@4.21.2
+express-ipfilter@1.3.2
+express-jwt@0.1.3
+express-rate-limit@7.5.1
+express-robots-txt@0.4.1
+express-security.txt@2.0.0
+extend@3.0.2
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@3.0.2
+extglob@2.0.4
+ext-list@2.2.2
+ext-name@5.0.0
+fast.js@0.1.1
+fdir@6.5.0
+fd-slicer@1.1.0
+feature-policy@0.5.0
+fecha@4.2.3
+filehound@1.17.6
+file-js@0.3.0
+filename-reserved-regex@2.0.0
+filenamify@3.0.0
+filesniffer@1.0.3
+file-stream-rotator@1.0.0
+file-type@11.1.0
+file-type@16.5.4
+file-type@3.9.0
+file-type@4.4.0
+file-type@5.2.0
+file-type@5.2.0
+file-type@6.2.0
+file-uri-to-path@1.0.0
+fill-range@4.0.0
+fill-range@7.1.1
+fill-range@7.1.1
+fill-range@7.1.1
+finale-rest@1.2.2
+finalhandler@1.3.1
+find-up@4.1.0
+findup-sync@2.0.0
+findup-sync@4.0.0
+findup-sync@5.0.0
+fined@1.2.0
+flagged-respawn@1.0.1
+fn.name@1.1.0
+fontkit@1.9.0
+for-each@0.3.5
+foreachasync@3.0.0
+foreground-child@3.3.1
+for-in@1.0.2
+formatio@1.1.1
+for-own@1.0.0
+forwarded@0.2.0
+fragment-cache@0.2.1
+fresh@0.5.2
+from2@2.3.0
+frontend@19.0.0
+fs-constants@1.0.0
+fs-extra@9.1.0
+fs-minipass@1.2.7
+fs-minipass@2.1.0
+fs-minipass@3.0.3
+fs.realpath@1.0.0
+fstream@1.0.12
+function-bind@1.1.2
+functions-have-names@1.2.3
+fuzzball@1.4.0
+@gar/promisify@1.1.3
+gauge@2.7.4
+gauge@4.0.4
+geojson-utils@1.1.0
+get-caller-file@2.0.5
+get-intrinsic@1.3.0
+getobject@1.0.2
+get-proto@1.0.1
+get-stream@2.3.1
+get-stream@3.0.0
+get-stream@3.0.0
+get-stream@4.1.0
+get-value@2.0.6
+github-from-package@0.0.0
+glob@10.4.5
+glob@7.1.7
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+global-modules@1.0.0
+global-prefix@1.0.2
+glob-parent@5.1.2
+gopd@1.2.0
+got@8.3.2
+graceful-fs@4.2.11
+grunt@1.6.1
+grunt-cli@1.4.3
+grunt-contrib-compress@1.6.0
+grunt-known-options@2.0.0
+grunt-legacy-log@3.0.0
+grunt-legacy-log-utils@2.1.0
+grunt-legacy-util@2.0.1
+grunt-replace-json@0.1.0
+handlebars@4.7.7
+has-ansi@2.0.0
+has-bigints@1.1.0
+has-flag@3.0.0
+has-flag@4.0.0
+hashids@2.3.0
+hasown@2.0.2
+has-property-descriptors@1.0.2
+has-symbols@1.1.0
+has-symbol-support-x@1.4.2
+has-tostringtag@1.0.2
+has-to-string-tag-x@1.4.1
+has-unicode@2.0.1
+has-value@0.3.1
+has-value@1.0.0
+has-values@0.1.4
+has-values@1.0.0
+hbs@4.2.0
+he@0.4.1
+heap@0.2.7
+helmet@4.6.0
+hoister@0.0.2
+homedir-polyfill@1.0.3
+hooker@0.2.3
+html-entities@1.4.0
+htmlparser2@3.3.0
+http-cache-semantics@3.8.1
+http-cache-semantics@4.2.0
+http-cache-semantics@4.2.0
+http-errors@1.6.3
+http-errors@2.0.0
+http-proxy-agent@4.0.1
+http-proxy-agent@5.0.0
+http-proxy-agent@7.0.2
+https-proxy-agent@5.0.1
+https-proxy-agent@7.0.6
+humanize-ms@1.2.1
+i18n@0.11.1
+iconv-lite@0.4.24
+iconv-lite@0.6.3
+iconv-lite@0.6.3
+ieee754@1.2.1
+ignore-walk@3.0.4
+iltorb@2.4.5
+imurmurhash@0.1.4
+indent-string@4.0.0
+infer-owner@1.0.4
+inflection@1.13.4
+inflight@1.0.6
+inherits@2.0.3
+inherits@2.0.4
+ini@1.3.8
+ini@1.3.8
+internal-slot@1.1.0
+interpret@1.1.0
+into-stream@3.1.0
+invariant@2.2.4
+ip@2.0.1
+ip6@0.2.11
+ip-address@10.0.1
+ipaddr.js@1.9.1
+@isaacs/cliui@8.0.2
+@isaacs/fs-minipass@4.0.1
+is-absolute@1.0.0
+is-accessor-descriptor@1.0.1
+is-arguments@1.2.0
+isarray@0.0.1
+isarray@1.0.0
+isarray@1.0.0
+isarray@2.0.5
+is-array-buffer@3.0.5
+is-arrayish@0.3.2
+is-bigint@1.1.0
+is-binary-path@2.1.0
+is-boolean-object@1.2.2
+is-buffer@1.1.6
+is-callable@1.2.7
+is-core-module@2.16.1
+is-data-descriptor@1.0.1
+is-date-object@1.1.0
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@1.0.3
+isexe@2.0.0
+isexe@3.1.1
+is-expression@4.0.0
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@1.0.1
+is-extglob@2.1.1
+is-fullwidth-code-point@1.0.0
+is-fullwidth-code-point@2.0.0
+is-fullwidth-code-point@3.0.0
+is-generator-function@1.1.0
+is-glob@3.1.0
+is-glob@4.0.3
+is-lambda@1.0.1
+is-map@2.0.3
+is-natural-number@4.0.1
+is-number@3.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number-like@1.0.8
+is-number-object@1.1.1
+is-object@1.0.2
+isobject@2.1.0
+isobject@3.0.1
+isomorphic-ws@5.0.0
+is-plain-obj@1.1.0
+is-plain-object@2.0.4
+is-promise@2.2.2
+is-regex@1.2.1
+is-relative@1.0.0
+is-retry-allowed@1.2.0
+is-set@2.0.3
+is-shared-array-buffer@1.0.4
+is-stream@1.1.0
+is-stream@2.0.1
+is-string@1.1.1
+is-symbol@1.1.1
+is-typed-array@1.1.15
+is-unc-path@1.0.0
+isurl@1.0.0
+is-weakmap@2.0.2
+is-weakset@2.0.4
+is-windows@1.0.2
+jackspeak@3.4.3
+json5@2.2.3
+json-buffer@3.0.0
+jsonfile@6.2.0
+jsonwebtoken@0.1.0
+jsonwebtoken@0.4.0
+jssha@3.3.1
+js-stringify@1.0.2
+js-tokens@4.0.0
+jstransformer@1.0.0
+js-yaml@3.14.1
+juice-shop@19.0.0
+juice-shop@19.0.0
+juicy-chat-bot@0.9.0
+jwa@0.0.1
+jws@0.2.6
+keyv@3.0.0
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@4.0.0
+kind-of@6.0.3
+kuler@2.0.0
+lazystream@1.0.1
+libxmljs2@0.37.0
+liftup@3.0.1
+linebreak@1.1.0
+listenercount@1.0.1
+ljharb-monorepo-symlink-test@0.0.0
+locate-path@5.0.0
+lodash@2.4.2
+lodash@4.17.21
+lodash.camelcase@4.3.0
+lodash.isfinite@3.3.2
+lodash.set@4.3.2
+logform@2.7.0
+lolex@1.3.2
+loose-envify@1.4.0
+lowercase-keys@1.0.0
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@6.0.0
+make-dir@1.3.0
+make-dir@2.1.0
+make-error@1.3.6
+make-fetch-happen@14.0.3
+make-fetch-happen@9.1.0
+make-iterator@1.0.1
+make-plural@4.3.0
+make-plural@6.2.2
+map-cache@0.2.2
+map-visit@1.0.0
+marsdb@0.6.11
+math-interval-parser@2.0.1
+math-intrinsics@1.1.0
+median@0.0.2
+media-typer@0.3.0
+media-types@10.0.0
+merge-descriptors@1.0.3
+messageformat@2.3.0
+messageformat-formatters@2.0.1
+messageformat-parser@4.1.3
+methods@1.1.2
+micromatch@3.1.10
+micromatch@4.0.8
+micromatch@4.0.8
+mime@1.6.0
+mime-db@1.52.0
+mime-types@2.1.35
+mimic-response@1.0.1
+mimic-response@2.1.0
+mimic-response@3.1.0
+mimic-response@3.1.0
+minami@1.1.1
+minami@1.1.1
+minami@1.1.1
+minimatch@3.0.5
+minimatch@3.0.8
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@5.1.6
+minimatch@9.0.5
+minimist@0.2.4
+minimist@1.2.8
+minipass@2.9.0
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@5.0.0
+minipass@7.1.2
+minipass-collect@1.0.2
+minipass-collect@2.0.1
+minipass-fetch@1.4.1
+minipass-fetch@4.0.1
+minipass-flush@1.0.5
+minipass-pipeline@1.2.4
+minipass-sized@1.0.3
+minizlib@1.3.3
+minizlib@2.1.2
+minizlib@3.0.2
+mixin-deep@1.3.2
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@1.0.4
+mkdirp@3.0.1
+mkdirp@3.0.1
+mkdirp-classic@0.5.3
+moment@2.0.0
+moment@2.30.1
+moment-timezone@0.5.48
+morgan@1.10.1
+mout@1.2.4
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.1.3
+multer@1.4.5-lts.2
+mustache@4.2.0
+mylib@0.0.0
+@my-scope/package-a@0.0.0
+@my-scope/package-b@0.0.0
+nan@2.22.2
+nanomatch@1.2.13
+napi-build-utils@1.0.2
+napi-build-utils@2.0.0
+napi-build-utils@2.0.0
+needle@2.9.1
+negotiator@0.6.3
+negotiator@0.6.4
+negotiator@1.0.0
+neo-async@2.6.2
+netbase@6.4
+@nlpjs/core@4.26.1
+@nlpjs/core-loader@4.26.1
+@nlpjs/evaluator@4.26.1
+@nlpjs/lang-en@4.26.1
+@nlpjs/lang-en-min@4.26.1
+@nlpjs/language@4.25.0
+@nlpjs/language-min@4.25.0
+@nlpjs/ner@4.27.0
+@nlpjs/neural@4.25.0
+@nlpjs/nlg@4.26.1
+@nlpjs/nlp@4.27.0
+@nlpjs/nlu@4.27.0
+@nlpjs/request@4.25.0
+@nlpjs/sentiment@4.26.1
+@nlpjs/similarity@4.26.1
+@nlpjs/slot@4.26.1
+@noble/curves@1.2.0
+@noble/curves@1.4.2
+@noble/curves@1.4.2
+@noble/hashes@1.3.2
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+node-abi@2.30.1
+node-abi@3.77.0
+node-abi@3.77.0
+node-addon-api@7.1.1
+node-fetch@2.7.0
+node-gyp@11.4.2
+node-gyp@8.4.1
+node-pre-gyp@0.15.0
+noop-logger@0.1.1
+nopt@3.0.6
+nopt@4.0.3
+nopt@4.0.3
+nopt@5.0.0
+nopt@8.1.0
+normalize-path@2.1.1
+normalize-path@3.0.0
+normalize-path@3.0.0
+normalize-url@2.0.1
+notevil@1.3.3
+npm-bundled@1.1.2
+@npmcli/agent@3.0.0
+@npmcli/fs@1.1.1
+@npmcli/fs@4.0.0
+@npmcli/move-file@1.1.2
+npmlog@4.1.2
+npmlog@6.0.2
+npm-normalize-package-bin@1.0.1
+npm-packlist@1.4.8
+number-is-nan@1.0.1
+nw-pre-gyp-module-test@0.0.1
+object-assign@4.1.1
+object.assign@4.1.7
+object-copy@0.1.0
+object.defaults@1.1.0
+object-inspect@1.13.4
+object-is@1.1.6
+object-keys@1.1.1
+object.map@1.0.1
+object.pick@1.3.0
+object-visit@1.0.1
+once@1.4.0
+one-time@1.0.0
+on-finished@2.3.0
+on-finished@2.4.1
+on-headers@1.1.0
+opentype.js@0.7.3
+osenv@0.1.5
+os-homedir@1.0.2
+os-tmpdir@1.0.2
+otplib@12.0.1
+@otplib/core@12.0.1
+@otplib/plugin-crypto@12.0.1
+@otplib/plugin-thirty-two@12.0.1
+@otplib/preset-default@12.0.1
+@otplib/preset-v11@12.0.1
+package-json-from-dist@1.0.1
+pako@0.2.9
+parse-filepath@1.0.2
+parse-passwd@1.0.0
+parseurl@1.3.3
+pascalcase@0.1.1
+path-exists@4.0.0
+path-is-absolute@1.0.1
+path-key@3.1.1
+path-parse@1.0.7
+path-root@0.1.1
+path-root-regex@0.1.2
+path-scurry@1.11.1
+path-to-regexp@0.1.12
+p-cancelable@0.4.1
+pdfkit@0.11.0
+peek-readable@4.1.0
+pend@1.2.0
+p-event@2.3.1
+p-finally@1.0.0
+pg-connection-string@2.9.1
+picomatch@2.3.1
+picomatch@4.0.3
+pify@2.3.0
+pify@2.3.0
+pify@3.0.0
+pify@3.0.0
+pify@4.0.1
+pinkie@2.0.4
+pinkie-promise@2.0.1
+p-is-promise@1.1.0
+@pkgjs/parseargs@0.11.0
+p-limit@2.3.0
+p-locate@4.1.0
+p-map@4.0.0
+p-map@7.0.3
+png-js@1.0.0
+posix-character-classes@0.1.1
+possible-typed-array-names@1.1.0
+prebuild-install@5.3.6
+prebuild-install@7.1.3
+prebuild-install@7.1.3
+prepend-http@2.0.0
+pretty-bytes@4.0.2
+process@0.11.10
+process-nextick-args@2.0.1
+proc-log@5.0.0
+prom-client@14.2.0
+promise@7.3.1
+promise-inflight@1.0.1
+promise-retry@2.0.1
+proper-lockfile@1.2.0
+proxy-addr@2.0.7
+p-timeout@2.0.1
+p-try@2.2.0
+pug@3.0.3
+pug-attrs@3.0.0
+pug-code-gen@3.0.3
+pug-error@2.1.0
+pug-filters@4.0.0
+pug-lexer@5.0.1
+pug-linker@4.0.0
+pug-load@3.0.0
+pug-parser@6.0.0
+pug-runtime@3.0.1
+pug-strip-comments@2.0.0
+pug-walk@2.0.0
+pump@3.0.3
+qs@6.13.0
+query-string@5.1.1
+range_check@2.0.4
+range-parser@1.2.1
+raw-body@2.5.2
+rc@1.2.8
+readable-stream@1.0.34
+readable-stream@2.3.8
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@4.7.0
+readable-web-to-node-stream@3.0.4
+readdirp@3.5.0
+rechoir@0.7.1
+recursedir-comparisons@0.0.0
+regex-not@1.0.2
+regexp.prototype.flags@1.5.4
+remove-trailing-separator@1.1.0
+repeat-element@1.1.4
+repeat-string@1.6.1
+replace@1.2.2
+require-directory@2.1.1
+require-main-filename@2.0.0
+resolve@1.22.10
+resolve-dir@1.0.1
+resolve-url@0.2.1
+responselike@1.0.2
+restructure@2.0.1
+ret@0.1.15
+retry@0.10.1
+retry@0.12.0
+retry-as-promised@7.1.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@3.0.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.2.1
+safer-buffer@2.1.2
+safe-regex@1.1.0
+safe-regex-test@1.1.0
+safe-stable-stringify@2.5.0
+samsam@1.1.2
+sanitize-filename@1.6.3
+sanitize-html@1.4.2
+sax@1.4.1
+@scarf/scarf@1.4.0
+@scure/base@1.1.9
+@scure/bip32@1.4.0
+@scure/bip39@1.3.0
+seek-bzip@1.0.6
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@7.7.2
+send@0.19.0
+sequelize@6.37.7
+sequelize-pool@7.1.0
+serve-index@1.9.1
+serve-static@1.16.2
+set-blocking@2.0.0
+set-function-length@1.2.2
+set-function-name@2.0.2
+setimmediate@1.0.5
+setprototypeof@1.1.0
+setprototypeof@1.2.0
+set-value@2.0.1
+shebang-command@2.0.0
+shebang-regex@3.0.0
+side-channel@1.1.0
+side-channel-list@1.0.0
+side-channel-map@1.0.1
+side-channel-weakmap@1.0.2
+signal-exit@3.0.7
+signal-exit@4.1.0
+simple-concat@1.0.1
+simple-get@3.1.1
+simple-get@4.0.1
+simple-get@4.0.1
+simple-swizzle@0.2.2
+@sindresorhus/is@0.7.0
+sinon@1.17.7
+smart-buffer@4.2.0
+snapdragon@0.8.2
+snapdragon-node@2.1.1
+snapdragon-util@3.0.1
+socket.io@3.1.2
+socket.io-adapter@2.1.0
+socket.io-parser@4.0.5
+socks@2.8.7
+socks-proxy-agent@6.2.1
+socks-proxy-agent@8.0.5
+sort-keys@1.1.2
+sort-keys@2.0.0
+sort-keys-length@1.0.1
+source-map@0.5.7
+source-map@0.6.1
+source-map-resolve@0.5.3
+source-map-support@0.5.21
+source-map-url@0.4.1
+split-string@3.1.0
+sprintf-js@1.0.3
+sprintf-js@1.1.3
+sqlite3@5.1.7
+ssri@12.0.0
+ssri@8.0.1
+stack-trace@0.0.10
+static-extend@0.1.2
+statuses@1.5.0
+statuses@2.0.1
+stop-iteration-iterator@1.1.0
+stream-buffers@2.2.0
+streamsearch@1.1.0
+strict-uri-encode@1.1.0
+string_decoder@0.10.31
+string_decoder@1.1.1
+string_decoder@1.3.0
+string.fromcodepoint@0.2.1
+string.prototype.codepointat@0.2.1
+string-width@1.0.2
+string-width@2.1.1
+string-width@4.2.3
+string-width@4.2.3
+string-width@5.1.2
+string-width@5.1.2
+strip-ansi@3.0.1
+strip-ansi@3.0.1
+strip-ansi@4.0.0
+strip-ansi@6.0.1
+strip-ansi@6.0.1
+strip-ansi@7.1.0
+strip-ansi@7.1.0
+strip-bom@3.0.0
+strip-dirs@2.1.0
+strip-json-comments@2.0.1
+strip-json-comments@2.0.1
+strip-outer@1.0.1
+strtok3@6.3.0
+supports-color@2.0.0
+supports-color@5.5.0
+supports-color@7.2.0
+supports-preserve-symlinks-flag@1.0.0
+svg-captcha@1.4.0
+swagger-ui-dist@5.28.1
+swagger-ui-express@5.0.1
+@swc/helpers@0.3.17
+tar@4.4.19
+tar@6.2.1
+tar@7.4.3
+tar-fs@2.1.3
+tar-stream@1.6.2
+tar-stream@2.2.0
+tdigest@0.1.2
+text-hex@1.0.0
+thirty-two@1.0.2
+through@2.3.8
+timed-out@4.0.1
+tinyglobby@0.2.14
+tiny-inflate@1.0.3
+to-buffer@1.2.1
+toidentifier@1.0.1
+@tokenizer/token@0.3.0
+token-stream@1.0.0
+token-types@4.2.1
+to-object-path@0.3.0
+@tootallnate/once@1.1.2
+@tootallnate/once@2.0.0
+to-regex@3.0.2
+to-regex-range@2.1.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+tr46@0.0.3
+traverse@0.3.9
+tree-kill@1.2.2
+trim-repeated@1.0.0
+triple-beam@1.4.1
+truncate-utf8-bytes@1.0.2
+tsconfig@7.0.0
+tslib@2.7.0
+ts-node@9.1.1
+ts-node-dev@1.1.8
+tunnel-agent@0.6.0
+typecast@0.0.1
+typedarray@0.0.6
+typed-array-buffer@1.0.3
+type-is@1.6.18
+@types/component-emitter@1.2.14
+@types/cookie@0.4.1
+@types/cors@2.8.19
+typescript@5.3.3
+@types/debug@4.1.12
+@types/ms@2.1.0
+@types/node@20.19.12
+@types/node@22.7.5
+@types/strip-bom@3.0.0
+@types/strip-json-comments@0.0.30
+@types/triple-beam@1.3.5
+@types/validator@13.15.3
+@types/ws@8.5.3
+uglify-js@3.19.3
+unbzip2-stream@1.4.3
+unc-path-regex@0.1.2
+underscore.string@3.3.6
+undici-types@6.19.8
+undici-types@6.21.0
+unicode-properties@1.4.1
+unicode-trie@2.0.0
+union-value@1.0.1
+unique-filename@1.1.1
+unique-filename@4.0.0
+unique-slug@2.0.2
+unique-slug@5.0.0
+unit-compare@1.0.1
+universalify@2.0.1
+unpipe@1.0.0
+unset-value@1.0.0
+untildify@2.1.0
+unzipper@0.9.15
+urix@0.1.0
+url-parse-lax@3.0.0
+url-to-options@1.0.1
+use@3.1.1
+utf8-byte-length@1.0.5
+util@0.12.5
+util-deprecate@1.0.2
+utils-merge@1.0.1
+uuid@8.3.2
+v8flags@3.2.0
+validate@4.5.1
+validator@13.15.15
+vary@1.1.2
+vm2@3.9.17
+void-elements@3.1.0
+walk@2.3.15
+walkdir@0.0.11
+web3@4.16.0
+web3-core@4.7.1
+web3-errors@1.3.1
+web3-eth@4.11.1
+web3-eth-abi@4.4.1
+web3-eth-accounts@4.3.1
+web3-eth-contract@4.7.2
+web3-eth-ens@4.4.0
+web3-eth-iban@4.0.7
+web3-eth-personal@4.1.0
+web3-net@4.1.0
+web3-providers-http@4.2.0
+web3-providers-ipc@4.0.7
+web3-providers-ws@4.0.8
+web3-rpc-methods@1.3.0
+web3-rpc-providers@1.0.0-rc.4
+web3-types@1.10.0
+web3-utils@4.3.3
+web3-validator@2.0.6
+webidl-conversions@3.0.1
+whatwg-url@5.0.0
+which@1.3.1
+which@2.0.2
+which@5.0.0
+which-boxed-primitive@1.1.1
+which-collection@1.0.2
+which-module@2.0.1
+which-pm-runs@1.1.0
+which-typed-array@1.1.19
+wide-align@1.1.3
+wide-align@1.1.5
+winston@3.17.0
+winston-transport@4.9.0
+with@7.0.2
+wkx@0.5.0
+wordwrap@0.0.3
+wordwrap@1.0.0
+wrap-ansi@6.2.0
+wrap-ansi@7.0.0
+wrap-ansi@8.1.0
+wrappy@1.0.2
+ws@7.4.6
+ws@8.17.1
+xtend@4.0.2
+y18n@4.0.3
+yallist@3.1.1
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@5.0.0
+yaml-schema-validator@1.2.3
+yargs@15.4.1
+yargs-parser@18.1.3
+yauzl@2.10.0
+yn@3.1.1
+z85@0.0.2
+zip-stream@1.2.0
+zod@3.25.76
diff --git a/labs/lab4/comparison/grype-cves.txt b/labs/lab4/comparison/grype-cves.txt
new file mode 100644
index 00000000..bafa4efc
--- /dev/null
+++ b/labs/lab4/comparison/grype-cves.txt
@@ -0,0 +1,95 @@
+CVE-2010-4756
+CVE-2018-20796
+CVE-2019-1010022
+CVE-2019-1010023
+CVE-2019-1010024
+CVE-2019-1010025
+CVE-2019-9192
+CVE-2022-27943
+CVE-2025-15281
+CVE-2025-15467
+CVE-2025-27587
+CVE-2025-4802
+CVE-2025-55130
+CVE-2025-55131
+CVE-2025-55132
+CVE-2025-59465
+CVE-2025-59466
+CVE-2025-68160
+CVE-2025-69418
+CVE-2025-69419
+CVE-2025-69420
+CVE-2025-69421
+CVE-2025-8058
+CVE-2025-9230
+CVE-2025-9232
+CVE-2026-0861
+CVE-2026-0915
+CVE-2026-21637
+CVE-2026-22795
+CVE-2026-22796
+GHSA-23c5-xmqv-rm74
+GHSA-25hc-qcg6-38wj
+GHSA-2p57-rm9w-gvfp
+GHSA-34x7-hfp2-rc4v
+GHSA-35jh-r3h4-6jhm
+GHSA-3h5v-q93c-6h6q
+GHSA-3j7m-hmh3-9jmp
+GHSA-3ppc-4f35-3m26
+GHSA-446m-mv8f-q348
+GHSA-44fp-w29j-9vj5
+GHSA-4pg4-qvpc-4q3h
+GHSA-4xc9-xhrj-v574
+GHSA-5j98-mcp5-4vw2
+GHSA-5mrr-rgp6-x4gr
+GHSA-6g6m-m6h5-w9gf
+GHSA-6rw7-vpxm-498p
+GHSA-73rr-hh4g-fpgx
+GHSA-7r86-cg39-jmmj
+GHSA-83g3-92jg-28cx
+GHSA-869p-cjfg-cm3x
+GHSA-87vv-r9j6-g5qv
+GHSA-8cf7-32gw-wr33
+GHSA-8g4m-cjm2-96wq
+GHSA-8hfj-j24r-96c4
+GHSA-8qq5-rm4j-mr97
+GHSA-952p-6rrq-rcjv
+GHSA-9965-vmph-33xx
+GHSA-99p7-6v5w-7xg8
+GHSA-c7hr-j4mj-j2w6
+GHSA-cchq-frgv-rjh5
+GHSA-cgfm-xwp7-2cvr
+GHSA-cqmj-92xf-r6r9
+GHSA-f5x3-32g6-xq36
+GHSA-fjgf-rc76-4x9p
+GHSA-fvqr-27wr-82fm
+GHSA-g5hg-p3ph-g8qg
+GHSA-g644-9gfx-q4q4
+GHSA-gjcw-v447-2w7q
+GHSA-grv7-fg5c-xmjg
+GHSA-hjrf-2m68-5959
+GHSA-jf85-cpcp-j695
+GHSA-mh29-5h37-fv8m
+GHSA-mjxr-4v3x-q3m4
+GHSA-p5gc-c584-jj6v
+GHSA-p6mc-m468-83gw
+GHSA-pfrx-2q88-qq97
+GHSA-pxg6-pf52-xh8x
+GHSA-qhxp-v273-g94h
+GHSA-qwph-4952-7xr6
+GHSA-r5mx-6wc6-7h9w
+GHSA-r6q2-hw4h-h46w
+GHSA-r7qp-cfhv-p84w
+GHSA-rc47-6667-2j5j
+GHSA-rjqq-98f6-6j3r
+GHSA-rm97-x556-q36h
+GHSA-rvg8-pwq2-xj7q
+GHSA-v52c-386h-88mc
+GHSA-vghf-hv5q-vc2g
+GHSA-vj76-c3g6-qr5v
+GHSA-w7fw-mjwx-w883
+GHSA-whpj-8f3w-67p5
+GHSA-xc6g-ggrc-qq4r
+GHSA-xf7r-hgr6-v32p
+GHSA-xwcq-pm8m-c4vf
+GHSA-xxjr-mmjv-4gpg
diff --git a/labs/lab4/comparison/syft-only.txt b/labs/lab4/comparison/syft-only.txt
new file mode 100644
index 00000000..e5761d79
--- /dev/null
+++ b/labs/lab4/comparison/syft-only.txt
@@ -0,0 +1,13 @@
+baz@UNKNOWN
+browser_field@UNKNOWN
+false_main@UNKNOWN
+gcc-12-base@12.2.0-14+deb12u1
+hashids-esm@UNKNOWN
+invalid_main@UNKNOWN
+libc6@2.36-9+deb12u10
+libgcc-s1@12.2.0-14+deb12u1
+libgomp1@12.2.0-14+deb12u1
+libssl3@3.0.17-1~deb12u2
+libstdc++6@12.2.0-14+deb12u1
+node@22.18.0
+tzdata@2025b-0+deb12u1
diff --git a/labs/lab4/comparison/syft-packages.txt b/labs/lab4/comparison/syft-packages.txt
new file mode 100644
index 00000000..7091e4a9
--- /dev/null
+++ b/labs/lab4/comparison/syft-packages.txt
@@ -0,0 +1,1139 @@
+1to2@1.0.0
+abbrev@1.1.1
+abbrev@3.0.1
+abitype@0.7.1
+abort-controller@3.0.0
+accepts@1.3.8
+acorn@7.4.1
+acorn@8.15.0
+acorn-walk@8.3.4
+@adraffy/ens-normalize@1.10.1
+aes-js@4.0.0-beta.5
+agent-base@6.0.2
+agent-base@7.1.4
+agent-base@7.1.4
+agentkeepalive@4.6.0
+aggregate-error@3.1.0
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@3.0.1
+ansi-regex@5.0.1
+ansi-regex@6.2.0
+ansi-regex@6.2.0
+ansi-styles@2.2.1
+ansi-styles@3.2.1
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@6.2.1
+anymatch@3.1.3
+append-field@1.0.0
+aproba@1.2.0
+archiver@1.3.0
+archiver-utils@1.3.0
+archive-type@4.0.0
+are-we-there-yet@1.1.7
+are-we-there-yet@3.0.1
+arg@4.1.3
+argparse@1.0.10
+array-buffer-byte-length@1.0.2
+array-each@1.0.1
+array-flatten@1.1.1
+array-slice@1.1.0
+array-unique@0.3.2
+arr-diff@4.0.0
+arr-flatten@1.1.0
+arr-union@3.1.0
+asap@2.0.6
+assert-never@1.4.0
+assign-symbols@1.0.0
+async@2.6.4
+async@2.6.4
+async@3.2.6
+at-least-node@1.0.0
+atob@2.1.2
+available-typed-arrays@1.0.7
+@babel/helper-string-parser@7.27.1
+@babel/helper-validator-identifier@7.27.1
+@babel/parser@7.28.3
+@babel/types@7.28.2
+babel-walk@3.0.0-canary-5
+balanced-match@1.0.2
+base@0.11.2
+base64-arraybuffer@0.1.4
+base64id@2.0.0
+base64-js@0.0.8
+base64-js@1.5.1
+base64url@0.0.6
+base-files@12.4+deb12u11
+basic-auth@2.0.1
+batch@0.6.1
+baz@UNKNOWN
+beep-boop@1.2.3
+big-integer@1.6.52
+binary@0.3.0
+binary-extensions@2.3.0
+bindings@1.5.0
+bintrees@1.0.2
+bl@1.2.3
+bl@4.1.0
+bluebird@3.4.7
+bluebird@3.7.2
+body-parser@1.20.3
+bower-config@1.4.3
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@2.0.2
+braces@2.3.2
+braces@3.0.3
+braces@3.0.3
+braces@3.0.3
+brotli@1.3.3
+browser_field@UNKNOWN
+buffer@5.7.1
+buffer@6.0.3
+buffer-alloc@1.2.0
+buffer-alloc-unsafe@1.1.0
+buffer-crc32@0.2.13
+buffer-fill@1.0.0
+buffer-from@1.1.2
+buffer-indexof-polyfill@1.0.2
+buffers@0.1.1
+busboy@1.6.0
+byline@4.2.2
+bytes@3.1.2
+cacache@15.3.0
+cacache@19.0.1
+cacheable-request@2.1.4
+cache-base@1.0.1
+call-bind@1.0.8
+call-bind-apply-helpers@1.0.2
+call-bound@1.0.4
+camelcase@5.3.1
+chainsaw@0.1.0
+chalk@1.1.3
+chalk@2.4.2
+chalk@4.1.2
+character-parser@2.2.0
+check-dependencies@1.1.1
+check-internet-connected@2.0.6
+check-types@6.0.0
+chokidar@3.5.1
+chownr@1.1.4
+chownr@1.1.4
+chownr@2.0.0
+chownr@3.0.0
+clarinet@0.12.6
+class-utils@0.3.6
+clean-stack@2.2.0
+cliui@6.0.0
+clone@2.1.2
+clone-response@1.0.2
+code-point-at@1.1.0
+collection-visit@1.0.0
+color@3.2.1
+color-convert@1.9.3
+color-convert@2.0.1
+color-convert@2.0.1
+color-convert@2.0.1
+color-name@1.1.3
+color-name@1.1.4
+color-name@1.1.4
+color-name@1.1.4
+colors@1.1.2
+colors@1.4.0
+@colors/colors@1.6.0
+@colors/colors@1.6.0
+colorspace@1.1.4
+color-string@1.9.1
+color-support@1.1.3
+commander@2.20.3
+commander@2.20.3
+component-emitter@1.3.1
+component-type@1.2.1
+compress-commons@1.2.2
+compressible@2.0.18
+compression@1.8.1
+concat-map@0.0.1
+concat-stream@1.6.2
+config@3.3.12
+console-control-strings@1.1.0
+constantinople@4.0.1
+content-disposition@0.5.4
+content-type@1.0.5
+cookie@0.4.2
+cookie@0.7.1
+cookie@0.7.2
+cookie-parser@1.4.7
+cookie-signature@1.0.6
+copy-descriptor@0.1.1
+core-util-is@1.0.2
+cors@2.8.5
+crc-32@1.2.2
+crc32-stream@2.0.0
+crc@3.8.0
+create-require@1.1.1
+cross-fetch@4.1.0
+cross-fetch-polyfill@0.0.0
+cross-spawn@7.0.6
+crypto-js@3.3.0
+@dabh/diagnostics@2.0.3
+dateformat@4.6.3
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@3.2.7
+debug@4.3.7
+decamelize@1.2.0
+decode-uri-component@0.2.2
+decompress@4.2.1
+decompress-response@3.3.0
+decompress-response@4.2.1
+decompress-response@6.0.0
+decompress-response@6.0.0
+decompress-tar@4.1.1
+decompress-tarbz2@4.1.1
+decompress-targz@4.1.1
+decompress-unzip@4.0.1
+deep-equal@2.2.3
+deep-extend@0.6.0
+define-data-property@1.1.4
+define-properties@1.2.1
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@1.0.0
+define-property@1.0.0
+define-property@1.0.0
+define-property@2.0.2
+delegates@1.0.0
+depd@1.1.2
+depd@2.0.0
+destroy@1.2.0
+detect-file@1.0.0
+detect-libc@1.0.3
+detect-libc@2.0.4
+detect-libc@2.0.4
+dfa@1.2.0
+diff@4.0.2
+doctypes@1.1.0
+domelementtype@1.3.1
+domhandler@2.1.0
+domutils@1.1.6
+dottie@2.0.6
+double-ended-queue@0.9.7
+download@8.0.0
+dunder-proto@1.0.1
+duplexer2@0.1.4
+duplexer3@0.1.5
+dynamic-dedupe@0.3.0
+eastasianwidth@0.2.0
+ee-first@1.1.1
+eivindfjeldstad-dot@0.0.1
+emoji-regex@8.0.0
+emoji-regex@9.2.2
+emoji-regex@9.2.2
+enabled@2.0.0
+encodeurl@1.0.2
+encodeurl@2.0.0
+encoding@0.1.13
+end-of-stream@1.4.5
+engine.io@4.1.2
+engine.io-parser@4.0.3
+env-paths@2.2.1
+err-code@1.1.2
+err-code@2.0.3
+errorhandler@1.5.1
+escape-html@1.0.3
+escape-string-regexp@1.0.5
+escodegen@2.1.0
+es-define-property@1.0.1
+es-errors@1.3.0
+es-get-iterator@1.1.3
+es-object-atoms@1.1.1
+esprima@1.0.4
+esprima@4.0.1
+estraverse@5.3.0
+esutils@2.0.3
+etag@1.8.1
+ethereum-cryptography@2.2.1
+@ethereumjs/rlp@4.0.1
+@ethereumjs/rlp@5.0.2
+ethers@6.15.0
+eventemitter2@0.4.14
+eventemitter3@1.1.1
+eventemitter3@5.0.1
+events@3.3.0
+event-target-shim@5.0.1
+exit@0.1.2
+expand-brackets@2.1.4
+expand-template@2.0.3
+expand-tilde@2.0.2
+exponential-backoff@3.1.2
+express@4.21.2
+express-ipfilter@1.3.2
+express-jwt@0.1.3
+express-rate-limit@7.5.1
+express-robots-txt@0.4.1
+express-security.txt@2.0.0
+extend@3.0.2
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@3.0.2
+extglob@2.0.4
+ext-list@2.2.2
+ext-name@5.0.0
+false_main@UNKNOWN
+fast.js@0.1.1
+fdir@6.5.0
+fd-slicer@1.1.0
+feature-policy@0.5.0
+fecha@4.2.3
+filehound@1.17.6
+file-js@0.3.0
+filename-reserved-regex@2.0.0
+filenamify@3.0.0
+filesniffer@1.0.3
+file-stream-rotator@1.0.0
+file-type@11.1.0
+file-type@16.5.4
+file-type@3.9.0
+file-type@4.4.0
+file-type@5.2.0
+file-type@5.2.0
+file-type@6.2.0
+file-uri-to-path@1.0.0
+fill-range@4.0.0
+fill-range@7.1.1
+fill-range@7.1.1
+fill-range@7.1.1
+finale-rest@1.2.2
+finalhandler@1.3.1
+find-up@4.1.0
+findup-sync@2.0.0
+findup-sync@4.0.0
+findup-sync@5.0.0
+fined@1.2.0
+flagged-respawn@1.0.1
+fn.name@1.1.0
+fontkit@1.9.0
+for-each@0.3.5
+foreachasync@3.0.0
+foreground-child@3.3.1
+for-in@1.0.2
+formatio@1.1.1
+for-own@1.0.0
+forwarded@0.2.0
+fragment-cache@0.2.1
+fresh@0.5.2
+from2@2.3.0
+frontend@19.0.0
+fs-constants@1.0.0
+fs-extra@9.1.0
+fs-minipass@1.2.7
+fs-minipass@2.1.0
+fs-minipass@3.0.3
+fs.realpath@1.0.0
+fstream@1.0.12
+function-bind@1.1.2
+functions-have-names@1.2.3
+fuzzball@1.4.0
+@gar/promisify@1.1.3
+gauge@2.7.4
+gauge@4.0.4
+gcc-12-base@12.2.0-14+deb12u1
+geojson-utils@1.1.0
+get-caller-file@2.0.5
+get-intrinsic@1.3.0
+getobject@1.0.2
+get-proto@1.0.1
+get-stream@2.3.1
+get-stream@3.0.0
+get-stream@3.0.0
+get-stream@4.1.0
+get-value@2.0.6
+github-from-package@0.0.0
+glob@10.4.5
+glob@7.1.7
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+global-modules@1.0.0
+global-prefix@1.0.2
+glob-parent@5.1.2
+gopd@1.2.0
+got@8.3.2
+graceful-fs@4.2.11
+grunt@1.6.1
+grunt-cli@1.4.3
+grunt-contrib-compress@1.6.0
+grunt-known-options@2.0.0
+grunt-legacy-log@3.0.0
+grunt-legacy-log-utils@2.1.0
+grunt-legacy-util@2.0.1
+grunt-replace-json@0.1.0
+handlebars@4.7.7
+has-ansi@2.0.0
+has-bigints@1.1.0
+has-flag@3.0.0
+has-flag@4.0.0
+hashids@2.3.0
+hashids-esm@UNKNOWN
+hasown@2.0.2
+has-property-descriptors@1.0.2
+has-symbols@1.1.0
+has-symbol-support-x@1.4.2
+has-tostringtag@1.0.2
+has-to-string-tag-x@1.4.1
+has-unicode@2.0.1
+has-value@0.3.1
+has-value@1.0.0
+has-values@0.1.4
+has-values@1.0.0
+hbs@4.2.0
+he@0.4.1
+heap@0.2.7
+helmet@4.6.0
+hoister@0.0.2
+homedir-polyfill@1.0.3
+hooker@0.2.3
+html-entities@1.4.0
+htmlparser2@3.3.0
+http-cache-semantics@3.8.1
+http-cache-semantics@4.2.0
+http-cache-semantics@4.2.0
+http-errors@1.6.3
+http-errors@2.0.0
+http-proxy-agent@4.0.1
+http-proxy-agent@5.0.0
+http-proxy-agent@7.0.2
+https-proxy-agent@5.0.1
+https-proxy-agent@7.0.6
+humanize-ms@1.2.1
+i18n@0.11.1
+iconv-lite@0.4.24
+iconv-lite@0.6.3
+iconv-lite@0.6.3
+ieee754@1.2.1
+ignore-walk@3.0.4
+iltorb@2.4.5
+imurmurhash@0.1.4
+indent-string@4.0.0
+infer-owner@1.0.4
+inflection@1.13.4
+inflight@1.0.6
+inherits@2.0.3
+inherits@2.0.4
+ini@1.3.8
+ini@1.3.8
+internal-slot@1.1.0
+interpret@1.1.0
+into-stream@3.1.0
+invalid_main@UNKNOWN
+invariant@2.2.4
+ip@2.0.1
+ip6@0.2.11
+ip-address@10.0.1
+ipaddr.js@1.9.1
+@isaacs/cliui@8.0.2
+@isaacs/fs-minipass@4.0.1
+is-absolute@1.0.0
+is-accessor-descriptor@1.0.1
+is-arguments@1.2.0
+isarray@0.0.1
+isarray@1.0.0
+isarray@1.0.0
+isarray@2.0.5
+is-array-buffer@3.0.5
+is-arrayish@0.3.2
+is-bigint@1.1.0
+is-binary-path@2.1.0
+is-boolean-object@1.2.2
+is-buffer@1.1.6
+is-callable@1.2.7
+is-core-module@2.16.1
+is-data-descriptor@1.0.1
+is-date-object@1.1.0
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@1.0.3
+isexe@2.0.0
+isexe@3.1.1
+is-expression@4.0.0
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@1.0.1
+is-extglob@2.1.1
+is-fullwidth-code-point@1.0.0
+is-fullwidth-code-point@2.0.0
+is-fullwidth-code-point@3.0.0
+is-generator-function@1.1.0
+is-glob@3.1.0
+is-glob@4.0.3
+is-lambda@1.0.1
+is-map@2.0.3
+is-natural-number@4.0.1
+is-number@3.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number-like@1.0.8
+is-number-object@1.1.1
+is-object@1.0.2
+isobject@2.1.0
+isobject@3.0.1
+isomorphic-ws@5.0.0
+is-plain-obj@1.1.0
+is-plain-object@2.0.4
+is-promise@2.2.2
+is-regex@1.2.1
+is-relative@1.0.0
+is-retry-allowed@1.2.0
+is-set@2.0.3
+is-shared-array-buffer@1.0.4
+is-stream@1.1.0
+is-stream@2.0.1
+is-string@1.1.1
+is-symbol@1.1.1
+is-typed-array@1.1.15
+is-unc-path@1.0.0
+isurl@1.0.0
+is-weakmap@2.0.2
+is-weakset@2.0.4
+is-windows@1.0.2
+jackspeak@3.4.3
+json5@2.2.3
+json-buffer@3.0.0
+jsonfile@6.2.0
+jsonwebtoken@0.1.0
+jsonwebtoken@0.4.0
+jssha@3.3.1
+js-stringify@1.0.2
+js-tokens@4.0.0
+jstransformer@1.0.0
+js-yaml@3.14.1
+juice-shop@19.0.0
+juice-shop@19.0.0
+juicy-chat-bot@0.9.0
+jwa@0.0.1
+jws@0.2.6
+keyv@3.0.0
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@4.0.0
+kind-of@6.0.3
+kuler@2.0.0
+lazystream@1.0.1
+libc6@2.36-9+deb12u10
+libgcc-s1@12.2.0-14+deb12u1
+libgomp1@12.2.0-14+deb12u1
+libssl3@3.0.17-1~deb12u2
+libstdc++6@12.2.0-14+deb12u1
+libxmljs2@0.37.0
+liftup@3.0.1
+linebreak@1.1.0
+listenercount@1.0.1
+ljharb-monorepo-symlink-test@0.0.0
+locate-path@5.0.0
+lodash@2.4.2
+lodash@4.17.21
+lodash.camelcase@4.3.0
+lodash.isfinite@3.3.2
+lodash.set@4.3.2
+logform@2.7.0
+lolex@1.3.2
+loose-envify@1.4.0
+lowercase-keys@1.0.0
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@6.0.0
+make-dir@1.3.0
+make-dir@2.1.0
+make-error@1.3.6
+make-fetch-happen@14.0.3
+make-fetch-happen@9.1.0
+make-iterator@1.0.1
+make-plural@4.3.0
+make-plural@6.2.2
+map-cache@0.2.2
+map-visit@1.0.0
+marsdb@0.6.11
+math-interval-parser@2.0.1
+math-intrinsics@1.1.0
+median@0.0.2
+media-typer@0.3.0
+media-types@10.0.0
+merge-descriptors@1.0.3
+messageformat@2.3.0
+messageformat-formatters@2.0.1
+messageformat-parser@4.1.3
+methods@1.1.2
+micromatch@3.1.10
+micromatch@4.0.8
+micromatch@4.0.8
+mime@1.6.0
+mime-db@1.52.0
+mime-types@2.1.35
+mimic-response@1.0.1
+mimic-response@2.1.0
+mimic-response@3.1.0
+mimic-response@3.1.0
+minami@1.1.1
+minami@1.1.1
+minami@1.1.1
+minimatch@3.0.5
+minimatch@3.0.8
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@5.1.6
+minimatch@9.0.5
+minimist@0.2.4
+minimist@1.2.8
+minipass@2.9.0
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@5.0.0
+minipass@7.1.2
+minipass-collect@1.0.2
+minipass-collect@2.0.1
+minipass-fetch@1.4.1
+minipass-fetch@4.0.1
+minipass-flush@1.0.5
+minipass-pipeline@1.2.4
+minipass-sized@1.0.3
+minizlib@1.3.3
+minizlib@2.1.2
+minizlib@3.0.2
+mixin-deep@1.3.2
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@1.0.4
+mkdirp@3.0.1
+mkdirp@3.0.1
+mkdirp-classic@0.5.3
+moment@2.0.0
+moment@2.30.1
+moment-timezone@0.5.48
+morgan@1.10.1
+mout@1.2.4
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.1.3
+multer@1.4.5-lts.2
+mustache@4.2.0
+mylib@0.0.0
+@my-scope/package-a@0.0.0
+@my-scope/package-b@0.0.0
+nan@2.22.2
+nanomatch@1.2.13
+napi-build-utils@1.0.2
+napi-build-utils@2.0.0
+napi-build-utils@2.0.0
+needle@2.9.1
+negotiator@0.6.3
+negotiator@0.6.4
+negotiator@1.0.0
+neo-async@2.6.2
+netbase@6.4
+@nlpjs/core@4.26.1
+@nlpjs/core-loader@4.26.1
+@nlpjs/evaluator@4.26.1
+@nlpjs/lang-en@4.26.1
+@nlpjs/lang-en-min@4.26.1
+@nlpjs/language@4.25.0
+@nlpjs/language-min@4.25.0
+@nlpjs/ner@4.27.0
+@nlpjs/neural@4.25.0
+@nlpjs/nlg@4.26.1
+@nlpjs/nlp@4.27.0
+@nlpjs/nlu@4.27.0
+@nlpjs/request@4.25.0
+@nlpjs/sentiment@4.26.1
+@nlpjs/similarity@4.26.1
+@nlpjs/slot@4.26.1
+@noble/curves@1.2.0
+@noble/curves@1.4.2
+@noble/curves@1.4.2
+@noble/hashes@1.3.2
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+node@22.18.0
+node-abi@2.30.1
+node-abi@3.77.0
+node-abi@3.77.0
+node-addon-api@7.1.1
+node-fetch@2.7.0
+node-gyp@11.4.2
+node-gyp@8.4.1
+node-pre-gyp@0.15.0
+noop-logger@0.1.1
+nopt@3.0.6
+nopt@4.0.3
+nopt@4.0.3
+nopt@5.0.0
+nopt@8.1.0
+normalize-path@2.1.1
+normalize-path@3.0.0
+normalize-path@3.0.0
+normalize-url@2.0.1
+notevil@1.3.3
+npm-bundled@1.1.2
+@npmcli/agent@3.0.0
+@npmcli/fs@1.1.1
+@npmcli/fs@4.0.0
+@npmcli/move-file@1.1.2
+npmlog@4.1.2
+npmlog@6.0.2
+npm-normalize-package-bin@1.0.1
+npm-packlist@1.4.8
+number-is-nan@1.0.1
+nw-pre-gyp-module-test@0.0.1
+object-assign@4.1.1
+object.assign@4.1.7
+object-copy@0.1.0
+object.defaults@1.1.0
+object-inspect@1.13.4
+object-is@1.1.6
+object-keys@1.1.1
+object.map@1.0.1
+object.pick@1.3.0
+object-visit@1.0.1
+once@1.4.0
+one-time@1.0.0
+on-finished@2.3.0
+on-finished@2.4.1
+on-headers@1.1.0
+opentype.js@0.7.3
+osenv@0.1.5
+os-homedir@1.0.2
+os-tmpdir@1.0.2
+otplib@12.0.1
+@otplib/core@12.0.1
+@otplib/plugin-crypto@12.0.1
+@otplib/plugin-thirty-two@12.0.1
+@otplib/preset-default@12.0.1
+@otplib/preset-v11@12.0.1
+package-json-from-dist@1.0.1
+pako@0.2.9
+parse-filepath@1.0.2
+parse-passwd@1.0.0
+parseurl@1.3.3
+pascalcase@0.1.1
+path-exists@4.0.0
+path-is-absolute@1.0.1
+path-key@3.1.1
+path-parse@1.0.7
+path-root@0.1.1
+path-root-regex@0.1.2
+path-scurry@1.11.1
+path-to-regexp@0.1.12
+p-cancelable@0.4.1
+pdfkit@0.11.0
+peek-readable@4.1.0
+pend@1.2.0
+p-event@2.3.1
+p-finally@1.0.0
+pg-connection-string@2.9.1
+picomatch@2.3.1
+picomatch@4.0.3
+pify@2.3.0
+pify@2.3.0
+pify@3.0.0
+pify@3.0.0
+pify@4.0.1
+pinkie@2.0.4
+pinkie-promise@2.0.1
+p-is-promise@1.1.0
+@pkgjs/parseargs@0.11.0
+p-limit@2.3.0
+p-locate@4.1.0
+p-map@4.0.0
+p-map@7.0.3
+png-js@1.0.0
+posix-character-classes@0.1.1
+possible-typed-array-names@1.1.0
+prebuild-install@5.3.6
+prebuild-install@7.1.3
+prebuild-install@7.1.3
+prepend-http@2.0.0
+pretty-bytes@4.0.2
+process@0.11.10
+process-nextick-args@2.0.1
+proc-log@5.0.0
+prom-client@14.2.0
+promise@7.3.1
+promise-inflight@1.0.1
+promise-retry@2.0.1
+proper-lockfile@1.2.0
+proxy-addr@2.0.7
+p-timeout@2.0.1
+p-try@2.2.0
+pug@3.0.3
+pug-attrs@3.0.0
+pug-code-gen@3.0.3
+pug-error@2.1.0
+pug-filters@4.0.0
+pug-lexer@5.0.1
+pug-linker@4.0.0
+pug-load@3.0.0
+pug-parser@6.0.0
+pug-runtime@3.0.1
+pug-strip-comments@2.0.0
+pug-walk@2.0.0
+pump@3.0.3
+qs@6.13.0
+query-string@5.1.1
+range_check@2.0.4
+range-parser@1.2.1
+raw-body@2.5.2
+rc@1.2.8
+readable-stream@1.0.34
+readable-stream@2.3.8
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@4.7.0
+readable-web-to-node-stream@3.0.4
+readdirp@3.5.0
+rechoir@0.7.1
+recursedir-comparisons@0.0.0
+regex-not@1.0.2
+regexp.prototype.flags@1.5.4
+remove-trailing-separator@1.1.0
+repeat-element@1.1.4
+repeat-string@1.6.1
+replace@1.2.2
+require-directory@2.1.1
+require-main-filename@2.0.0
+resolve@1.22.10
+resolve-dir@1.0.1
+resolve-url@0.2.1
+responselike@1.0.2
+restructure@2.0.1
+ret@0.1.15
+retry@0.10.1
+retry@0.12.0
+retry-as-promised@7.1.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@3.0.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.2.1
+safer-buffer@2.1.2
+safe-regex@1.1.0
+safe-regex-test@1.1.0
+safe-stable-stringify@2.5.0
+samsam@1.1.2
+sanitize-filename@1.6.3
+sanitize-html@1.4.2
+sax@1.4.1
+@scarf/scarf@1.4.0
+@scure/base@1.1.9
+@scure/bip32@1.4.0
+@scure/bip39@1.3.0
+seek-bzip@1.0.6
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@7.7.2
+send@0.19.0
+sequelize@6.37.7
+sequelize-pool@7.1.0
+serve-index@1.9.1
+serve-static@1.16.2
+set-blocking@2.0.0
+set-function-length@1.2.2
+set-function-name@2.0.2
+setimmediate@1.0.5
+setprototypeof@1.1.0
+setprototypeof@1.2.0
+set-value@2.0.1
+shebang-command@2.0.0
+shebang-regex@3.0.0
+side-channel@1.1.0
+side-channel-list@1.0.0
+side-channel-map@1.0.1
+side-channel-weakmap@1.0.2
+signal-exit@3.0.7
+signal-exit@4.1.0
+simple-concat@1.0.1
+simple-get@3.1.1
+simple-get@4.0.1
+simple-get@4.0.1
+simple-swizzle@0.2.2
+@sindresorhus/is@0.7.0
+sinon@1.17.7
+smart-buffer@4.2.0
+snapdragon@0.8.2
+snapdragon-node@2.1.1
+snapdragon-util@3.0.1
+socket.io@3.1.2
+socket.io-adapter@2.1.0
+socket.io-parser@4.0.5
+socks@2.8.7
+socks-proxy-agent@6.2.1
+socks-proxy-agent@8.0.5
+sort-keys@1.1.2
+sort-keys@2.0.0
+sort-keys-length@1.0.1
+source-map@0.5.7
+source-map@0.6.1
+source-map-resolve@0.5.3
+source-map-support@0.5.21
+source-map-url@0.4.1
+split-string@3.1.0
+sprintf-js@1.0.3
+sprintf-js@1.1.3
+sqlite3@5.1.7
+ssri@12.0.0
+ssri@8.0.1
+stack-trace@0.0.10
+static-extend@0.1.2
+statuses@1.5.0
+statuses@2.0.1
+stop-iteration-iterator@1.1.0
+stream-buffers@2.2.0
+streamsearch@1.1.0
+strict-uri-encode@1.1.0
+string_decoder@0.10.31
+string_decoder@1.1.1
+string_decoder@1.3.0
+string.fromcodepoint@0.2.1
+string.prototype.codepointat@0.2.1
+string-width@1.0.2
+string-width@2.1.1
+string-width@4.2.3
+string-width@4.2.3
+string-width@5.1.2
+string-width@5.1.2
+strip-ansi@3.0.1
+strip-ansi@3.0.1
+strip-ansi@4.0.0
+strip-ansi@6.0.1
+strip-ansi@6.0.1
+strip-ansi@7.1.0
+strip-ansi@7.1.0
+strip-bom@3.0.0
+strip-dirs@2.1.0
+strip-json-comments@2.0.1
+strip-json-comments@2.0.1
+strip-outer@1.0.1
+strtok3@6.3.0
+supports-color@2.0.0
+supports-color@5.5.0
+supports-color@7.2.0
+supports-preserve-symlinks-flag@1.0.0
+svg-captcha@1.4.0
+swagger-ui-dist@5.28.1
+swagger-ui-express@5.0.1
+@swc/helpers@0.3.17
+tar@4.4.19
+tar@6.2.1
+tar@7.4.3
+tar-fs@2.1.3
+tar-stream@1.6.2
+tar-stream@2.2.0
+tdigest@0.1.2
+text-hex@1.0.0
+thirty-two@1.0.2
+through@2.3.8
+timed-out@4.0.1
+tinyglobby@0.2.14
+tiny-inflate@1.0.3
+to-buffer@1.2.1
+toidentifier@1.0.1
+@tokenizer/token@0.3.0
+token-stream@1.0.0
+token-types@4.2.1
+to-object-path@0.3.0
+@tootallnate/once@1.1.2
+@tootallnate/once@2.0.0
+to-regex@3.0.2
+to-regex-range@2.1.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+tr46@0.0.3
+traverse@0.3.9
+tree-kill@1.2.2
+trim-repeated@1.0.0
+triple-beam@1.4.1
+truncate-utf8-bytes@1.0.2
+tsconfig@7.0.0
+tslib@2.7.0
+ts-node@9.1.1
+ts-node-dev@1.1.8
+tunnel-agent@0.6.0
+typecast@0.0.1
+typedarray@0.0.6
+typed-array-buffer@1.0.3
+type-is@1.6.18
+@types/component-emitter@1.2.14
+@types/cookie@0.4.1
+@types/cors@2.8.19
+typescript@5.3.3
+@types/debug@4.1.12
+@types/ms@2.1.0
+@types/node@20.19.12
+@types/node@22.7.5
+@types/strip-bom@3.0.0
+@types/strip-json-comments@0.0.30
+@types/triple-beam@1.3.5
+@types/validator@13.15.3
+@types/ws@8.5.3
+tzdata@2025b-0+deb12u1
+uglify-js@3.19.3
+unbzip2-stream@1.4.3
+unc-path-regex@0.1.2
+underscore.string@3.3.6
+undici-types@6.19.8
+undici-types@6.21.0
+unicode-properties@1.4.1
+unicode-trie@2.0.0
+union-value@1.0.1
+unique-filename@1.1.1
+unique-filename@4.0.0
+unique-slug@2.0.2
+unique-slug@5.0.0
+unit-compare@1.0.1
+universalify@2.0.1
+unpipe@1.0.0
+unset-value@1.0.0
+untildify@2.1.0
+unzipper@0.9.15
+urix@0.1.0
+url-parse-lax@3.0.0
+url-to-options@1.0.1
+use@3.1.1
+utf8-byte-length@1.0.5
+util@0.12.5
+util-deprecate@1.0.2
+utils-merge@1.0.1
+uuid@8.3.2
+v8flags@3.2.0
+validate@4.5.1
+validator@13.15.15
+vary@1.1.2
+vm2@3.9.17
+void-elements@3.1.0
+walk@2.3.15
+walkdir@0.0.11
+web3@4.16.0
+web3-core@4.7.1
+web3-errors@1.3.1
+web3-eth@4.11.1
+web3-eth-abi@4.4.1
+web3-eth-accounts@4.3.1
+web3-eth-contract@4.7.2
+web3-eth-ens@4.4.0
+web3-eth-iban@4.0.7
+web3-eth-personal@4.1.0
+web3-net@4.1.0
+web3-providers-http@4.2.0
+web3-providers-ipc@4.0.7
+web3-providers-ws@4.0.8
+web3-rpc-methods@1.3.0
+web3-rpc-providers@1.0.0-rc.4
+web3-types@1.10.0
+web3-utils@4.3.3
+web3-validator@2.0.6
+webidl-conversions@3.0.1
+whatwg-url@5.0.0
+which@1.3.1
+which@2.0.2
+which@5.0.0
+which-boxed-primitive@1.1.1
+which-collection@1.0.2
+which-module@2.0.1
+which-pm-runs@1.1.0
+which-typed-array@1.1.19
+wide-align@1.1.3
+wide-align@1.1.5
+winston@3.17.0
+winston-transport@4.9.0
+with@7.0.2
+wkx@0.5.0
+wordwrap@0.0.3
+wordwrap@1.0.0
+wrap-ansi@6.2.0
+wrap-ansi@7.0.0
+wrap-ansi@8.1.0
+wrappy@1.0.2
+ws@7.4.6
+ws@8.17.1
+xtend@4.0.2
+y18n@4.0.3
+yallist@3.1.1
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@5.0.0
+yaml-schema-validator@1.2.3
+yargs@15.4.1
+yargs-parser@18.1.3
+yauzl@2.10.0
+yn@3.1.1
+z85@0.0.2
+zip-stream@1.2.0
+zod@3.25.76
diff --git a/labs/lab4/comparison/trivy-cves.txt b/labs/lab4/comparison/trivy-cves.txt
new file mode 100644
index 00000000..8ae55844
--- /dev/null
+++ b/labs/lab4/comparison/trivy-cves.txt
@@ -0,0 +1,91 @@
+CVE-2010-4756
+CVE-2015-9235
+CVE-2016-1000223
+CVE-2016-1000237
+CVE-2016-4055
+CVE-2017-16016
+CVE-2017-18214
+CVE-2018-16487
+CVE-2018-20796
+CVE-2018-3721
+CVE-2019-1010022
+CVE-2019-1010023
+CVE-2019-1010024
+CVE-2019-1010025
+CVE-2019-10744
+CVE-2019-25225
+CVE-2019-9192
+CVE-2020-15084
+CVE-2020-8203
+CVE-2021-23337
+CVE-2021-23771
+CVE-2021-26539
+CVE-2021-26540
+CVE-2022-23539
+CVE-2022-23540
+CVE-2022-23541
+CVE-2022-24785
+CVE-2022-25881
+CVE-2022-25887
+CVE-2022-27943
+CVE-2022-33987
+CVE-2022-41940
+CVE-2023-32313
+CVE-2023-32314
+CVE-2023-32695
+CVE-2023-37466
+CVE-2023-37903
+CVE-2023-46233
+CVE-2024-21501
+CVE-2024-28863
+CVE-2024-29415
+CVE-2024-37890
+CVE-2024-38355
+CVE-2024-4067
+CVE-2024-4068
+CVE-2024-47764
+CVE-2025-12758
+CVE-2025-13465
+CVE-2025-15281
+CVE-2025-15284
+CVE-2025-15467
+CVE-2025-27587
+CVE-2025-47935
+CVE-2025-47944
+CVE-2025-4802
+CVE-2025-48997
+CVE-2025-56200
+CVE-2025-57349
+CVE-2025-59343
+CVE-2025-64718
+CVE-2025-64756
+CVE-2025-65945
+CVE-2025-68160
+CVE-2025-69418
+CVE-2025-69419
+CVE-2025-69420
+CVE-2025-69421
+CVE-2025-7338
+CVE-2025-8058
+CVE-2025-9230
+CVE-2025-9232
+CVE-2026-0861
+CVE-2026-0915
+CVE-2026-22709
+CVE-2026-22795
+CVE-2026-22796
+CVE-2026-23745
+CVE-2026-2391
+CVE-2026-23950
+CVE-2026-24001
+CVE-2026-24842
+CVE-2026-26960
+CVE-2026-26996
+CVE-2026-27837
+CVE-2026-27903
+CVE-2026-27904
+GHSA-5mrr-rgp6-x4gr
+GHSA-rvg8-pwq2-xj7q
+NSWG-ECO-154
+NSWG-ECO-17
+NSWG-ECO-428
diff --git a/labs/lab4/comparison/trivy-only.txt b/labs/lab4/comparison/trivy-only.txt
new file mode 100644
index 00000000..eb056b32
--- /dev/null
+++ b/labs/lab4/comparison/trivy-only.txt
@@ -0,0 +1,9 @@
+gcc-12-base@12.2.0
+libc6@2.36
+libgcc-s1@12.2.0
+libgomp1@12.2.0
+libssl3@3.0.17
+libstdc++6@12.2.0
+portscanner@2.2.0
+toposort-class@1.0.1
+tzdata@2025b
diff --git a/labs/lab4/comparison/trivy-packages.txt b/labs/lab4/comparison/trivy-packages.txt
new file mode 100644
index 00000000..e807fc96
--- /dev/null
+++ b/labs/lab4/comparison/trivy-packages.txt
@@ -0,0 +1,1135 @@
+1to2@1.0.0
+abbrev@1.1.1
+abbrev@3.0.1
+abitype@0.7.1
+abort-controller@3.0.0
+accepts@1.3.8
+acorn@7.4.1
+acorn@8.15.0
+acorn-walk@8.3.4
+@adraffy/ens-normalize@1.10.1
+aes-js@4.0.0-beta.5
+agent-base@6.0.2
+agent-base@7.1.4
+agent-base@7.1.4
+agentkeepalive@4.6.0
+aggregate-error@3.1.0
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@2.1.1
+ansi-regex@3.0.1
+ansi-regex@5.0.1
+ansi-regex@6.2.0
+ansi-regex@6.2.0
+ansi-styles@2.2.1
+ansi-styles@3.2.1
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@4.3.0
+ansi-styles@6.2.1
+anymatch@3.1.3
+append-field@1.0.0
+aproba@1.2.0
+archiver@1.3.0
+archiver-utils@1.3.0
+archive-type@4.0.0
+are-we-there-yet@1.1.7
+are-we-there-yet@3.0.1
+arg@4.1.3
+argparse@1.0.10
+array-buffer-byte-length@1.0.2
+array-each@1.0.1
+array-flatten@1.1.1
+array-slice@1.1.0
+array-unique@0.3.2
+arr-diff@4.0.0
+arr-flatten@1.1.0
+arr-union@3.1.0
+asap@2.0.6
+assert-never@1.4.0
+assign-symbols@1.0.0
+async@2.6.4
+async@2.6.4
+async@3.2.6
+at-least-node@1.0.0
+atob@2.1.2
+available-typed-arrays@1.0.7
+@babel/helper-string-parser@7.27.1
+@babel/helper-validator-identifier@7.27.1
+@babel/parser@7.28.3
+@babel/types@7.28.2
+babel-walk@3.0.0-canary-5
+balanced-match@1.0.2
+base@0.11.2
+base64-arraybuffer@0.1.4
+base64id@2.0.0
+base64-js@0.0.8
+base64-js@1.5.1
+base64url@0.0.6
+base-files@12.4+deb12u11
+basic-auth@2.0.1
+batch@0.6.1
+beep-boop@1.2.3
+big-integer@1.6.52
+binary@0.3.0
+binary-extensions@2.3.0
+bindings@1.5.0
+bintrees@1.0.2
+bl@1.2.3
+bl@4.1.0
+bluebird@3.4.7
+bluebird@3.7.2
+body-parser@1.20.3
+bower-config@1.4.3
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@1.1.12
+brace-expansion@2.0.2
+braces@2.3.2
+braces@3.0.3
+braces@3.0.3
+braces@3.0.3
+brotli@1.3.3
+buffer@5.7.1
+buffer@6.0.3
+buffer-alloc@1.2.0
+buffer-alloc-unsafe@1.1.0
+buffer-crc32@0.2.13
+buffer-fill@1.0.0
+buffer-from@1.1.2
+buffer-indexof-polyfill@1.0.2
+buffers@0.1.1
+busboy@1.6.0
+byline@4.2.2
+bytes@3.1.2
+cacache@15.3.0
+cacache@19.0.1
+cacheable-request@2.1.4
+cache-base@1.0.1
+call-bind@1.0.8
+call-bind-apply-helpers@1.0.2
+call-bound@1.0.4
+camelcase@5.3.1
+chainsaw@0.1.0
+chalk@1.1.3
+chalk@2.4.2
+chalk@4.1.2
+character-parser@2.2.0
+check-dependencies@1.1.1
+check-internet-connected@2.0.6
+check-types@6.0.0
+chokidar@3.5.1
+chownr@1.1.4
+chownr@1.1.4
+chownr@2.0.0
+chownr@3.0.0
+clarinet@0.12.6
+class-utils@0.3.6
+clean-stack@2.2.0
+cliui@6.0.0
+clone@2.1.2
+clone-response@1.0.2
+code-point-at@1.1.0
+collection-visit@1.0.0
+color@3.2.1
+color-convert@1.9.3
+color-convert@2.0.1
+color-convert@2.0.1
+color-convert@2.0.1
+color-name@1.1.3
+color-name@1.1.4
+color-name@1.1.4
+color-name@1.1.4
+colors@1.1.2
+colors@1.4.0
+@colors/colors@1.6.0
+@colors/colors@1.6.0
+colorspace@1.1.4
+color-string@1.9.1
+color-support@1.1.3
+commander@2.20.3
+commander@2.20.3
+component-emitter@1.3.1
+component-type@1.2.1
+compress-commons@1.2.2
+compressible@2.0.18
+compression@1.8.1
+concat-map@0.0.1
+concat-stream@1.6.2
+config@3.3.12
+console-control-strings@1.1.0
+constantinople@4.0.1
+content-disposition@0.5.4
+content-type@1.0.5
+cookie@0.4.2
+cookie@0.7.1
+cookie@0.7.2
+cookie-parser@1.4.7
+cookie-signature@1.0.6
+copy-descriptor@0.1.1
+core-util-is@1.0.2
+cors@2.8.5
+crc-32@1.2.2
+crc32-stream@2.0.0
+crc@3.8.0
+create-require@1.1.1
+cross-fetch@4.1.0
+cross-fetch-polyfill@0.0.0
+cross-spawn@7.0.6
+crypto-js@3.3.0
+@dabh/diagnostics@2.0.3
+dateformat@4.6.3
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@2.6.9
+debug@3.2.7
+debug@4.3.7
+decamelize@1.2.0
+decode-uri-component@0.2.2
+decompress@4.2.1
+decompress-response@3.3.0
+decompress-response@4.2.1
+decompress-response@6.0.0
+decompress-response@6.0.0
+decompress-tar@4.1.1
+decompress-tarbz2@4.1.1
+decompress-targz@4.1.1
+decompress-unzip@4.0.1
+deep-equal@2.2.3
+deep-extend@0.6.0
+define-data-property@1.1.4
+define-properties@1.2.1
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@0.2.5
+define-property@1.0.0
+define-property@1.0.0
+define-property@1.0.0
+define-property@2.0.2
+delegates@1.0.0
+depd@1.1.2
+depd@2.0.0
+destroy@1.2.0
+detect-file@1.0.0
+detect-libc@1.0.3
+detect-libc@2.0.4
+detect-libc@2.0.4
+dfa@1.2.0
+diff@4.0.2
+doctypes@1.1.0
+domelementtype@1.3.1
+domhandler@2.1.0
+domutils@1.1.6
+dottie@2.0.6
+double-ended-queue@0.9.7
+download@8.0.0
+dunder-proto@1.0.1
+duplexer2@0.1.4
+duplexer3@0.1.5
+dynamic-dedupe@0.3.0
+eastasianwidth@0.2.0
+ee-first@1.1.1
+eivindfjeldstad-dot@0.0.1
+emoji-regex@8.0.0
+emoji-regex@9.2.2
+emoji-regex@9.2.2
+enabled@2.0.0
+encodeurl@1.0.2
+encodeurl@2.0.0
+encoding@0.1.13
+end-of-stream@1.4.5
+engine.io@4.1.2
+engine.io-parser@4.0.3
+env-paths@2.2.1
+err-code@1.1.2
+err-code@2.0.3
+errorhandler@1.5.1
+escape-html@1.0.3
+escape-string-regexp@1.0.5
+escodegen@2.1.0
+es-define-property@1.0.1
+es-errors@1.3.0
+es-get-iterator@1.1.3
+es-object-atoms@1.1.1
+esprima@1.0.4
+esprima@4.0.1
+estraverse@5.3.0
+esutils@2.0.3
+etag@1.8.1
+ethereum-cryptography@2.2.1
+@ethereumjs/rlp@4.0.1
+@ethereumjs/rlp@5.0.2
+ethers@6.15.0
+eventemitter2@0.4.14
+eventemitter3@1.1.1
+eventemitter3@5.0.1
+events@3.3.0
+event-target-shim@5.0.1
+exit@0.1.2
+expand-brackets@2.1.4
+expand-template@2.0.3
+expand-tilde@2.0.2
+exponential-backoff@3.1.2
+express@4.21.2
+express-ipfilter@1.3.2
+express-jwt@0.1.3
+express-rate-limit@7.5.1
+express-robots-txt@0.4.1
+express-security.txt@2.0.0
+extend@3.0.2
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@2.0.1
+extend-shallow@3.0.2
+extglob@2.0.4
+ext-list@2.2.2
+ext-name@5.0.0
+fast.js@0.1.1
+fdir@6.5.0
+fd-slicer@1.1.0
+feature-policy@0.5.0
+fecha@4.2.3
+filehound@1.17.6
+file-js@0.3.0
+filename-reserved-regex@2.0.0
+filenamify@3.0.0
+filesniffer@1.0.3
+file-stream-rotator@1.0.0
+file-type@11.1.0
+file-type@16.5.4
+file-type@3.9.0
+file-type@4.4.0
+file-type@5.2.0
+file-type@5.2.0
+file-type@6.2.0
+file-uri-to-path@1.0.0
+fill-range@4.0.0
+fill-range@7.1.1
+fill-range@7.1.1
+fill-range@7.1.1
+finale-rest@1.2.2
+finalhandler@1.3.1
+find-up@4.1.0
+findup-sync@2.0.0
+findup-sync@4.0.0
+findup-sync@5.0.0
+fined@1.2.0
+flagged-respawn@1.0.1
+fn.name@1.1.0
+fontkit@1.9.0
+for-each@0.3.5
+foreachasync@3.0.0
+foreground-child@3.3.1
+for-in@1.0.2
+formatio@1.1.1
+for-own@1.0.0
+forwarded@0.2.0
+fragment-cache@0.2.1
+fresh@0.5.2
+from2@2.3.0
+frontend@19.0.0
+fs-constants@1.0.0
+fs-extra@9.1.0
+fs-minipass@1.2.7
+fs-minipass@2.1.0
+fs-minipass@3.0.3
+fs.realpath@1.0.0
+fstream@1.0.12
+function-bind@1.1.2
+functions-have-names@1.2.3
+fuzzball@1.4.0
+@gar/promisify@1.1.3
+gauge@2.7.4
+gauge@4.0.4
+gcc-12-base@12.2.0
+geojson-utils@1.1.0
+get-caller-file@2.0.5
+get-intrinsic@1.3.0
+getobject@1.0.2
+get-proto@1.0.1
+get-stream@2.3.1
+get-stream@3.0.0
+get-stream@3.0.0
+get-stream@4.1.0
+get-value@2.0.6
+github-from-package@0.0.0
+glob@10.4.5
+glob@7.1.7
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+glob@7.2.3
+global-modules@1.0.0
+global-prefix@1.0.2
+glob-parent@5.1.2
+gopd@1.2.0
+got@8.3.2
+graceful-fs@4.2.11
+grunt@1.6.1
+grunt-cli@1.4.3
+grunt-contrib-compress@1.6.0
+grunt-known-options@2.0.0
+grunt-legacy-log@3.0.0
+grunt-legacy-log-utils@2.1.0
+grunt-legacy-util@2.0.1
+grunt-replace-json@0.1.0
+handlebars@4.7.7
+has-ansi@2.0.0
+has-bigints@1.1.0
+has-flag@3.0.0
+has-flag@4.0.0
+hashids@2.3.0
+hasown@2.0.2
+has-property-descriptors@1.0.2
+has-symbols@1.1.0
+has-symbol-support-x@1.4.2
+has-tostringtag@1.0.2
+has-to-string-tag-x@1.4.1
+has-unicode@2.0.1
+has-value@0.3.1
+has-value@1.0.0
+has-values@0.1.4
+has-values@1.0.0
+hbs@4.2.0
+he@0.4.1
+heap@0.2.7
+helmet@4.6.0
+hoister@0.0.2
+homedir-polyfill@1.0.3
+hooker@0.2.3
+html-entities@1.4.0
+htmlparser2@3.3.0
+http-cache-semantics@3.8.1
+http-cache-semantics@4.2.0
+http-cache-semantics@4.2.0
+http-errors@1.6.3
+http-errors@2.0.0
+http-proxy-agent@4.0.1
+http-proxy-agent@5.0.0
+http-proxy-agent@7.0.2
+https-proxy-agent@5.0.1
+https-proxy-agent@7.0.6
+humanize-ms@1.2.1
+i18n@0.11.1
+iconv-lite@0.4.24
+iconv-lite@0.6.3
+iconv-lite@0.6.3
+ieee754@1.2.1
+ignore-walk@3.0.4
+iltorb@2.4.5
+imurmurhash@0.1.4
+indent-string@4.0.0
+infer-owner@1.0.4
+inflection@1.13.4
+inflight@1.0.6
+inherits@2.0.3
+inherits@2.0.4
+ini@1.3.8
+ini@1.3.8
+internal-slot@1.1.0
+interpret@1.1.0
+into-stream@3.1.0
+invariant@2.2.4
+ip@2.0.1
+ip6@0.2.11
+ip-address@10.0.1
+ipaddr.js@1.9.1
+@isaacs/cliui@8.0.2
+@isaacs/fs-minipass@4.0.1
+is-absolute@1.0.0
+is-accessor-descriptor@1.0.1
+is-arguments@1.2.0
+isarray@0.0.1
+isarray@1.0.0
+isarray@1.0.0
+isarray@2.0.5
+is-array-buffer@3.0.5
+is-arrayish@0.3.2
+is-bigint@1.1.0
+is-binary-path@2.1.0
+is-boolean-object@1.2.2
+is-buffer@1.1.6
+is-callable@1.2.7
+is-core-module@2.16.1
+is-data-descriptor@1.0.1
+is-date-object@1.1.0
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@0.1.7
+is-descriptor@1.0.3
+isexe@2.0.0
+isexe@3.1.1
+is-expression@4.0.0
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@0.1.1
+is-extendable@1.0.1
+is-extglob@2.1.1
+is-fullwidth-code-point@1.0.0
+is-fullwidth-code-point@2.0.0
+is-fullwidth-code-point@3.0.0
+is-generator-function@1.1.0
+is-glob@3.1.0
+is-glob@4.0.3
+is-lambda@1.0.1
+is-map@2.0.3
+is-natural-number@4.0.1
+is-number@3.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number@7.0.0
+is-number-like@1.0.8
+is-number-object@1.1.1
+is-object@1.0.2
+isobject@2.1.0
+isobject@3.0.1
+isomorphic-ws@5.0.0
+is-plain-obj@1.1.0
+is-plain-object@2.0.4
+is-promise@2.2.2
+is-regex@1.2.1
+is-relative@1.0.0
+is-retry-allowed@1.2.0
+is-set@2.0.3
+is-shared-array-buffer@1.0.4
+is-stream@1.1.0
+is-stream@2.0.1
+is-string@1.1.1
+is-symbol@1.1.1
+is-typed-array@1.1.15
+is-unc-path@1.0.0
+isurl@1.0.0
+is-weakmap@2.0.2
+is-weakset@2.0.4
+is-windows@1.0.2
+jackspeak@3.4.3
+json5@2.2.3
+json-buffer@3.0.0
+jsonfile@6.2.0
+jsonwebtoken@0.1.0
+jsonwebtoken@0.4.0
+jssha@3.3.1
+js-stringify@1.0.2
+js-tokens@4.0.0
+jstransformer@1.0.0
+js-yaml@3.14.1
+juice-shop@19.0.0
+juice-shop@19.0.0
+juicy-chat-bot@0.9.0
+jwa@0.0.1
+jws@0.2.6
+keyv@3.0.0
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@3.2.2
+kind-of@4.0.0
+kind-of@6.0.3
+kuler@2.0.0
+lazystream@1.0.1
+libc6@2.36
+libgcc-s1@12.2.0
+libgomp1@12.2.0
+libssl3@3.0.17
+libstdc++6@12.2.0
+libxmljs2@0.37.0
+liftup@3.0.1
+linebreak@1.1.0
+listenercount@1.0.1
+ljharb-monorepo-symlink-test@0.0.0
+locate-path@5.0.0
+lodash@2.4.2
+lodash@4.17.21
+lodash.camelcase@4.3.0
+lodash.isfinite@3.3.2
+lodash.set@4.3.2
+logform@2.7.0
+lolex@1.3.2
+loose-envify@1.4.0
+lowercase-keys@1.0.0
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@10.4.3
+lru-cache@6.0.0
+make-dir@1.3.0
+make-dir@2.1.0
+make-error@1.3.6
+make-fetch-happen@14.0.3
+make-fetch-happen@9.1.0
+make-iterator@1.0.1
+make-plural@4.3.0
+make-plural@6.2.2
+map-cache@0.2.2
+map-visit@1.0.0
+marsdb@0.6.11
+math-interval-parser@2.0.1
+math-intrinsics@1.1.0
+median@0.0.2
+media-typer@0.3.0
+media-types@10.0.0
+merge-descriptors@1.0.3
+messageformat@2.3.0
+messageformat-formatters@2.0.1
+messageformat-parser@4.1.3
+methods@1.1.2
+micromatch@3.1.10
+micromatch@4.0.8
+micromatch@4.0.8
+mime@1.6.0
+mime-db@1.52.0
+mime-types@2.1.35
+mimic-response@1.0.1
+mimic-response@2.1.0
+mimic-response@3.1.0
+mimic-response@3.1.0
+minami@1.1.1
+minami@1.1.1
+minami@1.1.1
+minimatch@3.0.5
+minimatch@3.0.8
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@3.1.2
+minimatch@5.1.6
+minimatch@9.0.5
+minimist@0.2.4
+minimist@1.2.8
+minipass@2.9.0
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@3.3.6
+minipass@5.0.0
+minipass@7.1.2
+minipass-collect@1.0.2
+minipass-collect@2.0.1
+minipass-fetch@1.4.1
+minipass-fetch@4.0.1
+minipass-flush@1.0.5
+minipass-pipeline@1.2.4
+minipass-sized@1.0.3
+minizlib@1.3.3
+minizlib@2.1.2
+minizlib@3.0.2
+mixin-deep@1.3.2
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@0.5.6
+mkdirp@1.0.4
+mkdirp@3.0.1
+mkdirp@3.0.1
+mkdirp-classic@0.5.3
+moment@2.0.0
+moment@2.30.1
+moment-timezone@0.5.48
+morgan@1.10.1
+mout@1.2.4
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.0.0
+ms@2.1.3
+multer@1.4.5-lts.2
+mustache@4.2.0
+mylib@0.0.0
+@my-scope/package-a@0.0.0
+@my-scope/package-b@0.0.0
+nan@2.22.2
+nanomatch@1.2.13
+napi-build-utils@1.0.2
+napi-build-utils@2.0.0
+napi-build-utils@2.0.0
+needle@2.9.1
+negotiator@0.6.3
+negotiator@0.6.4
+negotiator@1.0.0
+neo-async@2.6.2
+netbase@6.4
+@nlpjs/core@4.26.1
+@nlpjs/core-loader@4.26.1
+@nlpjs/evaluator@4.26.1
+@nlpjs/lang-en@4.26.1
+@nlpjs/lang-en-min@4.26.1
+@nlpjs/language@4.25.0
+@nlpjs/language-min@4.25.0
+@nlpjs/ner@4.27.0
+@nlpjs/neural@4.25.0
+@nlpjs/nlg@4.26.1
+@nlpjs/nlp@4.27.0
+@nlpjs/nlu@4.27.0
+@nlpjs/request@4.25.0
+@nlpjs/sentiment@4.26.1
+@nlpjs/similarity@4.26.1
+@nlpjs/slot@4.26.1
+@noble/curves@1.2.0
+@noble/curves@1.4.2
+@noble/curves@1.4.2
+@noble/hashes@1.3.2
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+@noble/hashes@1.4.0
+node-abi@2.30.1
+node-abi@3.77.0
+node-abi@3.77.0
+node-addon-api@7.1.1
+node-fetch@2.7.0
+node-gyp@11.4.2
+node-gyp@8.4.1
+node-pre-gyp@0.15.0
+noop-logger@0.1.1
+nopt@3.0.6
+nopt@4.0.3
+nopt@4.0.3
+nopt@5.0.0
+nopt@8.1.0
+normalize-path@2.1.1
+normalize-path@3.0.0
+normalize-path@3.0.0
+normalize-url@2.0.1
+notevil@1.3.3
+npm-bundled@1.1.2
+@npmcli/agent@3.0.0
+@npmcli/fs@1.1.1
+@npmcli/fs@4.0.0
+@npmcli/move-file@1.1.2
+npmlog@4.1.2
+npmlog@6.0.2
+npm-normalize-package-bin@1.0.1
+npm-packlist@1.4.8
+number-is-nan@1.0.1
+nw-pre-gyp-module-test@0.0.1
+object-assign@4.1.1
+object.assign@4.1.7
+object-copy@0.1.0
+object.defaults@1.1.0
+object-inspect@1.13.4
+object-is@1.1.6
+object-keys@1.1.1
+object.map@1.0.1
+object.pick@1.3.0
+object-visit@1.0.1
+once@1.4.0
+one-time@1.0.0
+on-finished@2.3.0
+on-finished@2.4.1
+on-headers@1.1.0
+opentype.js@0.7.3
+osenv@0.1.5
+os-homedir@1.0.2
+os-tmpdir@1.0.2
+otplib@12.0.1
+@otplib/core@12.0.1
+@otplib/plugin-crypto@12.0.1
+@otplib/plugin-thirty-two@12.0.1
+@otplib/preset-default@12.0.1
+@otplib/preset-v11@12.0.1
+package-json-from-dist@1.0.1
+pako@0.2.9
+parse-filepath@1.0.2
+parse-passwd@1.0.0
+parseurl@1.3.3
+pascalcase@0.1.1
+path-exists@4.0.0
+path-is-absolute@1.0.1
+path-key@3.1.1
+path-parse@1.0.7
+path-root@0.1.1
+path-root-regex@0.1.2
+path-scurry@1.11.1
+path-to-regexp@0.1.12
+p-cancelable@0.4.1
+pdfkit@0.11.0
+peek-readable@4.1.0
+pend@1.2.0
+p-event@2.3.1
+p-finally@1.0.0
+pg-connection-string@2.9.1
+picomatch@2.3.1
+picomatch@4.0.3
+pify@2.3.0
+pify@2.3.0
+pify@3.0.0
+pify@3.0.0
+pify@4.0.1
+pinkie@2.0.4
+pinkie-promise@2.0.1
+p-is-promise@1.1.0
+@pkgjs/parseargs@0.11.0
+p-limit@2.3.0
+p-locate@4.1.0
+p-map@4.0.0
+p-map@7.0.3
+png-js@1.0.0
+portscanner@2.2.0
+posix-character-classes@0.1.1
+possible-typed-array-names@1.1.0
+prebuild-install@5.3.6
+prebuild-install@7.1.3
+prebuild-install@7.1.3
+prepend-http@2.0.0
+pretty-bytes@4.0.2
+process@0.11.10
+process-nextick-args@2.0.1
+proc-log@5.0.0
+prom-client@14.2.0
+promise@7.3.1
+promise-inflight@1.0.1
+promise-retry@2.0.1
+proper-lockfile@1.2.0
+proxy-addr@2.0.7
+p-timeout@2.0.1
+p-try@2.2.0
+pug@3.0.3
+pug-attrs@3.0.0
+pug-code-gen@3.0.3
+pug-error@2.1.0
+pug-filters@4.0.0
+pug-lexer@5.0.1
+pug-linker@4.0.0
+pug-load@3.0.0
+pug-parser@6.0.0
+pug-runtime@3.0.1
+pug-strip-comments@2.0.0
+pug-walk@2.0.0
+pump@3.0.3
+qs@6.13.0
+query-string@5.1.1
+range_check@2.0.4
+range-parser@1.2.1
+raw-body@2.5.2
+rc@1.2.8
+readable-stream@1.0.34
+readable-stream@2.3.8
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@3.6.2
+readable-stream@4.7.0
+readable-web-to-node-stream@3.0.4
+readdirp@3.5.0
+rechoir@0.7.1
+recursedir-comparisons@0.0.0
+regex-not@1.0.2
+regexp.prototype.flags@1.5.4
+remove-trailing-separator@1.1.0
+repeat-element@1.1.4
+repeat-string@1.6.1
+replace@1.2.2
+require-directory@2.1.1
+require-main-filename@2.0.0
+resolve@1.22.10
+resolve-dir@1.0.1
+resolve-url@0.2.1
+responselike@1.0.2
+restructure@2.0.1
+ret@0.1.15
+retry@0.10.1
+retry@0.12.0
+retry-as-promised@7.1.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@2.7.1
+rimraf@3.0.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.1.2
+safe-buffer@5.2.1
+safer-buffer@2.1.2
+safe-regex@1.1.0
+safe-regex-test@1.1.0
+safe-stable-stringify@2.5.0
+samsam@1.1.2
+sanitize-filename@1.6.3
+sanitize-html@1.4.2
+sax@1.4.1
+@scarf/scarf@1.4.0
+@scure/base@1.1.9
+@scure/bip32@1.4.0
+@scure/bip39@1.3.0
+seek-bzip@1.0.6
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@5.7.2
+semver@7.7.2
+send@0.19.0
+sequelize@6.37.7
+sequelize-pool@7.1.0
+serve-index@1.9.1
+serve-static@1.16.2
+set-blocking@2.0.0
+set-function-length@1.2.2
+set-function-name@2.0.2
+setimmediate@1.0.5
+setprototypeof@1.1.0
+setprototypeof@1.2.0
+set-value@2.0.1
+shebang-command@2.0.0
+shebang-regex@3.0.0
+side-channel@1.1.0
+side-channel-list@1.0.0
+side-channel-map@1.0.1
+side-channel-weakmap@1.0.2
+signal-exit@3.0.7
+signal-exit@4.1.0
+simple-concat@1.0.1
+simple-get@3.1.1
+simple-get@4.0.1
+simple-get@4.0.1
+simple-swizzle@0.2.2
+@sindresorhus/is@0.7.0
+sinon@1.17.7
+smart-buffer@4.2.0
+snapdragon@0.8.2
+snapdragon-node@2.1.1
+snapdragon-util@3.0.1
+socket.io@3.1.2
+socket.io-adapter@2.1.0
+socket.io-parser@4.0.5
+socks@2.8.7
+socks-proxy-agent@6.2.1
+socks-proxy-agent@8.0.5
+sort-keys@1.1.2
+sort-keys@2.0.0
+sort-keys-length@1.0.1
+source-map@0.5.7
+source-map@0.6.1
+source-map-resolve@0.5.3
+source-map-support@0.5.21
+source-map-url@0.4.1
+split-string@3.1.0
+sprintf-js@1.0.3
+sprintf-js@1.1.3
+sqlite3@5.1.7
+ssri@12.0.0
+ssri@8.0.1
+stack-trace@0.0.10
+static-extend@0.1.2
+statuses@1.5.0
+statuses@2.0.1
+stop-iteration-iterator@1.1.0
+stream-buffers@2.2.0
+streamsearch@1.1.0
+strict-uri-encode@1.1.0
+string_decoder@0.10.31
+string_decoder@1.1.1
+string_decoder@1.3.0
+string.fromcodepoint@0.2.1
+string.prototype.codepointat@0.2.1
+string-width@1.0.2
+string-width@2.1.1
+string-width@4.2.3
+string-width@4.2.3
+string-width@5.1.2
+string-width@5.1.2
+strip-ansi@3.0.1
+strip-ansi@3.0.1
+strip-ansi@4.0.0
+strip-ansi@6.0.1
+strip-ansi@6.0.1
+strip-ansi@7.1.0
+strip-ansi@7.1.0
+strip-bom@3.0.0
+strip-dirs@2.1.0
+strip-json-comments@2.0.1
+strip-json-comments@2.0.1
+strip-outer@1.0.1
+strtok3@6.3.0
+supports-color@2.0.0
+supports-color@5.5.0
+supports-color@7.2.0
+supports-preserve-symlinks-flag@1.0.0
+svg-captcha@1.4.0
+swagger-ui-dist@5.28.1
+swagger-ui-express@5.0.1
+@swc/helpers@0.3.17
+tar@4.4.19
+tar@6.2.1
+tar@7.4.3
+tar-fs@2.1.3
+tar-stream@1.6.2
+tar-stream@2.2.0
+tdigest@0.1.2
+text-hex@1.0.0
+thirty-two@1.0.2
+through@2.3.8
+timed-out@4.0.1
+tinyglobby@0.2.14
+tiny-inflate@1.0.3
+to-buffer@1.2.1
+toidentifier@1.0.1
+@tokenizer/token@0.3.0
+token-stream@1.0.0
+token-types@4.2.1
+to-object-path@0.3.0
+@tootallnate/once@1.1.2
+@tootallnate/once@2.0.0
+toposort-class@1.0.1
+to-regex@3.0.2
+to-regex-range@2.1.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+to-regex-range@5.0.1
+tr46@0.0.3
+traverse@0.3.9
+tree-kill@1.2.2
+trim-repeated@1.0.0
+triple-beam@1.4.1
+truncate-utf8-bytes@1.0.2
+tsconfig@7.0.0
+tslib@2.7.0
+ts-node@9.1.1
+ts-node-dev@1.1.8
+tunnel-agent@0.6.0
+typecast@0.0.1
+typedarray@0.0.6
+typed-array-buffer@1.0.3
+type-is@1.6.18
+@types/component-emitter@1.2.14
+@types/cookie@0.4.1
+@types/cors@2.8.19
+typescript@5.3.3
+@types/debug@4.1.12
+@types/ms@2.1.0
+@types/node@20.19.12
+@types/node@22.7.5
+@types/strip-bom@3.0.0
+@types/strip-json-comments@0.0.30
+@types/triple-beam@1.3.5
+@types/validator@13.15.3
+@types/ws@8.5.3
+tzdata@2025b
+uglify-js@3.19.3
+unbzip2-stream@1.4.3
+unc-path-regex@0.1.2
+underscore.string@3.3.6
+undici-types@6.19.8
+undici-types@6.21.0
+unicode-properties@1.4.1
+unicode-trie@2.0.0
+union-value@1.0.1
+unique-filename@1.1.1
+unique-filename@4.0.0
+unique-slug@2.0.2
+unique-slug@5.0.0
+unit-compare@1.0.1
+universalify@2.0.1
+unpipe@1.0.0
+unset-value@1.0.0
+untildify@2.1.0
+unzipper@0.9.15
+urix@0.1.0
+url-parse-lax@3.0.0
+url-to-options@1.0.1
+use@3.1.1
+utf8-byte-length@1.0.5
+util@0.12.5
+util-deprecate@1.0.2
+utils-merge@1.0.1
+uuid@8.3.2
+v8flags@3.2.0
+validate@4.5.1
+validator@13.15.15
+vary@1.1.2
+vm2@3.9.17
+void-elements@3.1.0
+walk@2.3.15
+walkdir@0.0.11
+web3@4.16.0
+web3-core@4.7.1
+web3-errors@1.3.1
+web3-eth@4.11.1
+web3-eth-abi@4.4.1
+web3-eth-accounts@4.3.1
+web3-eth-contract@4.7.2
+web3-eth-ens@4.4.0
+web3-eth-iban@4.0.7
+web3-eth-personal@4.1.0
+web3-net@4.1.0
+web3-providers-http@4.2.0
+web3-providers-ipc@4.0.7
+web3-providers-ws@4.0.8
+web3-rpc-methods@1.3.0
+web3-rpc-providers@1.0.0-rc.4
+web3-types@1.10.0
+web3-utils@4.3.3
+web3-validator@2.0.6
+webidl-conversions@3.0.1
+whatwg-url@5.0.0
+which@1.3.1
+which@2.0.2
+which@5.0.0
+which-boxed-primitive@1.1.1
+which-collection@1.0.2
+which-module@2.0.1
+which-pm-runs@1.1.0
+which-typed-array@1.1.19
+wide-align@1.1.3
+wide-align@1.1.5
+winston@3.17.0
+winston-transport@4.9.0
+with@7.0.2
+wkx@0.5.0
+wordwrap@0.0.3
+wordwrap@1.0.0
+wrap-ansi@6.2.0
+wrap-ansi@7.0.0
+wrap-ansi@8.1.0
+wrappy@1.0.2
+ws@7.4.6
+ws@8.17.1
+xtend@4.0.2
+y18n@4.0.3
+yallist@3.1.1
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@4.0.0
+yallist@5.0.0
+yaml-schema-validator@1.2.3
+yargs@15.4.1
+yargs-parser@18.1.3
+yauzl@2.10.0
+yn@3.1.1
+z85@0.0.2
+zip-stream@1.2.0
+zod@3.25.76
diff --git a/labs/lab4/syft/grype-vuln-results.json b/labs/lab4/syft/grype-vuln-results.json
new file mode 100644
index 00000000..971f7c9d
--- /dev/null
+++ b/labs/lab4/syft/grype-vuln-results.json
@@ -0,0 +1 @@
+{"matches":[{"vulnerability":{"id":"GHSA-2p57-rm9w-gvfp","dataSource":"https://github.com/advisories/GHSA-2p57-rm9w-gvfp","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-29415","https://github.com/indutny/node-ip/issues/150","https://github.com/indutny/node-ip/pull/143","https://github.com/indutny/node-ip/pull/144","https://security.netapp.com/advisory/ntap-20250117-0010"],"description":"ip SSRF improper categorization in isPublic","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29415","epss":0.86505,"percentile":0.99409,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-29415","cwe":"CWE-918","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2024-29415","cwe":"CWE-941","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":67.4739},"relatedVulnerabilities":[{"id":"CVE-2024-29415","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-29415","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/indutny/node-ip/issues/150","https://github.com/indutny/node-ip/pull/143","https://github.com/indutny/node-ip/pull/144","https://security.netapp.com/advisory/ntap-20250117-0010/"],"description":"The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.1,"exploitabilityScore":2.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-29415","epss":0.86505,"percentile":0.99409,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-29415","cwe":"CWE-918","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"},{"cve":"CVE-2024-29415","cwe":"CWE-941","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ip","version":"2.0.1"}},"found":{"vulnerabilityID":"GHSA-2p57-rm9w-gvfp","versionConstraint":"<=2.0.1 (semantic)"}}],"artifact":{"id":"80c437d1f8f690a8","name":"ip","version":"2.0.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/ip/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ip/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:fedorindutny:ip:2.0.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ip@2.0.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-whpj-8f3w-67p5","dataSource":"https://github.com/advisories/GHSA-whpj-8f3w-67p5","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5","https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf","https://github.com/patriksimek/vm2/releases/tag/3.9.18","https://nvd.nist.gov/vuln/detail/CVE-2023-32314","https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac"],"description":"vm2 Sandbox Escape vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32314","epss":0.69875,"percentile":0.98648,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-32314","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.9.18"],"state":"fixed","available":[{"version":"3.9.18","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":65.6825},"relatedVulnerabilities":[{"id":"CVE-2023-32314","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32314","namespace":"nvd:cpe","severity":"Critical","urls":["https://gist.github.com/arkark/e9f5cf5782dec8321095be3e52acf5ac","https://github.com/patriksimek/vm2/commit/d88105f99752305c5b8a77b63ddee3ec86912daf","https://github.com/patriksimek/vm2/releases/tag/3.9.18","https://github.com/patriksimek/vm2/security/advisories/GHSA-whpj-8f3w-67p5"],"description":"vm2 is a sandbox that can run untrusted code with Node's built-in modules. A sandbox escape vulnerability exists in vm2 for versions up to and including 3.9.17. It abuses an unexpected creation of a host object based on the specification of `Proxy`. As a result a threat actor can bypass the sandbox protections to gain remote code execution rights on the host running the sandbox. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. There are no known workarounds for this vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32314","epss":0.69875,"percentile":0.98648,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-32314","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-whpj-8f3w-67p5","versionConstraint":"<3.9.18 (semantic)"},"fix":{"suggestedVersion":"3.9.18"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-g644-9gfx-q4q4","dataSource":"https://github.com/advisories/GHSA-g644-9gfx-q4q4","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4","https://nvd.nist.gov/vuln/detail/CVE-2023-37903","https://security.netapp.com/advisory/ntap-20230831-0007","https://security.netapp.com/advisory/ntap-20241108-0002"],"description":"vm2 Sandbox Escape vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37903","epss":0.39234,"percentile":0.97222,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-37903","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-37903","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":36.879960000000004},"relatedVulnerabilities":[{"id":"CVE-2023-37903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37903","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-g644-9gfx-q4q4","https://security.netapp.com/advisory/ntap-20230831-0007/","https://security.netapp.com/advisory/ntap-20241108-0002/"],"description":"vm2 is an open source vm/sandbox for Node.js. In vm2 for versions up to and including 3.9.19, Node.js custom inspect function allows attackers to escape the sandbox and run arbitrary code. This may result in Remote Code Execution, assuming the attacker has arbitrary code execution primitive inside the context of vm2 sandbox. There are no patches and no known workarounds. Users are advised to find an alternative software.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37903","epss":0.39234,"percentile":0.97222,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-37903","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-37903","cwe":"CWE-78","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-g644-9gfx-q4q4","versionConstraint":"<=3.9.19 (semantic)"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-c7hr-j4mj-j2w6","dataSource":"https://github.com/advisories/GHSA-c7hr-j4mj-j2w6","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-9235","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://www.npmjs.com/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html"],"description":"Verification Bypass in jsonwebtoken","cvss":[],"epss":[{"cve":"CVE-2015-9235","epss":0.3247,"percentile":0.96781,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2015-9235","cwe":"CWE-20","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2015-9235","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.2"],"state":"fixed","available":[{"version":"4.2.2","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":29.223},"relatedVulnerabilities":[{"id":"CVE-2015-9235","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-9235","namespace":"nvd:cpe","severity":"Critical","urls":["https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://nodesecurity.io/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html"],"description":"In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-9235","epss":0.3247,"percentile":0.96781,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2015-9235","cwe":"CWE-20","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2015-9235","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-c7hr-j4mj-j2w6","versionConstraint":"<4.2.2 (semantic)"},"fix":{"suggestedVersion":"4.2.2"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-c7hr-j4mj-j2w6","dataSource":"https://github.com/advisories/GHSA-c7hr-j4mj-j2w6","namespace":"github:language:javascript","severity":"Critical","urls":["https://nvd.nist.gov/vuln/detail/CVE-2015-9235","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://www.npmjs.com/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html"],"description":"Verification Bypass in jsonwebtoken","cvss":[],"epss":[{"cve":"CVE-2015-9235","epss":0.3247,"percentile":0.96781,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2015-9235","cwe":"CWE-20","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2015-9235","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.2"],"state":"fixed","available":[{"version":"4.2.2","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":29.223},"relatedVulnerabilities":[{"id":"CVE-2015-9235","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2015-9235","namespace":"nvd:cpe","severity":"Critical","urls":["https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://github.com/auth0/node-jsonwebtoken/commit/1bb584bc382295eeb7ee8c4452a673a77a68b687","https://nodesecurity.io/advisories/17","https://www.timmclean.net/2015/02/25/jwt-alg-none.html"],"description":"In jsonwebtoken node module before 4.2.2 it is possible for an attacker to bypass verification when a token digitally signed with an asymmetric key (RS/ES family) of algorithms but instead the attacker send a token digitally signed with a symmetric algorithm (HS* family).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2015-9235","epss":0.3247,"percentile":0.96781,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2015-9235","cwe":"CWE-20","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2015-9235","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-c7hr-j4mj-j2w6","versionConstraint":"<4.2.2 (semantic)"},"fix":{"suggestedVersion":"4.2.2"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-cchq-frgv-rjh5","dataSource":"https://github.com/advisories/GHSA-cchq-frgv-rjh5","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5","https://nvd.nist.gov/vuln/detail/CVE-2023-37466","https://gist.github.com/leesh3288/f693061e6523c97274ad5298eb2c74e9","https://security.netapp.com/advisory/ntap-20230831-0007","https://security.netapp.com/advisory/ntap-20241108-0002","https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744","https://github.com/patriksimek/vm2/releases/tag/v3.10.0"],"description":"vm2 Sandbox Escape vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37466","epss":0.04997,"percentile":0.89561,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-37466","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-37466","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["3.10.0"],"state":"fixed","available":[{"version":"3.10.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":4.69718},"relatedVulnerabilities":[{"id":"CVE-2023-37466","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-37466","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/patriksimek/vm2/commit/d9a1fde8ec5a5a9c9e5a69bf91d703950859d744","https://github.com/patriksimek/vm2/releases/tag/v3.10.0","https://github.com/patriksimek/vm2/security/advisories/GHSA-cchq-frgv-rjh5","https://security.netapp.com/advisory/ntap-20241108-0002/"],"description":"vm2 is an advanced vm/sandbox for Node.js. The library contains critical security issues and should not be used for production. The maintenance of the project has been discontinued. In vm2 for versions up to 3.9.19, `Promise` handler sanitization can be bypassed with the `@@species` accessor property allowing attackers to escape the sandbox and run arbitrary code, potentially allowing remote code execution inside the context of vm2 sandbox. Version 3.10.0 contains a patch for the issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-37466","epss":0.04997,"percentile":0.89561,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-37466","cwe":"CWE-94","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-37466","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-cchq-frgv-rjh5","versionConstraint":"<=3.9.19 (semantic)"},"fix":{"suggestedVersion":"3.10.0"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-8hfj-j24r-96c4","dataSource":"https://github.com/advisories/GHSA-8hfj-j24r-96c4","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","https://nvd.nist.gov/vuln/detail/CVE-2022-24785","https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5","https://www.tenable.com/security/tns-2022-09","https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5","https://security.netapp.com/advisory/ntap-20220513-0006","https://security.netapp.com/advisory/ntap-20241108-0002"],"description":"Path Traversal: 'dir/../../filename' in moment.locale","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24785","epss":0.02206,"percentile":0.84231,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-27","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.29.2"],"state":"fixed","available":[{"version":"2.29.2","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":1.6545},"relatedVulnerabilities":[{"id":"CVE-2022-24785","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-24785","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moment/moment/commit/4211bfc8f15746be4019bba557e29a7ba83d54c5","https://github.com/moment/moment/security/advisories/GHSA-8hfj-j24r-96c4","https://lists.debian.org/debian-lts-announce/2023/01/msg00035.html","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6QIO6YNLTK2T7SPKDS4JEL45FANLNC2Q/","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/ORJX2LF6KMPIHP6B2P6KZIVKMLE3LVJ5/","https://security.netapp.com/advisory/ntap-20220513-0006/","https://www.tenable.com/security/tns-2022-09","https://security.netapp.com/advisory/ntap-20241108-0002/"],"description":"Moment.js is a JavaScript date library for parsing, validating, manipulating, and formatting dates. A path traversal vulnerability impacts npm (server) users of Moment.js between versions 1.0.1 and 2.29.1, especially if a user-provided locale string is directly used to switch moment locale. This problem is patched in 2.29.2, and the patch can be applied to all affected versions. As a workaround, sanitize the user-provided locale name before passing it to Moment.js.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-24785","epss":0.02206,"percentile":0.84231,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-27","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-24785","cwe":"CWE-22","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-8hfj-j24r-96c4","versionConstraint":"<2.29.2 (semantic)"},"fix":{"suggestedVersion":"2.29.2"}}],"artifact":{"id":"fb07dad56d7726f5","name":"moment","version":"2.0.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:momentjs:moment:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-p6mc-m468-83gw","dataSource":"https://github.com/advisories/GHSA-p6mc-m468-83gw","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/lodash/lodash/issues/4744","https://github.com/lodash/lodash/commit/c84fe82760fb2d3e03a63379b297a1cc1a2fce12","https://nvd.nist.gov/vuln/detail/CVE-2020-8203","https://hackerone.com/reports/712065","https://github.com/lodash/lodash/issues/4874","https://github.com/github/advisory-database/pull/2884","https://hackerone.com/reports/864701","https://github.com/lodash/lodash/wiki/Changelog#v41719","https://web.archive.org/web/20210914001339/https://github.com/lodash/lodash/issues/4744","https://security.netapp.com/advisory/ntap-20200724-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2020-8203.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.01978,"percentile":0.83383,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":1.4736099999999999},"relatedVulnerabilities":[{"id":"CVE-2020-8203","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-8203","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/lodash/lodash/issues/4874","https://hackerone.com/reports/712065","https://security.netapp.com/advisory/ntap-20200724-0006/","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuApr2021.html","https://www.oracle.com/security-alerts/cpuapr2022.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:P","metrics":{"baseScore":5.8,"exploitabilityScore":8.6,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-8203","epss":0.01978,"percentile":0.83383,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2020-8203","cwe":"CWE-770","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2020-8203","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash.set","version":"4.3.2"}},"found":{"vulnerabilityID":"GHSA-p6mc-m468-83gw","versionConstraint":">=3.7.0,<=4.3.2 (semantic)"}}],"artifact":{"id":"be8f210a7cd0fab3","name":"lodash.set","version":"4.3.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/lodash.set/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/lodash.set/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash.set:lodash.set:4.3.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/lodash.set@4.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-r7qp-cfhv-p84w","dataSource":"https://github.com/advisories/GHSA-r7qp-cfhv-p84w","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w","https://nvd.nist.gov/vuln/detail/CVE-2022-41940","https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6","https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085"],"description":"Uncaught exception in engine.io","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-41940","epss":0.0231,"percentile":0.8456,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-41940","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.2.1"],"state":"fixed","available":[{"version":"6.2.1","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":1.32825},"relatedVulnerabilities":[{"id":"CVE-2022-41940","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-41940","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/socketio/engine.io/commit/425e833ab13373edf1dd5a0706f07100db14e3c6","https://github.com/socketio/engine.io/commit/83c4071af871fc188298d7d591e95670bf9f9085","https://github.com/socketio/engine.io/security/advisories/GHSA-r7qp-cfhv-p84w"],"description":"Engine.IO is the implementation of transport-based cross-browser/cross-device bi-directional communication layer for Socket.IO. A specially crafted HTTP request can trigger an uncaught exception on the Engine.IO server, thus killing the Node.js process. This impacts all the users of the engine.io package, including those who uses depending packages like socket.io. There is no known workaround except upgrading to a safe version. There are patches for this issue released in versions 3.6.1 and 6.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:L/A:H","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-41940","epss":0.0231,"percentile":0.8456,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-41940","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"engine.io","version":"4.1.2"}},"found":{"vulnerabilityID":"GHSA-r7qp-cfhv-p84w","versionConstraint":">=4.0.0,<6.2.1 (semantic)"},"fix":{"suggestedVersion":"6.2.1"}}],"artifact":{"id":"8c4af4f22e5de7e4","name":"engine.io","version":"4.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/engine.io/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:socket:engine.io:4.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/engine.io@4.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-jf85-cpcp-j695","dataSource":"https://github.com/advisories/GHSA-jf85-cpcp-j695","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/lodash/lodash/pull/4336","https://nvd.nist.gov/vuln/detail/CVE-2019-10744","https://snyk.io/vuln/SNYK-JS-LODASH-450202","https://access.redhat.com/errata/RHSA-2019:3024","https://support.f5.com/csp/article/K47105354?utm_source=f5support&utm_medium=RSS","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html","https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS","https://security.netapp.com/advisory/ntap-20191004-0005","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2019-10744.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10744","epss":0.01196,"percentile":0.78713,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-10744","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.12"],"state":"fixed","available":[{"version":"4.17.12","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":1.08238},"relatedVulnerabilities":[{"id":"CVE-2019-10744","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-10744","namespace":"nvd:cpe","severity":"Critical","urls":["https://access.redhat.com/errata/RHSA-2019:3024","https://security.netapp.com/advisory/ntap-20191004-0005/","https://snyk.io/vuln/SNYK-JS-LODASH-450202","https://support.f5.com/csp/article/K47105354?utm_source=f5support&%3Butm_medium=RSS","https://www.oracle.com/security-alerts/cpujan2021.html","https://www.oracle.com/security-alerts/cpuoct2020.html"],"description":"Versions of lodash lower than 4.17.12 are vulnerable to Prototype Pollution. The function defaultsDeep could be tricked into adding or modifying properties of Object.prototype using a constructor payload.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:P","metrics":{"baseScore":6.4,"exploitabilityScore":10,"impactScore":5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-10744","epss":0.01196,"percentile":0.78713,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-10744","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-jf85-cpcp-j695","versionConstraint":"<4.17.12 (semantic)"},"fix":{"suggestedVersion":"4.17.12"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-87vv-r9j6-g5qv","dataSource":"https://github.com/advisories/GHSA-87vv-r9j6-g5qv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-4055","https://www.npmjs.com/advisories/55","https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731@%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49@%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2@%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854@%3Cuser.flink.apache.org%3E","https://www.tenable.com/security/tns-2019-02","http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/95849"],"description":"Regular Expression Denial of Service in moment","cvss":[{"type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-4055","epss":0.01876,"percentile":0.82916,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2016-4055","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.11.2"],"state":"fixed","available":[{"version":"2.11.2","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":1.0786999999999998},"relatedVulnerabilities":[{"id":"CVE-2016-4055","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-4055","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.openwall.com/lists/oss-security/2016/04/20/11","http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","http://www.securityfocus.com/bid/95849","https://lists.apache.org/thread.html/10f0f3aefd51444d1198c65f44ffdf2d78ca3359423dbc1c168c9731%40%3Cdev.flink.apache.org%3E","https://lists.apache.org/thread.html/17ff53f7999e74fbe3cc0ceb4e1c3b00b180b7c5afec8e978837bc49%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/52bafac05ad174000ea465fe275fd3cc7bd5c25535a7631c0bc9bfb2%40%3Cuser.flink.apache.org%3E","https://lists.apache.org/thread.html/54df3aeb4239b64b50b356f0ca6f986e3c4ca5b84c515dce077c7854%40%3Cuser.flink.apache.org%3E","https://nodesecurity.io/advisories/55","https://www.tenable.com/security/tns-2019-02"],"description":"The duration function in the moment package before 2.11.2 for Node.js allows remote attackers to cause a denial of service (CPU consumption) via a long string, aka a \"regular expression Denial of Service (ReDoS).\"","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","metrics":{"baseScore":7.8,"exploitabilityScore":10,"impactScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-4055","epss":0.01876,"percentile":0.82916,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2016-4055","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-87vv-r9j6-g5qv","versionConstraint":"<2.11.2 (semantic)"},"fix":{"suggestedVersion":"2.11.2"}}],"artifact":{"id":"fb07dad56d7726f5","name":"moment","version":"2.0.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:momentjs:moment:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xwcq-pm8m-c4vf","dataSource":"https://github.com/advisories/GHSA-xwcq-pm8m-c4vf","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf","https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a","https://nvd.nist.gov/vuln/detail/CVE-2023-46233","https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html"],"description":"crypto-js PBKDF2 1,000 times weaker than specified in 1993 and 1.3M times weaker than current standard","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-46233","epss":0.00823,"percentile":0.74244,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-46233","cwe":"CWE-328","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-46233","cwe":"CWE-916","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-46233","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.0"],"state":"fixed","available":[{"version":"4.2.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.744815},"relatedVulnerabilities":[{"id":"CVE-2023-46233","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-46233","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/brix/crypto-js/commit/421dd538b2d34e7c24a5b72cc64dc2b9167db40a","https://github.com/brix/crypto-js/security/advisories/GHSA-xwcq-pm8m-c4vf","https://lists.debian.org/debian-lts-announce/2023/11/msg00025.html"],"description":"crypto-js is a JavaScript library of crypto standards. Prior to version 4.2.0, crypto-js PBKDF2 is 1,000 times weaker than originally specified in 1993, and at least 1,300,000 times weaker than current industry standard. This is because it both defaults to SHA1, a cryptographic hash algorithm considered insecure since at least 2005, and defaults to one single iteration, a 'strength' or 'difficulty' value specified at 1,000 when specified in 1993. PBKDF2 relies on iteration count as a countermeasure to preimage and collision attacks. If used to protect passwords, the impact is high. If used to generate signatures, the impact is high. Version 4.2.0 contains a patch for this issue. As a workaround, configure crypto-js to use SHA256 with at least 250,000 iterations.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-46233","epss":0.00823,"percentile":0.74244,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-46233","cwe":"CWE-328","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-46233","cwe":"CWE-916","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-46233","cwe":"CWE-327","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"crypto-js","version":"3.3.0"}},"found":{"vulnerabilityID":"GHSA-xwcq-pm8m-c4vf","versionConstraint":"<4.2.0 (semantic)"},"fix":{"suggestedVersion":"4.2.0"}}],"artifact":{"id":"c00a8b8b043aae72","name":"crypto-js","version":"3.3.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/crypto-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crypto-js/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:crypto-js:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto-js:crypto_js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto_js:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto_js:crypto_js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:crypto:crypto_js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:brix:crypto-js:3.3.0:*:*:*:*:*:*:*","cpe:2.3:a:brix:crypto_js:3.3.0:*:*:*:*:*:*:*"],"purl":"pkg:npm/crypto-js@3.3.0","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-15467","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15467","namespace":"debian:distro:debian:12","severity":"Critical","urls":[],"description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with maliciously crafted AEAD parameters can trigger a stack buffer overflow. Impact summary: A stack buffer overflow may lead to a crash, causing Denial of Service, or potentially remote code execution. When parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as AES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is copied into a fixed-size stack buffer without verifying that its length fits the destination. An attacker can supply a crafted CMS message with an oversized IV, causing a stack-based out-of-bounds write before any authentication or tag verification occurs. Applications and services that parse untrusted CMS or PKCS#7 content using AEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable. Because the overflow occurs prior to authentication, no valid key material is required to trigger it. While exploitability to remote code execution depends on platform and toolchain mitigations, the stack-based write primitive represents a severe risk. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue. OpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15467","epss":0.00766,"percentile":0.73257,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.7200400000000001},"relatedVulnerabilities":[{"id":"CVE-2025-15467","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15467","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/openssl/openssl/commit/2c8f0e5fa9b6ee5508a0349e4572ddb74db5a703","https://github.com/openssl/openssl/commit/5f26d4202f5b89664c5c3f3c62086276026ba9a9","https://github.com/openssl/openssl/commit/6ced0fe6b10faa560e410e3ee8d6c82f06c65ea3","https://github.com/openssl/openssl/commit/ce39170276daec87f55c39dad1f629b56344429e","https://github.com/openssl/openssl/commit/d0071a0799f20cc8101730145349ed4487c268dc","https://openssl-library.org/news/secadv/20260127.txt","http://www.openwall.com/lists/oss-security/2026/01/27/10","http://www.openwall.com/lists/oss-security/2026/02/25/6"],"description":"Issue summary: Parsing CMS AuthEnvelopedData or EnvelopedData message with\nmaliciously crafted AEAD parameters can trigger a stack buffer overflow.\n\nImpact summary: A stack buffer overflow may lead to a crash, causing Denial\nof Service, or potentially remote code execution.\n\nWhen parsing CMS (Auth)EnvelopedData structures that use AEAD ciphers such as\nAES-GCM, the IV (Initialization Vector) encoded in the ASN.1 parameters is\ncopied into a fixed-size stack buffer without verifying that its length fits\nthe destination. An attacker can supply a crafted CMS message with an\noversized IV, causing a stack-based out-of-bounds write before any\nauthentication or tag verification occurs.\n\nApplications and services that parse untrusted CMS or PKCS#7 content using\nAEAD ciphers (e.g., S/MIME (Auth)EnvelopedData with AES-GCM) are vulnerable.\nBecause the overflow occurs prior to authentication, no valid key material\nis required to trigger it. While exploitability to remote code execution\ndepends on platform and toolchain mitigations, the stack-based write\nprimitive represents a severe risk.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3 and 3.0 are vulnerable to this issue.\n\nOpenSSL 1.1.1 and 1.0.2 are not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15467","epss":0.00766,"percentile":0.73257,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-15467","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-15467","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-rm97-x556-q36h","dataSource":"https://github.com/advisories/GHSA-rm97-x556-q36h","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-21501","https://github.com/apostrophecms/sanitize-html/pull/650","https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4","https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf","https://github.com/apostrophecms/apostrophe/discussions/4436","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S"],"description":"sanitize-html Information Exposure vulnerability","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21501","epss":0.01341,"percentile":0.79837,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-21501","cwe":"CWE-200","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21501","cwe":"CWE-538","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["2.12.1"],"state":"fixed","available":[{"version":"2.12.1","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.690615},"relatedVulnerabilities":[{"id":"CVE-2024-21501","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-21501","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/Slonser/8b4d061abe6ee1b2e10c7242987674cf","https://github.com/apostrophecms/apostrophe/discussions/4436","https://github.com/apostrophecms/sanitize-html/commit/c5dbdf77fe8b836d3bf4554ea39edb45281ec0b4","https://github.com/apostrophecms/sanitize-html/pull/650","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/4EB5JPYRCTS64EA5AMV3INHDPI6I4AW7/","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/P4I5X6V3LYUNBMZ5YOW4BV427TH3IK4S/","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-6276557","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-6256334"],"description":"Versions of the package sanitize-html before 2.12.1 are vulnerable to Information Exposure when used on the backend and with the style attribute allowed, allowing enumeration of files in the system (including project dependencies). An attacker could exploit this vulnerability to gather details about the file system structure and dependencies of the targeted server.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-21501","epss":0.01341,"percentile":0.79837,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-21501","cwe":"CWE-200","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2024-21501","cwe":"CWE-538","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-rm97-x556-q36h","versionConstraint":"<2.12.1 (semantic)"},"fix":{"suggestedVersion":"2.12.1"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3h5v-q93c-6h6q","dataSource":"https://github.com/advisories/GHSA-3h5v-q93c-6h6q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q","https://github.com/websockets/ws/issues/2230","https://github.com/websockets/ws/pull/2231","https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f","https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e","https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c","https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63"],"description":"ws affected by a DoS when handling a request with many HTTP headers","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37890","epss":0.00541,"percentile":0.67381,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-37890","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["7.5.10"],"state":"fixed","available":[{"version":"7.5.10","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.42198},"relatedVulnerabilities":[{"id":"CVE-2024-37890","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-37890","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/websockets/ws/commit/22c28763234aa75a7e1b76f5c01c181260d7917f","https://github.com/websockets/ws/commit/4abd8f6de4b0b65ef80b3ff081989479ed93377e","https://github.com/websockets/ws/commit/e55e5106f10fcbaac37cfa89759e4cc0d073a52c","https://github.com/websockets/ws/commit/eeb76d313e2a00dd5247ca3597bba7877d064a63","https://github.com/websockets/ws/issues/2230","https://github.com/websockets/ws/pull/2231","https://github.com/websockets/ws/security/advisories/GHSA-3h5v-q93c-6h6q","https://nodejs.org/api/http.html#servermaxheaderscount"],"description":"ws is an open source WebSocket client and server for Node.js. A request with a number of headers exceeding theserver.maxHeadersCount threshold could be used to crash a ws server. The vulnerability was fixed in ws@8.17.1 (e55e510) and backported to ws@7.5.10 (22c2876), ws@6.2.3 (eeb76d3), and ws@5.2.4 (4abd8f6). In vulnerable versions of ws, the issue can be mitigated in the following ways: 1. Reduce the maximum allowed length of the request headers using the --max-http-header-size=size and/or the maxHeaderSize options so that no more headers than the server.maxHeadersCount limit can be sent. 2. Set server.maxHeadersCount to 0 so that no limit is applied.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-37890","epss":0.00541,"percentile":0.67381,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-37890","cwe":"CWE-476","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"ws","version":"7.4.6"}},"found":{"vulnerabilityID":"GHSA-3h5v-q93c-6h6q","versionConstraint":">=7.0.0,<7.5.10 (semantic)"},"fix":{"suggestedVersion":"7.5.10"}}],"artifact":{"id":"670482146c83d660","name":"ws","version":"7.4.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/ws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/ws/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:ws_project:ws:7.4.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/ws@7.4.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-pfrx-2q88-qq97","dataSource":"https://github.com/advisories/GHSA-pfrx-2q88-qq97","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-33987","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/commit/861ccd9ac2237df762a9e2beed7edd88c60782dc","https://github.com/sindresorhus/got/releases/tag/v11.8.5","https://github.com/sindresorhus/got/releases/tag/v12.1.0"],"description":"Got allows a redirect to a UNIX socket","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.00807,"percentile":0.73994,"date":"2026-03-01"}],"fix":{"versions":["11.8.5"],"state":"fixed","available":[{"version":"11.8.5","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.41560500000000006},"relatedVulnerabilities":[{"id":"CVE-2022-33987","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-33987","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/sindresorhus/got/compare/v12.0.3...v12.1.0","https://github.com/sindresorhus/got/pull/2047","https://github.com/sindresorhus/got/releases/tag/v11.8.5"],"description":"The got package before 12.1.0 (also fixed in 11.8.5) for Node.js allows a redirect to a UNIX socket.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-33987","epss":0.00807,"percentile":0.73994,"date":"2026-03-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"got","version":"8.3.2"}},"found":{"vulnerabilityID":"GHSA-pfrx-2q88-qq97","versionConstraint":"<11.8.5 (semantic)"},"fix":{"suggestedVersion":"11.8.5"}}],"artifact":{"id":"5bd1b0995776246c","name":"got","version":"8.3.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/got/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/got/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:got:got:8.3.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/got@8.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-cgfm-xwp7-2cvr","dataSource":"https://github.com/advisories/GHSA-cgfm-xwp7-2cvr","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25887","https://github.com/apostrophecms/sanitize-html/pull/557","https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526"],"description":"Sanitize-html Vulnerable To REDoS Attacks","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25887","epss":0.00447,"percentile":0.6329,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-25887","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.7.1"],"state":"fixed","available":[{"version":"2.7.1","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.33525},"relatedVulnerabilities":[{"id":"CVE-2022-25887","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25887","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/apostrophecms/sanitize-html/commit/b4682c12fd30e12e82fa2d9b766de91d7d2cd23c","https://github.com/apostrophecms/sanitize-html/pull/557","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3008102","https://security.snyk.io/vuln/SNYK-JS-SANITIZEHTML-2957526"],"description":"The package sanitize-html before 2.7.1 are vulnerable to Regular Expression Denial of Service (ReDoS) due to insecure global regular expression replacement logic of HTML comment removal.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25887","epss":0.00447,"percentile":0.6329,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-25887","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-cgfm-xwp7-2cvr","versionConstraint":"<2.7.1 (semantic)"},"fix":{"suggestedVersion":"2.7.1"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-p5gc-c584-jj6v","dataSource":"https://github.com/advisories/GHSA-p5gc-c584-jj6v","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v","https://nvd.nist.gov/vuln/detail/CVE-2023-32313","https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238","https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550","https://github.com/patriksimek/vm2/releases/tag/3.9.18"],"description":"vm2 vulnerable to Inspect Manipulation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32313","epss":0.0057,"percentile":0.68307,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-32313","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.9.18"],"state":"fixed","available":[{"version":"3.9.18","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.29355000000000003},"relatedVulnerabilities":[{"id":"CVE-2023-32313","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32313","namespace":"nvd:cpe","severity":"Medium","urls":["https://gist.github.com/arkark/c1c57eaf3e0a649af1a70c2b93b17550","https://github.com/patriksimek/vm2/commit/5206ba25afd86ef547a2c9d48d46ca7a9e6ec238","https://github.com/patriksimek/vm2/releases/tag/3.9.18","https://github.com/patriksimek/vm2/security/advisories/GHSA-p5gc-c584-jj6v"],"description":"vm2 is a sandbox that can run untrusted code with Node's built-in modules. In versions 3.9.17 and lower of vm2 it was possible to get a read-write reference to the node `inspect` method and edit options for `console.log`. As a result a threat actor can edit options for the `console.log` command. This vulnerability was patched in the release of version `3.9.18` of `vm2`. Users are advised to upgrade. Users unable to upgrade may make the `inspect` method readonly with `vm.readonly(inspect)` after creating a vm.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32313","epss":0.0057,"percentile":0.68307,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-32313","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-p5gc-c584-jj6v","versionConstraint":"<3.9.18 (semantic)"},"fix":{"suggestedVersion":"3.9.18"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-f5x3-32g6-xq36","dataSource":"https://github.com/advisories/GHSA-f5x3-32g6-xq36","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://nvd.nist.gov/vuln/detail/CVE-2024-28863","https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://security.netapp.com/advisory/ntap-20240524-0005"],"description":"Denial of service while parsing a tar file due to lack of folders count validation","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.0045,"percentile":0.63393,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["6.2.1"],"state":"fixed","available":[{"version":"6.2.1","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.2587499999999999},"relatedVulnerabilities":[{"id":"CVE-2024-28863","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-28863","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/fe8cd57da5686f8695415414bda49206a545f7f7","https://github.com/isaacs/node-tar/security/advisories/GHSA-f5x3-32g6-xq36","https://security.netapp.com/advisory/ntap-20240524-0005/"],"description":"node-tar is a Tar for Node.js. node-tar prior to version 6.2.1 has no limit on the number of sub-folders created in the folder creation process. An attacker who generates a large number of sub-folders can consume memory on the system running node-tar and even crash the Node.js client within few seconds of running it using a path with too many sub-folders inside. Version 6.2.1 fixes this issue by preventing extraction in excessively deep sub-folders.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-28863","epss":0.0045,"percentile":0.63393,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-28863","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-28863","cwe":"CWE-770","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-f5x3-32g6-xq36","versionConstraint":"<6.2.1 (semantic)"},"fix":{"suggestedVersion":"6.2.1"}}],"artifact":{"id":"f42c59d94c10b95d","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-35jh-r3h4-6jhm","dataSource":"https://github.com/advisories/GHSA-35jh-r3h4-6jhm","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23337","https://github.com/lodash/lodash/commit/3469357cff396a26c363f8c1b5a91dde28ba4b1c","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js#L14851","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpuoct2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://security.netapp.com/advisory/ntap-20210312-0006","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2021-23337.yml"],"description":"Command Injection in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.00278,"percentile":0.50927,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.21"],"state":"fixed","available":[{"version":"4.17.21","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.20433},"relatedVulnerabilities":[{"id":"CVE-2021-23337","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23337","namespace":"nvd:cpe","severity":"High","urls":["https://cert-portal.siemens.com/productcert/pdf/ssa-637483.pdf","https://github.com/lodash/lodash/blob/ddfd9b11a0126db2302cb70ec9973b66baec0975/lodash.js%23L14851","https://security.netapp.com/advisory/ntap-20210312-0006/","https://snyk.io/vuln/SNYK-JAVA-ORGFUJIONWEBJARS-1074932","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARS-1074930","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWER-1074928","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSBOWERGITHUBLODASH-1074931","https://snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-1074929","https://snyk.io/vuln/SNYK-JS-LODASH-1040724","https://www.oracle.com//security-alerts/cpujul2021.html","https://www.oracle.com/security-alerts/cpujan2022.html","https://www.oracle.com/security-alerts/cpujul2022.html","https://www.oracle.com/security-alerts/cpuoct2021.html"],"description":"Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:P/I:P/A:P","metrics":{"baseScore":6.5,"exploitabilityScore":8,"impactScore":6.5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.2,"exploitabilityScore":1.3,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23337","epss":0.00278,"percentile":0.50927,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2021-23337","cwe":"CWE-94","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-35jh-r3h4-6jhm","versionConstraint":"<4.17.21 (semantic)"},"fix":{"suggestedVersion":"4.17.21"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3j7m-hmh3-9jmp","dataSource":"https://github.com/advisories/GHSA-3j7m-hmh3-9jmp","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2016-1000237","https://github.com/apostrophecms/sanitize-html/issues/29","https://github.com/apostrophecms/sanitize-html/commit/762fbc7bba389f3f789cc291c1eb2b64f60f2caf","https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json","https://github.com/punkave/sanitize-html/issues/29","https://www.npmjs.com/advisories/135"],"description":"Cross-Site Scripting in sanitize-html","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-1000237","epss":0.00328,"percentile":0.55441,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2016-1000237","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.4.3"],"state":"fixed","available":[{"version":"1.4.3","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.18203999999999998},"relatedVulnerabilities":[{"id":"CVE-2016-1000237","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2016-1000237","namespace":"nvd:cpe","severity":"Medium","urls":["https://nodesecurity.io/advisories/135","https://raw.githubusercontent.com/distributedweaknessfiling/cvelist/master/2016/1000xxx/CVE-2016-1000237.json"],"description":"sanitize-html before 1.4.3 has XSS.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2016-1000237","epss":0.00328,"percentile":0.55441,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2016-1000237","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-3j7m-hmh3-9jmp","versionConstraint":"<1.4.3 (semantic)"},"fix":{"suggestedVersion":"1.4.3"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-446m-mv8f-q348","dataSource":"https://github.com/advisories/GHSA-446m-mv8f-q348","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-18214","https://github.com/moment/moment/issues/4163","https://github.com/moment/moment/pull/4326","https://www.npmjs.com/advisories/532","https://www.tenable.com/security/tns-2019-02","https://github.com/moment/moment/commit/69ed9d44957fa6ab12b73d2ae29d286a857b80eb"],"description":"Regular Expression Denial of Service in moment","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-18214","epss":0.00235,"percentile":0.46278,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2017-18214","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["2.19.3"],"state":"fixed","available":[{"version":"2.19.3","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.17625000000000002},"relatedVulnerabilities":[{"id":"CVE-2017-18214","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-18214","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/moment/moment/issues/4163","https://nodesecurity.io/advisories/532","https://www.tenable.com/security/tns-2019-02"],"description":"The moment module before 2.19.3 for Node.js is prone to a regular expression denial of service via a crafted date string, a different vulnerability than CVE-2016-4055.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-18214","epss":0.00235,"percentile":0.46278,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2017-18214","cwe":"CWE-400","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"moment","version":"2.0.0"}},"found":{"vulnerabilityID":"GHSA-446m-mv8f-q348","versionConstraint":"<2.19.3 (semantic)"},"fix":{"suggestedVersion":"2.19.3"}}],"artifact":{"id":"fb07dad56d7726f5","name":"moment","version":"2.0.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/moment/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:momentjs:moment:2.0.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/moment@2.0.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8g4m-cjm2-96wq","dataSource":"https://github.com/advisories/GHSA-8g4m-cjm2-96wq","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-23771","https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587","https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946"],"description":"Sandbox escape in notevil and argencoders-notevil","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23771","epss":0.00304,"percentile":0.53416,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2021-23771","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.1748},"relatedVulnerabilities":[{"id":"CVE-2021-23771","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-23771","namespace":"nvd:cpe","severity":"Medium","urls":["https://snyk.io/vuln/SNYK-JS-ARGENCODERSNOTEVIL-2388587","https://snyk.io/vuln/SNYK-JS-NOTEVIL-2385946"],"description":"This affects all versions of package notevil; all versions of package argencoders-notevil. It is vulnerable to Sandbox Escape leading to Prototype pollution. The package fails to restrict access to the main context, allowing an attacker to add or modify an object's prototype. **Note:** This vulnerability derives from an incomplete fix in [SNYK-JS-NOTEVIL-608878](https://security.snyk.io/vuln/SNYK-JS-NOTEVIL-608878).","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:N","metrics":{"baseScore":6.4,"exploitabilityScore":10,"impactScore":5},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-23771","epss":0.00304,"percentile":0.53416,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2021-23771","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"notevil","version":"1.3.3"}},"found":{"vulnerabilityID":"GHSA-8g4m-cjm2-96wq","versionConstraint":"<=1.3.3 (semantic)"}}],"artifact":{"id":"06d4740823f7ae47","name":"notevil","version":"1.3.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/notevil/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/notevil/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:notevil_project:notevil:1.3.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/notevil@1.3.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-6rw7-vpxm-498p","dataSource":"https://github.com/advisories/GHSA-6rw7-vpxm-498p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p","https://nvd.nist.gov/vuln/detail/CVE-2025-15284","https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9"],"description":"qs's arrayLimit bypass in its bracket notation allows DoS via memory exhaustion","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.00224,"percentile":0.44966,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.1"],"state":"fixed","available":[{"version":"6.14.1","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.17472},"relatedVulnerabilities":[{"id":"CVE-2025-15284","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15284","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/ljharb/qs/commit/3086902ecf7f088d0d1803887643ac6c03d415b9","https://github.com/ljharb/qs/security/advisories/GHSA-6rw7-vpxm-498p"],"description":"Improper Input Validation vulnerability in qs (parse modules) allows HTTP DoS.This issue affects qs: < 6.14.1.\n\n\nSummary\n\nThe arrayLimit option in qs did not enforce limits for bracket notation (a[]=1&a[]=2), only for indexed notation (a[0]=1). This is a consistency bug; arrayLimit should apply uniformly across all array notations.\n\nNote: The default parameterLimit of 1000 effectively mitigates the DoS scenario originally described. With default options, bracket notation cannot produce arrays larger than parameterLimit regardless of arrayLimit, because each a[]=valueconsumes one parameter slot. The severity has been reduced accordingly.\n\nDetails\n\nThe arrayLimit option only checked limits for indexed notation (a[0]=1&a[1]=2) but did not enforce it for bracket notation (a[]=1&a[]=2).\n\nVulnerable code (lib/parse.js:159-162):\n\nif (root === '[]' && options.parseArrays) {\n obj = utils.combine([], leaf); // No arrayLimit check\n}\n\n\n\n\n\nWorking code (lib/parse.js:175):\n\nelse if (index <= options.arrayLimit) { // Limit checked here\n obj = [];\n obj[index] = leaf;\n}\n\n\n\n\n\nThe bracket notation handler at line 159 uses utils.combine([], leaf) without validating against options.arrayLimit, while indexed notation at line 175 checks index <= options.arrayLimit before creating arrays.\n\n\n\nPoC\n\nconst qs = require('qs');\nconst result = qs.parse('a[]=1&a[]=2&a[]=3&a[]=4&a[]=5&a[]=6', { arrayLimit: 5 });\nconsole.log(result.a.length); // Output: 6 (should be max 5)\n\n\n\n\n\nNote on parameterLimit interaction: The original advisory's \"DoS demonstration\" claimed a length of 10,000, but parameterLimit (default: 1000) caps parsing to 1,000 parameters. With default options, the actual output is 1,000, not 10,000.\n\nImpact\n\nConsistency bug in arrayLimit enforcement. With default parameterLimit, the practical DoS risk is negligible since parameterLimit already caps the total number of parsed parameters (and thus array elements from bracket notation). The risk increases only when parameterLimit is explicitly set to a very high value.","cvss":[{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15284","epss":0.00224,"percentile":0.44966,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-15284","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.13.0"}},"found":{"vulnerabilityID":"GHSA-6rw7-vpxm-498p","versionConstraint":"<6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.1"}}],"artifact":{"id":"f1485a5d8cce1397","name":"qs","version":"6.13.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/qs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.13.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.13.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-6g6m-m6h5-w9gf","dataSource":"https://github.com/advisories/GHSA-6g6m-m6h5-w9gf","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf","https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef","https://nvd.nist.gov/vuln/detail/CVE-2020-15084"],"description":"Authorization bypass in express-jwt","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.7,"exploitabilityScore":1.3,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15084","epss":0.00222,"percentile":0.44716,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2020-15084","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-15084","cwe":"CWE-863","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["6.0.0"],"state":"fixed","available":[{"version":"6.0.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.16872000000000004},"relatedVulnerabilities":[{"id":"CVE-2020-15084","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2020-15084","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/auth0/express-jwt/commit/7ecab5f8f0cab5297c2b863596566eb0c019cdef","https://github.com/auth0/express-jwt/security/advisories/GHSA-6g6m-m6h5-w9gf"],"description":"In express-jwt (NPM package) up and including version 5.3.3, the algorithms entry to be specified in the configuration is not being enforced. When algorithms is not specified in the configuration, with the combination of jwks-rsa, it may lead to authorization bypass. You are affected by this vulnerability if all of the following conditions apply: - You are using express-jwt - You do not have **algorithms** configured in your express-jwt configuration. - You are using libraries such as jwks-rsa as the **secret**. You can fix this by specifying **algorithms** in the express-jwt configuration. See linked GHSA for example. This is also fixed in version 6.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N","metrics":{"baseScore":7.7,"exploitabilityScore":1.3,"impactScore":5.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2020-15084","epss":0.00222,"percentile":0.44716,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2020-15084","cwe":"CWE-285","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2020-15084","cwe":"CWE-863","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"express-jwt","version":"0.1.3"}},"found":{"vulnerabilityID":"GHSA-6g6m-m6h5-w9gf","versionConstraint":"<=5.3.3 (semantic)"},"fix":{"suggestedVersion":"6.0.0"}}],"artifact":{"id":"b057e452c5702954","name":"express-jwt","version":"0.1.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:express-jwt:0.1.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/express-jwt@0.1.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-4xc9-xhrj-v574","dataSource":"https://github.com/advisories/GHSA-4xc9-xhrj-v574","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-16487","https://hackerone.com/reports/380873","https://github.com/lodash/lodash/commit/90e6199a161b6445b01454517b40ef65ebecd2ad","https://security.netapp.com/advisory/ntap-20190919-0004","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-16487.yml"],"description":"Prototype Pollution in lodash","cvss":[],"epss":[{"cve":"CVE-2018-16487","epss":0.00205,"percentile":0.42599,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2018-16487","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"}],"fix":{"versions":["4.17.11"],"state":"fixed","available":[{"version":"4.17.11","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.15375000000000003},"relatedVulnerabilities":[{"id":"CVE-2018-16487","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-16487","namespace":"nvd:cpe","severity":"Medium","urls":["https://hackerone.com/reports/380873","https://security.netapp.com/advisory/ntap-20190919-0004/"],"description":"A prototype pollution vulnerability was found in lodash <4.17.11 where the functions merge, mergeWith, and defaultsDeep can be tricked into adding or modifying properties of Object.prototype.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5.6,"exploitabilityScore":2.3,"impactScore":3.4},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-16487","epss":0.00205,"percentile":0.42599,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2018-16487","cwe":"CWE-400","source":"support@hackerone.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-4xc9-xhrj-v574","versionConstraint":"<4.17.11 (semantic)"},"fix":{"suggestedVersion":"4.17.11"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-mjxr-4v3x-q3m4","dataSource":"https://github.com/advisories/GHSA-mjxr-4v3x-q3m4","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-26540","https://github.com/apostrophecms/sanitize-html/pull/460","https://advisory.checkmarx.net/advisory/CX-2021-4309","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26"],"description":"Improper Input Validation in sanitize-html","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26540","epss":0.00288,"percentile":0.52034,"date":"2026-03-01"}],"fix":{"versions":["2.3.2"],"state":"fixed","available":[{"version":"2.3.2","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.14832},"relatedVulnerabilities":[{"id":"CVE-2021-26540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-26540","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CX-2021-4309","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#232-2021-01-26","https://github.com/apostrophecms/sanitize-html/pull/460"],"description":"Apostrophe Technologies sanitize-html before 2.3.2 does not properly validate the hostnames set by the \"allowedIframeHostnames\" option when the \"allowIframeRelativeUrls\" is set to true, which allows attackers to bypass hostname whitelist for iframe element, related using an src value that starts with \"/\\\\example.com\".","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26540","epss":0.00288,"percentile":0.52034,"date":"2026-03-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-mjxr-4v3x-q3m4","versionConstraint":"<2.3.2 (semantic)"},"fix":{"suggestedVersion":"2.3.2"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rjqq-98f6-6j3r","dataSource":"https://github.com/advisories/GHSA-rjqq-98f6-6j3r","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2021-26539","https://github.com/apostrophecms/sanitize-html/pull/458","https://advisory.checkmarx.net/advisory/CX-2021-4308","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22","https://github.com/apostrophecms/sanitize-html/commit/bdf7836ef8f0e5b21f9a1aab0623ae8fcd09c1da"],"description":"Improper Input Validation in sanitize-html","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26539","epss":0.00288,"percentile":0.52034,"date":"2026-03-01"}],"fix":{"versions":["2.3.1"],"state":"fixed","available":[{"version":"2.3.1","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.14832},"relatedVulnerabilities":[{"id":"CVE-2021-26539","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2021-26539","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CX-2021-4308","https://github.com/apostrophecms/sanitize-html/blob/main/CHANGELOG.md#231-2021-01-22","https://github.com/apostrophecms/sanitize-html/pull/458"],"description":"Apostrophe Technologies sanitize-html before 2.3.1 does not properly handle internationalized domain name (IDN) which could allow an attacker to bypass hostname whitelist validation set by the \"allowedIframeHostnames\" option.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:P/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2021-26539","epss":0.00288,"percentile":0.52034,"date":"2026-03-01"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-rjqq-98f6-6j3r","versionConstraint":"<2.3.1 (semantic)"},"fix":{"suggestedVersion":"2.3.1"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-rc47-6667-2j5j","dataSource":"https://github.com/advisories/GHSA-rc47-6667-2j5j","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2022-25881","https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332","https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783","https://github.com/kornelski/http-cache-semantics/commit/560b2d8ef452bbba20ffed69dc155d63ac757b74","https://security.netapp.com/advisory/ntap-20230622-0008"],"description":"http-cache-semantics vulnerable to Regular Expression Denial of Service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25881","epss":0.00196,"percentile":0.41554,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["4.1.1"],"state":"fixed","available":[{"version":"4.1.1","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.147},"relatedVulnerabilities":[{"id":"CVE-2022-25881","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-25881","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/kornelski/http-cache-semantics/blob/master/index.js%23L83","https://security.netapp.com/advisory/ntap-20230622-0008/","https://security.snyk.io/vuln/SNYK-JAVA-ORGWEBJARSNPM-3253332","https://security.snyk.io/vuln/SNYK-JS-HTTPCACHESEMANTICS-3248783"],"description":"This affects versions of the package http-cache-semantics before 4.1.1. The issue can be exploited via malicious request header values sent to a server, when that server reads the cache policy from the request using this library.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-25881","epss":0.00196,"percentile":0.41554,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"nvd@nist.gov","type":"Primary"},{"cve":"CVE-2022-25881","cwe":"CWE-1333","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"http-cache-semantics","version":"3.8.1"}},"found":{"vulnerabilityID":"GHSA-rc47-6667-2j5j","versionConstraint":"<4.1.1 (semantic)"},"fix":{"suggestedVersion":"4.1.1"}}],"artifact":{"id":"bd9e0a0c5346494e","name":"http-cache-semantics","version":"3.8.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/http-cache-semantics/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/http-cache-semantics/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["BSD-2-Clause"],"cpes":["cpe:2.3:a:http-cache-semantics_project:http-cache-semantics:3.8.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/http-cache-semantics@3.8.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-xc6g-ggrc-qq4r","dataSource":"https://github.com/advisories/GHSA-xc6g-ggrc-qq4r","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2017-16016","https://github.com/punkave/sanitize-html/issues/100","https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403)))","https://npmjs.com/package/sanitize-html#discarding-the-entire-contents-of-a-disallowed-tag","https://www.npmjs.com/advisories/154","https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403"],"description":"Cross-Site Scripting in sanitize-html","cvss":[],"epss":[{"cve":"CVE-2017-16016","epss":0.00286,"percentile":0.51792,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2017-16016","cwe":"CWE-79","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16016","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["1.11.4"],"state":"fixed","available":[{"version":"1.11.4","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.14300000000000002},"relatedVulnerabilities":[{"id":"CVE-2017-16016","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2017-16016","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/punkave/sanitize-html/commit/5d205a1005ba0df80e21d8c64a15bb3accdb2403","https://github.com/punkave/sanitize-html/issues/100","https://nodesecurity.io/advisories/154"],"description":"Sanitize-html is a library for scrubbing html input of malicious values. Versions 1.11.1 and below are vulnerable to cross site scripting (XSS) in certain scenarios: If allowed at least one nonTextTags, the result is a potential XSS vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2017-16016","epss":0.00286,"percentile":0.51792,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2017-16016","cwe":"CWE-79","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2017-16016","cwe":"CWE-79","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-xc6g-ggrc-qq4r","versionConstraint":"<=1.11.1 (semantic)"},"fix":{"suggestedVersion":"1.11.4"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-cqmj-92xf-r6r9","dataSource":"https://github.com/advisories/GHSA-cqmj-92xf-r6r9","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9","https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3","https://github.com/socketio/socket.io-parser/commit/1c220ddbf45ea4b44bc8dbf6f9ae245f672ba1b9","https://nvd.nist.gov/vuln/detail/CVE-2023-32695","https://github.com/socketio/socket.io-parser/releases/tag/4.2.3","https://github.com/socketio/socket.io-parser/commit/ee006607495eca4ec7262ad080dd3a91439a5ba4"],"description":"Insufficient validation when decoding a Socket.IO packet","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32695","epss":0.00203,"percentile":0.42405,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-32695","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-32695","cwe":"CWE-754","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.2.3"],"state":"fixed","available":[{"version":"4.2.3","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.12281500000000001},"relatedVulnerabilities":[{"id":"CVE-2023-32695","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2023-32695","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io-parser/commit/2dc3c92622dad113b8676be06f23b1ed46b02ced","https://github.com/socketio/socket.io-parser/commit/3b78117bf6ba7e99d7a5cfc1ba54d0477554a7f3","https://github.com/socketio/socket.io-parser/releases/tag/4.2.3","https://github.com/socketio/socket.io-parser/security/advisories/GHSA-cqmj-92xf-r6r9"],"description":"socket.io parser is a socket.io encoder and decoder written in JavaScript complying with version 5 of socket.io-protocol. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. A patch has been released in version 4.2.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2023-32695","epss":0.00203,"percentile":0.42405,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2023-32695","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2023-32695","cwe":"CWE-754","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io-parser","version":"4.0.5"}},"found":{"vulnerabilityID":"GHSA-cqmj-92xf-r6r9","versionConstraint":">=4.0.4,<4.2.3 (semantic)"},"fix":{"suggestedVersion":"4.2.3"}}],"artifact":{"id":"dd154d7bfbaea09c","name":"socket.io-parser","version":"4.0.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/socket.io-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socket.io-parser/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:socket:socket.io-parser:4.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io-parser@4.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-grv7-fg5c-xmjg","dataSource":"https://github.com/advisories/GHSA-grv7-fg5c-xmjg","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4068","https://github.com/micromatch/braces/issues/35","https://devhub.checkmarx.com/cve-details/CVE-2024-4068","https://github.com/micromatch/braces/blob/98414f9f1fabe021736e26836d8306d5de747e0d/lib/parse.js#L308","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff"],"description":"Uncontrolled resource consumption in braces","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.00159,"percentile":0.3684,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["3.0.3"],"state":"fixed","available":[{"version":"3.0.3","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.11925},"relatedVulnerabilities":[{"id":"CVE-2024-4068","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4068","namespace":"nvd:cpe","severity":"High","urls":["https://devhub.checkmarx.com/cve-details/CVE-2024-4068/","https://github.com/micromatch/braces/commit/415d660c3002d1ab7e63dbf490c9851da80596ff","https://github.com/micromatch/braces/issues/35","https://github.com/micromatch/braces/pull/37","https://github.com/micromatch/braces/pull/40"],"description":"The NPM package `braces`, versions prior to 3.0.3, fails to limit the number of characters it can handle, which could lead to Memory Exhaustion. In `lib/parse.js,` if a malicious user sends \"imbalanced braces\" as input, the parsing will enter a loop, which will cause the program to start allocating heap memory without freeing it at any moment of the loop. Eventually, the JavaScript heap limit is reached, and the program will crash.","cvss":[{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4068","epss":0.00159,"percentile":0.3684,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-4068","cwe":"CWE-1050","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"},{"cve":"CVE-2024-4068","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"braces","version":"2.3.2"}},"found":{"vulnerabilityID":"GHSA-grv7-fg5c-xmjg","versionConstraint":"<3.0.3 (semantic)"},"fix":{"suggestedVersion":"3.0.3"}}],"artifact":{"id":"e18c817c2057c675","name":"braces","version":"2.3.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:braces_project:braces:2.3.2:*:*:*:*:node.js:*:*","cpe:2.3:a:jonschlinkert:braces:2.3.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/braces@2.3.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-fvqr-27wr-82fm","dataSource":"https://github.com/advisories/GHSA-fvqr-27wr-82fm","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2018-3721","https://hackerone.com/reports/310443","https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a","https://security.netapp.com/advisory/ntap-20190919-0004","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/lodash-rails/CVE-2018-3721.yml"],"description":"Prototype Pollution in lodash","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3721","epss":0.00144,"percentile":0.34715,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2018-3721","cwe":"CWE-471","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2018-3721","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["4.17.5"],"state":"fixed","available":[{"version":"4.17.5","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.0828},"relatedVulnerabilities":[{"id":"CVE-2018-3721","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-3721","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/lodash/lodash/commit/d8e069cc3410082e44eb18fcf8e7f3d08ebe1d4a","https://hackerone.com/reports/310443","https://security.netapp.com/advisory/ntap-20190919-0004/"],"description":"lodash node module before 4.17.5 suffers from a Modification of Assumed-Immutable Data (MAID) vulnerability via defaultsDeep, merge, and mergeWith functions, which allows a malicious user to modify the prototype of \"Object\" via __proto__, causing the addition or modification of an existing property that will exist on all objects.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":6.5,"exploitabilityScore":2.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:N/I:P/A:N","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-3721","epss":0.00144,"percentile":0.34715,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2018-3721","cwe":"CWE-471","source":"support@hackerone.com","type":"Secondary"},{"cve":"CVE-2018-3721","cwe":"CWE-1321","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"2.4.2"}},"found":{"vulnerabilityID":"GHSA-fvqr-27wr-82fm","versionConstraint":"<4.17.5 (semantic)"},"fix":{"suggestedVersion":"4.17.5"}}],"artifact":{"id":"dbbb92a4d9c4d340","name":"lodash","version":"2.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:2.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@2.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-25hc-qcg6-38wj","dataSource":"https://github.com/advisories/GHSA-25hc-qcg6-38wj","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj","https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115","https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c","https://nvd.nist.gov/vuln/detail/CVE-2024-38355"],"description":"socket.io has an unhandled 'error' event","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-38355","epss":0.00136,"percentile":0.3347,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-38355","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-38355","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.6.2"],"state":"fixed","available":[{"version":"4.6.2","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.08228},"relatedVulnerabilities":[{"id":"CVE-2024-38355","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-38355","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/socketio/socket.io/commit/15af22fc22bc6030fcead322c106f07640336115","https://github.com/socketio/socket.io/commit/d30630ba10562bf987f4d2b42440fc41a828119c","https://github.com/socketio/socket.io/security/advisories/GHSA-25hc-qcg6-38wj","https://www.vicarius.io/vsociety/posts/unhandled-exception-in-socketio-cve-2024-38355"],"description":"Socket.IO is an open source, real-time, bidirectional, event-based, communication framework. A specially crafted Socket.IO packet can trigger an uncaught exception on the Socket.IO server, thus killing the Node.js process. This issue is fixed by commit `15af22fc22` which has been included in `socket.io@4.6.2` (released in May 2023). The fix was backported in the 2.x branch as well with commit `d30630ba10`. Users are advised to upgrade. Users unable to upgrade may attach a listener for the \"error\" event to catch these errors.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":7.3,"exploitabilityScore":3.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-38355","epss":0.00136,"percentile":0.3347,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-38355","cwe":"CWE-20","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2024-38355","cwe":"CWE-754","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"socket.io","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-25hc-qcg6-38wj","versionConstraint":">=3.0.0,<4.6.2 (semantic)"},"fix":{"suggestedVersion":"4.6.2"}}],"artifact":{"id":"a59f241f8d484687","name":"socket.io","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/socket.io/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socket.io/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:socket:socket.io:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/socket.io@3.1.2","upstreams":[]}},{"vulnerability":{"id":"CVE-2018-20796","dataSource":"https://security-tracker.debian.org/tracker/CVE-2018-20796","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.","cvss":[],"epss":[{"cve":"CVE-2018-20796","epss":0.01492,"percentile":0.80869,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0746},"relatedVulnerabilities":[{"id":"CVE-2018-20796","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2018-20796","namespace":"nvd:cpe","severity":"High","urls":["http://www.securityfocus.com/bid/107160","https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141","https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html","https://security.netapp.com/advisory/ntap-20190315-0002/","https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS"],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\\227|)(\\\\1\\\\1|t1|\\\\\\2537)+' in grep.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2018-20796","epss":0.01492,"percentile":0.80869,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2018-20796","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2018-20796","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-pxg6-pf52-xh8x","dataSource":"https://github.com/advisories/GHSA-pxg6-pf52-xh8x","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c"],"description":"cookie accepts cookie name, path, and domain with out of bounds characters","cvss":[],"epss":[{"cve":"CVE-2024-47764","epss":0.00205,"percentile":0.42597,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["0.7.0"],"state":"fixed","available":[{"version":"0.7.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.0615},"relatedVulnerabilities":[{"id":"CVE-2024-47764","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-47764","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/jshttp/cookie/commit/e10042845354fea83bd8f34af72475eed1dadf5c","https://github.com/jshttp/cookie/pull/167","https://github.com/jshttp/cookie/security/advisories/GHSA-pxg6-pf52-xh8x"],"description":"cookie is a basic HTTP cookie parser and serializer for HTTP servers. The cookie name could be used to set other fields of the cookie, resulting in an unexpected cookie value. A similar escape can be used for path and domain, which could be abused to alter other fields of the cookie. Upgrade to 0.7.0, which updates the validation for name, path, and domain.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-47764","epss":0.00205,"percentile":0.42597,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-47764","cwe":"CWE-74","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"cookie","version":"0.4.2"}},"found":{"vulnerabilityID":"GHSA-pxg6-pf52-xh8x","versionConstraint":"<0.7.0 (semantic)"},"fix":{"suggestedVersion":"0.7.0"}}],"artifact":{"id":"299182936c2fe78a","name":"cookie","version":"0.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:cookie:cookie:0.4.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/cookie@0.4.2","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-69420","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69420","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response verification code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing a malformed TimeStamp Response file. Impact summary: An application calling TS_RESP_verify_response() with a malformed TimeStamp Response can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2() access the signing cert attribute value without validating its type. When the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed TimeStamp Response to an application that verifies timestamp responses. The TimeStamp protocol (RFC 3161) is not widely used and the impact of the exploit is just a Denial of Service. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the TimeStamp Response implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69420","epss":0.00076,"percentile":0.2275,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.056999999999999995},"relatedVulnerabilities":[{"id":"CVE-2025-69420","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69420","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/openssl/openssl/commit/27c7012c91cc986a598d7540f3079dfde2416eb9","https://github.com/openssl/openssl/commit/4e254b48ad93cc092be3dd62d97015f33f73133a","https://github.com/openssl/openssl/commit/564fd9c73787f25693bf9e75faf7bf6bb1305d4e","https://github.com/openssl/openssl/commit/5eb0770ffcf11b785cf374ff3c19196245e54f1b","https://github.com/openssl/openssl/commit/a99349ebfc519999edc50620abe24d599b9eb085","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: A type confusion vulnerability exists in the TimeStamp Response\nverification code where an ASN1_TYPE union member is accessed without first\nvalidating the type, causing an invalid or NULL pointer dereference when\nprocessing a malformed TimeStamp Response file.\n\nImpact summary: An application calling TS_RESP_verify_response() with a\nmalformed TimeStamp Response can be caused to dereference an invalid or\nNULL pointer when reading, resulting in a Denial of Service.\n\nThe functions ossl_ess_get_signing_cert() and ossl_ess_get_signing_cert_v2()\naccess the signing cert attribute value without validating its type.\nWhen the type is not V_ASN1_SEQUENCE, this results in accessing invalid memory\nthrough the ASN1_TYPE union, causing a crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nTimeStamp Response to an application that verifies timestamp responses. The\nTimeStamp protocol (RFC 3161) is not widely used and the impact of the\nexploit is just a Denial of Service. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the TimeStamp Response implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69420","epss":0.00076,"percentile":0.2275,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-69420","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-69420","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-8cf7-32gw-wr33","dataSource":"https://github.com/advisories/GHSA-8cf7-32gw-wr33","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23539","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken unrestricted key type could lead to legacy keys usage","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00072,"percentile":0.21994,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23539","cwe":"CWE-327","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.05616000000000001},"relatedVulnerabilities":[{"id":"CVE-2022-23539","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23539","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00072,"percentile":0.21994,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23539","cwe":"CWE-327","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-8cf7-32gw-wr33","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-8cf7-32gw-wr33","dataSource":"https://github.com/advisories/GHSA-8cf7-32gw-wr33","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23539","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken unrestricted key type could lead to legacy keys usage","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00072,"percentile":0.21994,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23539","cwe":"CWE-327","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.05616000000000001},"relatedVulnerabilities":[{"id":"CVE-2022-23539","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23539","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-8cf7-32gw-wr33","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"Versions `<=8.5.1` of `jsonwebtoken` library could be misconfigured so that legacy, insecure key types are used for signature verification. For example, DSA keys could be used with the RS256 algorithm. You are affected if you are using an algorithm and a key type other than a combination listed in the GitHub Security Advisory as unaffected. This issue has been fixed, please update to version 9.0.0. This version validates for asymmetric key type and algorithm combinations. Please refer to the above mentioned algorithm / key type combinations for the valid secure configuration. After updating to version 9.0.0, if you still intend to continue with signing or verifying tokens using invalid key type/algorithm value combinations, you’ll need to set the `allowInvalidAsymmetricKeyTypes` option to `true` in the `sign()` and/or `verify()` functions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":8.1,"exploitabilityScore":2.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":1.7,"impactScore":4.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23539","epss":0.00072,"percentile":0.21994,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23539","cwe":"CWE-327","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-8cf7-32gw-wr33","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-vghf-hv5q-vc2g","dataSource":"https://github.com/advisories/GHSA-vghf-hv5q-vc2g","namespace":"github:language:javascript","severity":"High","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-12758","https://github.com/validatorjs/validator.js/pull/2616","https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e","https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476","https://github.com/validatorjs/validator.js/commit/d457ecaf55b0f3d8bd379d82757425d0d13dd382","http://seclists.org/fulldisclosure/2026/Jan/27"],"description":"Validator is Vulnerable to Incomplete Filtering of One or More Instances of Special Elements","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-12758","epss":0.00074,"percentile":0.22371,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-12758","cwe":"CWE-792","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2025-12758","cwe":"CWE-172","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["13.15.22"],"state":"fixed","available":[{"version":"13.15.22","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.055869999999999996},"relatedVulnerabilities":[{"id":"CVE-2025-12758","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-12758","namespace":"nvd:cpe","severity":"High","urls":["https://gist.github.com/koral--/ad31208b25b9e3d1e2e35f1d4d72572e","https://github.com/validatorjs/validator.js/pull/2616","https://security.snyk.io/vuln/SNYK-JS-VALIDATOR-13653476","http://seclists.org/fulldisclosure/2026/Jan/27"],"description":"Versions of the package validator before 13.15.22 are vulnerable to Incomplete Filtering of One or More Instances of Special Elements in the isLength() function that does not take into account Unicode variation selectors (\\uFE0F, \\uFE0E) appearing in a sequence which lead to improper string length calculation. This can lead to an application using isLength for input validation accepting strings significantly longer than intended, resulting in issues like data truncation in databases, buffer overflows in other system components, or denial-of-service.","cvss":[{"source":"report@snyk.io","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":7.7},"vendorMetadata":{}},{"source":"report@snyk.io","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-12758","epss":0.00074,"percentile":0.22371,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-12758","cwe":"CWE-792","source":"report@snyk.io","type":"Secondary"},{"cve":"CVE-2025-12758","cwe":"CWE-172","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"validator","version":"13.15.15"}},"found":{"vulnerabilityID":"GHSA-vghf-hv5q-vc2g","versionConstraint":"<13.15.22 (semantic)"},"fix":{"suggestedVersion":"13.15.22"}}],"artifact":{"id":"3b9b91f7d23a3503","name":"validator","version":"13.15.15","type":"npm","locations":[{"path":"/juice-shop/node_modules/validator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/validator/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:validator_project:validator:13.15.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/validator@13.15.15","upstreams":[]}},{"vulnerability":{"id":"GHSA-g5hg-p3ph-g8qg","dataSource":"https://github.com/advisories/GHSA-g5hg-p3ph-g8qg","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg","https://nvd.nist.gov/vuln/detail/CVE-2025-48997","https://github.com/expressjs/multer/issues/1233","https://github.com/expressjs/multer/pull/1256","https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9"],"description":"Multer vulnerable to Denial of Service via unhandled exception","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-48997","epss":0.00068,"percentile":0.20887,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-48997","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.1"],"state":"fixed","available":[{"version":"2.0.1","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.055080000000000004},"relatedVulnerabilities":[{"id":"CVE-2025-48997","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-48997","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/multer/commit/35a3272b611945155e046dd5cef11088587635e9","https://github.com/expressjs/multer/issues/1233","https://github.com/expressjs/multer/pull/1256","https://github.com/expressjs/multer/security/advisories/GHSA-g5hg-p3ph-g8qg"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.1 allows an attacker to trigger a Denial of Service (DoS) by sending an upload file request with an empty string field name. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to `2.0.1` to receive a patch. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-48997","epss":0.00068,"percentile":0.20887,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-48997","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-g5hg-p3ph-g8qg","versionConstraint":">=1.4.4-lts.1,<2.0.1 (semantic)"},"fix":{"suggestedVersion":"2.0.1"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-952p-6rrq-rcjv","dataSource":"https://github.com/advisories/GHSA-952p-6rrq-rcjv","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2024-4067","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247","https://devhub.checkmarx.com/cve-details/CVE-2024-4067","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/commit/500d5d6f42f0e8dfa1cb5464c6cb420b1b6aaaa0","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://advisory.checkmarx.net/advisory/CVE-2024-4067","https://github.com/micromatch/micromatch/releases/tag/4.0.8"],"description":"Regular Expression Denial of Service (ReDoS) in micromatch","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.00105,"percentile":0.28674,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["4.0.8"],"state":"fixed","available":[{"version":"4.0.8","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.054075},"relatedVulnerabilities":[{"id":"CVE-2024-4067","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2024-4067","namespace":"nvd:cpe","severity":"Medium","urls":["https://advisory.checkmarx.net/advisory/CVE-2024-4067/","https://devhub.checkmarx.com/cve-details/CVE-2024-4067/","https://github.com/micromatch/micromatch/commit/03aa8052171e878897eee5d7bb2ae0ae83ec2ade","https://github.com/micromatch/micromatch/pull/266","https://github.com/micromatch/micromatch/releases/tag/4.0.8","https://github.com/micromatch/micromatch/blob/2c56a8604b68c1099e7bc0f807ce0865a339747a/index.js#L448","https://github.com/micromatch/micromatch/issues/243","https://github.com/micromatch/micromatch/pull/247"],"description":"The NPM package `micromatch` prior to 4.0.8 is vulnerable to Regular Expression Denial of Service (ReDoS). The vulnerability occurs in `micromatch.braces()` in `index.js` because the pattern `.*` will greedily match anything. By passing a malicious payload, the pattern matching will keep backtracking to the input while it doesn't find the closing bracket. As the input size increases, the consumption time will also increase until it causes the application to hang or slow down. There was a merged fix but further testing shows the issue persists. This issue should be mitigated by using a safe pattern that won't start backtracking the regular expression due to greedy matching. This issue was fixed in version 4.0.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2024-4067","epss":0.00105,"percentile":0.28674,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2024-4067","cwe":"CWE-1333","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"micromatch","version":"3.1.10"}},"found":{"vulnerabilityID":"GHSA-952p-6rrq-rcjv","versionConstraint":"<4.0.8 (semantic)"},"fix":{"suggestedVersion":"4.0.8"}}],"artifact":{"id":"2f60ee768b1461a2","name":"micromatch","version":"3.1.10","type":"npm","locations":[{"path":"/juice-shop/node_modules/micromatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/micromatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:jonschlinkert:micromatch:3.1.10:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/micromatch@3.1.10","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-59465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59465","namespace":"nvd:cpe","severity":"High","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"A malformed `HTTP/2 HEADERS` frame with oversized, invalid `HPACK` data can cause Node.js to crash by triggering an unhandled `TLSSocket` error `ECONNRESET`. Instead of safely closing the connection, the process crashes, enabling a remote denial of service. This primarily affects applications that do not attach explicit error handlers to secure sockets, for example:\n```\nserver.on('secureConnection', socket => {\n socket.on('error', err => {\n console.log(err)\n })\n})\n```","cvss":[{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59465","epss":0.00067,"percentile":0.20776,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-59465","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.05025},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2025-59465","versionConstraint":"< 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-69421","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69421","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer dereference in the PKCS12_item_decrypt_d2i_ex() function. Impact summary: A NULL pointer dereference can trigger a crash which leads to Denial of Service for an application processing PKCS#12 files. The PKCS12_item_decrypt_d2i_ex() function does not check whether the oct parameter is NULL before dereferencing it. When called from PKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can be NULL, causing a crash. The vulnerability is limited to Denial of Service and cannot be escalated to achieve code execution or memory disclosure. Exploiting this issue requires an attacker to provide a malformed PKCS#12 file to an application that processes it. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69421","epss":0.00065,"percentile":0.20036,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.048749999999999995},"relatedVulnerabilities":[{"id":"CVE-2025-69421","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69421","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/openssl/openssl/commit/3524a29271f8191b8fd8a5257eb05173982a097b","https://github.com/openssl/openssl/commit/36ecb4960872a4ce04bf6f1e1f4e78d75ec0c0c7","https://github.com/openssl/openssl/commit/4bbc8d41a72c842ce4077a8a3eccd1109aaf74bd","https://github.com/openssl/openssl/commit/643986985cd1c21221f941129d76fe0c2785aeb3","https://github.com/openssl/openssl/commit/a2dbc539f0f9cc63832709fa5aa33ad9495eb19c","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: Processing a malformed PKCS#12 file can trigger a NULL pointer\ndereference in the PKCS12_item_decrypt_d2i_ex() function.\n\nImpact summary: A NULL pointer dereference can trigger a crash which leads to\nDenial of Service for an application processing PKCS#12 files.\n\nThe PKCS12_item_decrypt_d2i_ex() function does not check whether the oct\nparameter is NULL before dereferencing it. When called from\nPKCS12_unpack_p7encdata() with a malformed PKCS#12 file, this parameter can\nbe NULL, causing a crash. The vulnerability is limited to Denial of Service\nand cannot be escalated to achieve code execution or memory disclosure.\n\nExploiting this issue requires an attacker to provide a malformed PKCS#12 file\nto an application that processes it. For that reason the issue was assessed as\nLow severity according to our Security Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69421","epss":0.00065,"percentile":0.20036,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-69421","cwe":"CWE-476","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-69421","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2025-69419","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69419","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously crafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing non-ASCII BMP code point can trigger a one byte write before the allocated buffer. Impact summary: The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service. The OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12 BMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes, the helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16 source byte count as the destination buffer capacity to UTF8_putc(). For BMP code points above U+07FF, UTF-8 requires three bytes, but the forwarded capacity can be just two bytes. UTF8_putc() then returns -1, and this negative value is added to the output length without validation, causing the length to become negative. The subsequent trailing NUL byte is then written at a negative offset, causing write outside of heap allocated buffer. The vulnerability is reachable via the public PKCS12_get_friendlyname() API when parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a different code path that avoids this issue, PKCS12_get_friendlyname() directly invokes the vulnerable function. Exploitation requires an attacker to provide a malicious PKCS#12 file to be parsed by the application and the attacker can just trigger a one zero byte write before the allocated buffer. For that reason the issue was assessed as Low severity according to our Security Policy. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69419","epss":0.00061,"percentile":0.19051,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-69419","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.045445},"relatedVulnerabilities":[{"id":"CVE-2025-69419","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69419","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/openssl/openssl/commit/41be0f216404f14457bbf3b9cc488dba60b49296","https://github.com/openssl/openssl/commit/7e9cac9832e4705b91987c2474ed06a37a93cecb","https://github.com/openssl/openssl/commit/a26a90d38edec3748566129d824e664b54bee2e2","https://github.com/openssl/openssl/commit/cda12de3bc0e333ea8d2c6fd15001dbdaf280015","https://github.com/openssl/openssl/commit/ff628933755075446bca8307e8417c14d164b535","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: Calling PKCS12_get_friendlyname() function on a maliciously\ncrafted PKCS#12 file with a BMPString (UTF-16BE) friendly name containing\nnon-ASCII BMP code point can trigger a one byte write before the allocated\nbuffer.\n\nImpact summary: The out-of-bounds write can cause a memory corruption\nwhich can have various consequences including a Denial of Service.\n\nThe OPENSSL_uni2utf8() function performs a two-pass conversion of a PKCS#12\nBMPString (UTF-16BE) to UTF-8. In the second pass, when emitting UTF-8 bytes,\nthe helper function bmp_to_utf8() incorrectly forwards the remaining UTF-16\nsource byte count as the destination buffer capacity to UTF8_putc(). For BMP\ncode points above U+07FF, UTF-8 requires three bytes, but the forwarded\ncapacity can be just two bytes. UTF8_putc() then returns -1, and this negative\nvalue is added to the output length without validation, causing the\nlength to become negative. The subsequent trailing NUL byte is then written\nat a negative offset, causing write outside of heap allocated buffer.\n\nThe vulnerability is reachable via the public PKCS12_get_friendlyname() API\nwhen parsing attacker-controlled PKCS#12 files. While PKCS12_parse() uses a\ndifferent code path that avoids this issue, PKCS12_get_friendlyname() directly\ninvokes the vulnerable function. Exploitation requires an attacker to provide\na malicious PKCS#12 file to be parsed by the application and the attacker\ncan just trigger a one zero byte write before the allocated buffer.\nFor that reason the issue was assessed as Low severity according to our\nSecurity Policy.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.4,"exploitabilityScore":2.3,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69419","epss":0.00061,"percentile":0.19051,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-69419","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-69419","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2019-9192","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-9192","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern","cvss":[],"epss":[{"cve":"CVE-2019-9192","epss":0.0086,"percentile":0.74825,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.043000000000000003},"relatedVulnerabilities":[{"id":"CVE-2019-9192","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-9192","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=24269","https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS"],"description":"In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(|)(\\\\1\\\\1)*' in grep, a different issue than CVE-2018-20796. NOTE: the software maintainer disputes that this is a vulnerability because the behavior occurs only with a crafted pattern","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-9192","epss":0.0086,"percentile":0.74825,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-9192","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-9192","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2019-1010025","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010025","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.","cvss":[],"epss":[{"cve":"CVE-2019-1010025","epss":0.00856,"percentile":0.74779,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0428},"relatedVulnerabilities":[{"id":"CVE-2019-1010025","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010025","namespace":"nvd:cpe","severity":"Medium","urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010025","https://sourceware.org/bugzilla/show_bug.cgi?id=22853","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010025"],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may guess the heap addresses of pthread_created thread. The component is: glibc. NOTE: the vendor's position is \"ASLR bypass itself is not a vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010025","epss":0.00856,"percentile":0.74779,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-1010025","cwe":"CWE-330","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010025","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.5"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"a7d9f58fa9223af7","name":"minimatch","version":"3.0.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.8"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"64792428adfc1585","name":"minimatch","version":"3.0.8","type":"npm","locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"203e6da42d80803d","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"5c4dec26d80d1f6e","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/rimraf/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/rimraf/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"182b6a07cfd75764","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"60218374fb088257","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"31053d1a3eefafcf","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/archiver-utils/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"c46d28efb236e0c8","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"2ea489db3cb444cd","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/file-js/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/file-js/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"a88006b8a0ec9567","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/fstream/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/fstream/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"34e3a98e2f474c3f","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/ignore-walk/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ignore-walk/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["5.1.7"],"state":"fixed","available":[{"version":"5.1.7","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"5.1.6"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":">=5.0.0,<5.1.7 (semantic)"},"fix":{"suggestedVersion":"5.1.7"}}],"artifact":{"id":"ae8bd0e649f1262b","name":"minimatch","version":"5.1.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/filehound/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/filehound/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:5.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@5.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-3ppc-4f35-3m26","dataSource":"https://github.com/advisories/GHSA-3ppc-4f35-3m26","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26","https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://nvd.nist.gov/vuln/detail/CVE-2026-26996"],"description":"minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["9.0.6"],"state":"fixed","available":[{"version":"9.0.6","date":"2026-02-25","kind":"first-observed"}]},"advisories":[],"risk":0.04211999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-26996","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26996","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/commit/2e111f3a79abc00fa73110195de2c0f2351904f5","https://github.com/isaacs/minimatch/security/advisories/GHSA-3ppc-4f35-3m26"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Versions 10.2.0 and below are vulnerable to Regular Expression Denial of Service (ReDoS) when a glob pattern contains many consecutive * wildcards followed by a literal character that doesn't appear in the test string. Each * compiles to a separate [^/]*? regex group, and when the match fails, V8's regex engine backtracks exponentially across all possible splits. The time complexity is O(4^N) where N is the number of * characters. With N=15, a single minimatch() call takes ~2 seconds. With N=34, it hangs effectively forever. Any application that passes user-controlled strings to minimatch() as the pattern argument is vulnerable to DoS. This issue has been fixed in version 10.2.1.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26996","epss":0.00052,"percentile":0.16191,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26996","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-3ppc-4f35-3m26","versionConstraint":">=9.0.0,<9.0.6 (semantic)"},"fix":{"suggestedVersion":"9.0.6"}}],"artifact":{"id":"1f297f7286432e88","name":"minimatch","version":"9.0.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/glob/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/glob/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.5","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-15281","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-15281","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15281","epss":0.00053,"percentile":0.16564,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.039749999999999994},"relatedVulnerabilities":[{"id":"CVE-2025-15281","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-15281","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33814","http://www.openwall.com/lists/oss-security/2026/01/20/3"],"description":"Calling wordexp with WRDE_REUSE in conjunction with WRDE_APPEND in the GNU C Library version 2.0 to version 2.42 may cause the interface to return uninitialized memory in the we_wordv member, which on subsequent calls to wordfree may abort the process.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-15281","epss":0.00053,"percentile":0.16564,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-15281","cwe":"CWE-908","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-15281","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-22796","dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-22796","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"Issue summary: A type confusion vulnerability exists in the signature verification of signed PKCS#7 data where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid or NULL pointer dereference when processing malformed PKCS#7 data. Impact summary: An application performing signature verification of PKCS#7 data or calling directly the PKCS7_digest_from_attributes() function can be caused to dereference an invalid or NULL pointer when reading, resulting in a Denial of Service. The function PKCS7_digest_from_attributes() accesses the message digest attribute value without validating its type. When the type is not V_ASN1_OCTET_STRING, this results in accessing invalid memory through the ASN1_TYPE union, causing a crash. Exploiting this vulnerability requires an attacker to provide a malformed signed PKCS#7 to an application that verifies it. The impact of the exploit is just a Denial of Service, the PKCS7 API is legacy and applications should be using the CMS API instead. For these reasons the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS#7 parsing implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22796","epss":0.00077,"percentile":0.22912,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.039654999999999996},"relatedVulnerabilities":[{"id":"CVE-2026-22796","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22796","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: A type confusion vulnerability exists in the signature\nverification of signed PKCS#7 data where an ASN1_TYPE union member is\naccessed without first validating the type, causing an invalid or NULL\npointer dereference when processing malformed PKCS#7 data.\n\nImpact summary: An application performing signature verification of PKCS#7\ndata or calling directly the PKCS7_digest_from_attributes() function can be\ncaused to dereference an invalid or NULL pointer when reading, resulting in\na Denial of Service.\n\nThe function PKCS7_digest_from_attributes() accesses the message digest attribute\nvalue without validating its type. When the type is not V_ASN1_OCTET_STRING,\nthis results in accessing invalid memory through the ASN1_TYPE union, causing\na crash.\n\nExploiting this vulnerability requires an attacker to provide a malformed\nsigned PKCS#7 to an application that verifies it. The impact of the\nexploit is just a Denial of Service, the PKCS7 API is legacy and applications\nshould be using the CMS API instead. For these reasons the issue was\nassessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS#7 parsing implementation is outside the OpenSSL FIPS module\nboundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22796","epss":0.00077,"percentile":0.22912,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-22796","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2026-22796","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-r5mx-6wc6-7h9w","dataSource":"https://github.com/advisories/GHSA-r5mx-6wc6-7h9w","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w","https://nvd.nist.gov/vuln/detail/CVE-2026-27837","https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14","https://github.com/advisories/GHSA-4gxf-g5gf-22h4"],"description":"dottie is vulnerable to Prototype Pollution bypass via non-first path segments in set() and transform()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27837","epss":0.00066,"percentile":0.20287,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27837","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.7"],"state":"fixed","available":[{"version":"2.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03729},"relatedVulnerabilities":[{"id":"CVE-2026-27837","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27837","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/advisories/GHSA-4gxf-g5gf-22h4","https://github.com/mickhansen/dottie.js/commit/7e8fa1345a4b46325f0eab8d7aeb1c4deaefdb14","https://github.com/mickhansen/dottie.js/security/advisories/GHSA-r5mx-6wc6-7h9w"],"description":"Dottie provides nested object access and manipulation in JavaScript. Versions 2.0.4 through 2.0.6 contain an incomplete fix for CVE-2023-26132. The prototype pollution guard introduced in commit `7d3aee1` only validates the first segment of a dot-separated path, allowing an attacker to bypass the protection by placing `__proto__` at any position other than the first. Both `dottie.set()` and `dottie.transform()` are affected. Version 2.0.7 contains an updated fix to address the residual vulnerability.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27837","epss":0.00066,"percentile":0.20287,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27837","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"dottie","version":"2.0.6"}},"found":{"vulnerabilityID":"GHSA-r5mx-6wc6-7h9w","versionConstraint":">=2.0.4,<=2.0.6 (semantic)"},"fix":{"suggestedVersion":"2.0.7"}}],"artifact":{"id":"2a9aa5060d0355d3","name":"dottie","version":"2.0.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/dottie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/dottie/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:dottie_project:dottie:2.0.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/dottie@2.0.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-44fp-w29j-9vj5","dataSource":"https://github.com/advisories/GHSA-44fp-w29j-9vj5","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5","https://nvd.nist.gov/vuln/detail/CVE-2025-47935","https://github.com/expressjs/multer/pull/1120","https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665"],"description":"Multer vulnerable to Denial of Service via memory leaks from unclosed streams","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47935","epss":0.00048,"percentile":0.14879,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-47935","cwe":"CWE-401","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.0"],"state":"fixed","available":[{"version":"2.0.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.036000000000000004},"relatedVulnerabilities":[{"id":"CVE-2025-47935","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47935","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665","https://github.com/expressjs/multer/pull/1120","https://github.com/expressjs/multer/security/advisories/GHSA-44fp-w29j-9vj5"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. Versions prior to 2.0.0 are vulnerable to a resource exhaustion and memory leak issue due to improper stream handling. When the HTTP request stream emits an error, the internal `busboy` stream is not closed, violating Node.js stream safety guidance. This leads to unclosed streams accumulating over time, consuming memory and file descriptors. Under sustained or repeated failure conditions, this can result in denial of service, requiring manual server restarts to recover. All users of Multer handling file uploads are potentially impacted. Users should upgrade to 2.0.0 to receive a patch. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47935","epss":0.00048,"percentile":0.14879,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-47935","cwe":"CWE-401","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-44fp-w29j-9vj5","versionConstraint":"<2.0.0 (semantic)"},"fix":{"suggestedVersion":"2.0.0"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-v52c-386h-88mc","dataSource":"https://github.com/advisories/GHSA-v52c-386h-88mc","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc","https://nvd.nist.gov/vuln/detail/CVE-2026-2359","https://github.com/expressjs/multer/commit/cccf0fe0e64150c4f42ccf6654165c0d66b9adab","https://cna.openjsf.org/security-advisories.html","https://www.cve.org/CVERecord?id=CVE-2026-2359"],"description":"Multer vulnerable to Denial of Service via resource exhaustion","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2359","epss":0.00042,"percentile":0.12762,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-2359","cwe":"CWE-772","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.1.0"],"state":"fixed","available":[{"version":"2.1.0","date":"2026-03-01","kind":"first-observed"}]},"advisories":[],"risk":0.034019999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-2359","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2359","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/commit/cccf0fe0e64150c4f42ccf6654165c0d66b9adab","https://github.com/expressjs/multer/security/advisories/GHSA-v52c-386h-88mc","https://www.cve.org/CVERecord?id=CVE-2026-2359"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by dropping connection during file upload, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2359","epss":0.00042,"percentile":0.12762,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-2359","cwe":"CWE-772","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-v52c-386h-88mc","versionConstraint":"<2.1.0 (semantic)"},"fix":{"suggestedVersion":"2.1.0"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-xf7r-hgr6-v32p","dataSource":"https://github.com/advisories/GHSA-xf7r-hgr6-v32p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p","https://nvd.nist.gov/vuln/detail/CVE-2026-3304","https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee","https://cna.openjsf.org/security-advisories.html","https://www.cve.org/CVERecord?id=CVE-2026-3304"],"description":"Multer vulnerable to Denial of Service via incomplete cleanup","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-3304","epss":0.00042,"percentile":0.12762,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-3304","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.1.0"],"state":"fixed","available":[{"version":"2.1.0","date":"2026-03-01","kind":"first-observed"}]},"advisories":[],"risk":0.034019999999999995},"relatedVulnerabilities":[{"id":"CVE-2026-3304","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-3304","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/commit/739919097dde3921ec31b930e4b9025036fa74ee","https://github.com/expressjs/multer/security/advisories/GHSA-xf7r-hgr6-v32p","https://www.cve.org/CVERecord?id=CVE-2026-3304"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability in Multer prior to version 2.1.0 allows an attacker to trigger a Denial of Service (DoS) by sending malformed requests, potentially causing resource exhaustion. Users should upgrade to version 2.1.0 to receive a patch. No known workarounds are available.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-3304","epss":0.00042,"percentile":0.12762,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-3304","cwe":"CWE-459","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-xf7r-hgr6-v32p","versionConstraint":"<2.1.0 (semantic)"},"fix":{"suggestedVersion":"2.1.0"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.5"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"a7d9f58fa9223af7","name":"minimatch","version":"3.0.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.8"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"64792428adfc1585","name":"minimatch","version":"3.0.8","type":"npm","locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"203e6da42d80803d","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"31053d1a3eefafcf","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/archiver-utils/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"34e3a98e2f474c3f","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/ignore-walk/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ignore-walk/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"60218374fb088257","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"a88006b8a0ec9567","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/fstream/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/fstream/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"182b6a07cfd75764","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"2ea489db3cb444cd","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/file-js/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/file-js/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"5c4dec26d80d1f6e","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/rimraf/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/rimraf/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.3"],"state":"fixed","available":[{"version":"3.1.3","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":"<3.1.3 (semantic)"},"fix":{"suggestedVersion":"3.1.3"}}],"artifact":{"id":"c46d28efb236e0c8","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["5.1.8"],"state":"fixed","available":[{"version":"5.1.8","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"5.1.6"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":">=5.0.0,<5.1.8 (semantic)"},"fix":{"suggestedVersion":"5.1.8"}}],"artifact":{"id":"ae8bd0e649f1262b","name":"minimatch","version":"5.1.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/filehound/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/filehound/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:5.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@5.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-7r86-cg39-jmmj","dataSource":"https://github.com/advisories/GHSA-7r86-cg39-jmmj","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj","https://nvd.nist.gov/vuln/detail/CVE-2026-27903","https://github.com/isaacs/minimatch/commit/0bf499aa45f5059b56809cc3b75ff3eafeb8d748"],"description":"minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.03375},"relatedVulnerabilities":[{"id":"CVE-2026-27903","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27903","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-7r86-cg39-jmmj"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3, `matchOne()` performs unbounded recursive backtracking when a glob pattern contains multiple non-adjacent `**` (GLOBSTAR) segments and the input path does not match. The time complexity is O(C(n, k)) -- binomial -- where `n` is the number of path segments and `k` is the number of globstars. With k=11 and n=30, a call to the default `minimatch()` API stalls for roughly 5 seconds. With k=13, it exceeds 15 seconds. No memoization or call budget exists to bound this behavior. Any application where an attacker can influence the glob pattern passed to `minimatch()` is vulnerable. The realistic attack surface includes build tools and task runners that accept user-supplied glob arguments (ESLint, Webpack, Rollup config), multi-tenant systems where one tenant configures glob-based rules that run in a shared process, admin or developer interfaces that accept ignore-rule or filter configuration as globs, and CI/CD pipelines that evaluate user-submitted config files containing glob patterns. An attacker who can place a crafted pattern into any of these paths can stall the Node.js event loop for tens of seconds per invocation. The pattern is 56 bytes for a 5-second stall and does not require authentication in contexts where pattern input is part of the feature. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.3 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27903","epss":0.00045,"percentile":0.13681,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27903","cwe":"CWE-407","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-7r86-cg39-jmmj","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"1f297f7286432e88","name":"minimatch","version":"9.0.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/glob/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/glob/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.5","upstreams":[]}},{"vulnerability":{"id":"CVE-2019-1010024","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010024","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[],"epss":[{"cve":"CVE-2019-1010024","epss":0.00646,"percentile":0.70465,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0323},"relatedVulnerabilities":[{"id":"CVE-2019-1010024","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010024","namespace":"nvd:cpe","severity":"Medium","urls":["http://www.securityfocus.com/bid/109162","https://security-tracker.debian.org/tracker/CVE-2019-1010024","https://sourceware.org/bugzilla/show_bug.cgi?id=22852","https://support.f5.com/csp/article/K06046097","https://support.f5.com/csp/article/K06046097?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010024"],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass ASLR using cache of thread stack and heap. The component is: glibc. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","metrics":{"baseScore":5,"exploitabilityScore":10,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010024","epss":0.00646,"percentile":0.70465,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-1010024","cwe":"CWE-200","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010024","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-99p7-6v5w-7xg8","dataSource":"https://github.com/advisories/GHSA-99p7-6v5w-7xg8","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8","https://github.com/patriksimek/vm2/commit/4b009c2d4b1131c01810c1205e641d614c322a29","https://github.com/patriksimek/vm2/releases/tag/v3.10.2","https://nvd.nist.gov/vuln/detail/CVE-2026-22709"],"description":"vm2 has a Sandbox Escape","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22709","epss":0.00033,"percentile":0.09271,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-22709","cwe":"CWE-94","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-22709","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-22709","cwe":"CWE-913","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.10.2"],"state":"fixed","available":[{"version":"3.10.2","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.03102},"relatedVulnerabilities":[{"id":"CVE-2026-22709","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22709","namespace":"nvd:cpe","severity":"Critical","urls":["https://github.com/patriksimek/vm2/commit/4b009c2d4b1131c01810c1205e641d614c322a29","https://github.com/patriksimek/vm2/releases/tag/v3.10.2","https://github.com/patriksimek/vm2/security/advisories/GHSA-99p7-6v5w-7xg8"],"description":"vm2 is an open source vm/sandbox for Node.js. In vm2 prior to version 3.10.2, `Promise.prototype.then` `Promise.prototype.catch` callback sanitization can be bypassed. This allows attackers to escape the sandbox and run arbitrary code. In lib/setup-sandbox.js, the callback function of `localPromise.prototype.then` is sanitized, but `globalPromise.prototype.then` is not sanitized. The return value of async functions is `globalPromise` object. Version 3.10.2 fixes the issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","metrics":{"baseScore":10,"exploitabilityScore":3.9,"impactScore":6.1},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22709","epss":0.00033,"percentile":0.09271,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-22709","cwe":"CWE-94","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-22709","cwe":"CWE-693","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-22709","cwe":"CWE-913","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"vm2","version":"3.9.17"}},"found":{"vulnerabilityID":"GHSA-99p7-6v5w-7xg8","versionConstraint":"<=3.10.1 (semantic)"},"fix":{"suggestedVersion":"3.10.2"}}],"artifact":{"id":"9137ec7afce7bb08","name":"vm2","version":"3.9.17","type":"npm","locations":[{"path":"/juice-shop/node_modules/vm2/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/vm2/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:vm2_project:vm2:3.9.17:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/vm2@3.9.17","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.5"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"a7d9f58fa9223af7","name":"minimatch","version":"3.0.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.0.8"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"64792428adfc1585","name":"minimatch","version":"3.0.8","type":"npm","locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.0.8:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.0.8","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"c46d28efb236e0c8","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"31053d1a3eefafcf","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/archiver-utils/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"2ea489db3cb444cd","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/file-js/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/file-js/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"a88006b8a0ec9567","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/fstream/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/fstream/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"34e3a98e2f474c3f","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/ignore-walk/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ignore-walk/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"182b6a07cfd75764","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"5c4dec26d80d1f6e","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/rimraf/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/rimraf/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"203e6da42d80803d","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["3.1.4"],"state":"fixed","available":[{"version":"3.1.4","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"3.1.2"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":"<3.1.4 (semantic)"},"fix":{"suggestedVersion":"3.1.4"}}],"artifact":{"id":"60218374fb088257","name":"minimatch","version":"3.1.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:3.1.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@3.1.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["5.1.8"],"state":"fixed","available":[{"version":"5.1.8","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"5.1.6"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":">=5.0.0,<5.1.8 (semantic)"},"fix":{"suggestedVersion":"5.1.8"}}],"artifact":{"id":"ae8bd0e649f1262b","name":"minimatch","version":"5.1.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/filehound/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/filehound/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:5.1.6:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@5.1.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-23c5-xmqv-rm74","dataSource":"https://github.com/advisories/GHSA-23c5-xmqv-rm74","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74","https://nvd.nist.gov/vuln/detail/CVE-2026-27904","https://github.com/isaacs/minimatch/commit/11d0df6165d15a955462316b26d52e5efae06fce"],"description":"minimatch ReDoS: nested *() extglobs generate catastrophically backtracking regular expressions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["9.0.7"],"state":"fixed","available":[{"version":"9.0.7","date":"2026-02-27","kind":"first-observed"}]},"advisories":[],"risk":0.030000000000000002},"relatedVulnerabilities":[{"id":"CVE-2026-27904","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-27904","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/minimatch/security/advisories/GHSA-23c5-xmqv-rm74"],"description":"minimatch is a minimal matching utility for converting glob expressions into JavaScript RegExp objects. Prior to version 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4, nested `*()` extglobs produce regexps with nested unbounded quantifiers (e.g. `(?:(?:a|b)*)*`), which exhibit catastrophic backtracking in V8. With a 12-byte pattern `*(*(*(a|b)))` and an 18-byte non-matching input, `minimatch()` stalls for over 7 seconds. Adding a single nesting level or a few input characters pushes this to minutes. This is the most severe finding: it is triggered by the default `minimatch()` API with no special options, and the minimum viable pattern is only 12 bytes. The same issue affects `+()` extglobs equally. Versions 10.2.3, 9.0.7, 8.0.6, 7.4.8, 6.2.2, 5.1.8, 4.2.5, and 3.1.4 fix the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-27904","epss":0.0004,"percentile":0.11958,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-27904","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"minimatch","version":"9.0.5"}},"found":{"vulnerabilityID":"GHSA-23c5-xmqv-rm74","versionConstraint":">=9.0.0,<9.0.7 (semantic)"},"fix":{"suggestedVersion":"9.0.7"}}],"artifact":{"id":"1f297f7286432e88","name":"minimatch","version":"9.0.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/glob/node_modules/minimatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/glob/node_modules/minimatch/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:minimatch_project:minimatch:9.0.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/minimatch@9.0.5","upstreams":[]}},{"vulnerability":{"id":"GHSA-hjrf-2m68-5959","dataSource":"https://github.com/advisories/GHSA-hjrf-2m68-5959","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23541","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.0006,"percentile":0.18766,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23541","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"CWE-1259","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.03},"relatedVulnerabilities":[{"id":"CVE-2022-23541","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23541","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.0006,"percentile":0.18766,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23541","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"CWE-1259","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-hjrf-2m68-5959","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-hjrf-2m68-5959","dataSource":"https://github.com/advisories/GHSA-hjrf-2m68-5959","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23541","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken's insecure implementation of key retrieval function could lead to Forgeable Public/Private Tokens from RSA to HMAC","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.0006,"percentile":0.18766,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23541","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"CWE-1259","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.03},"relatedVulnerabilities":[{"id":"CVE-2022-23541","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23541","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/releases/tag/v9.0.0","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-hjrf-2m68-5959","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"jsonwebtoken is an implementation of JSON Web Tokens. Versions `<= 8.5.1` of `jsonwebtoken` library can be misconfigured so that passing a poorly implemented key retrieval function referring to the `secretOrPublicKey` argument from the readme link will result in incorrect verification of tokens. There is a possibility of using a different algorithm and key combination in verification, other than the one that was used to sign the tokens. Specifically, tokens signed with an asymmetric public key could be verified with a symmetric HS256 algorithm. This can lead to successful validation of forged tokens. If your application is supporting usage of both symmetric key and asymmetric key in jwt.verify() implementation with the same key retrieval function. This issue has been patched, please update to version 9.0.0.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":6.3,"exploitabilityScore":2.9,"impactScore":3.4},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","metrics":{"baseScore":5,"exploitabilityScore":1.7,"impactScore":3.4},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23541","epss":0.0006,"percentile":0.18766,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23541","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"CWE-1259","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23541","cwe":"NVD-CWE-Other","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-hjrf-2m68-5959","versionConstraint":"<=8.5.1 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-5j98-mcp5-4vw2","dataSource":"https://github.com/advisories/GHSA-5j98-mcp5-4vw2","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2","https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146","https://nvd.nist.gov/vuln/detail/CVE-2025-64756","https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f"],"description":"glob CLI: Command injection via -c/--cmd executes matches with shell:true","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64756","epss":0.00038,"percentile":0.11365,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-64756","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["10.5.0"],"state":"fixed","available":[{"version":"10.5.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.028499999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-64756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64756","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-glob/commit/1e4e297342a09f2aa0ced87fcd4a70ddc325d75f","https://github.com/isaacs/node-glob/commit/47473c046b91c67269df7a66eab782a6c2716146","https://github.com/isaacs/node-glob/security/advisories/GHSA-5j98-mcp5-4vw2"],"description":"Glob matches files using patterns the shell uses. Starting in version 10.2.0 and prior to versions 10.5.0 and 11.1.0, the glob CLI contains a command injection vulnerability in its -c/--cmd option that allows arbitrary command execution when processing files with malicious names. When glob -c are used, matched filenames are passed to a shell with shell: true, enabling shell metacharacters in filenames to trigger command injection and achieve arbitrary code execution under the user or CI account privileges. This issue has been patched in versions 10.5.0 and 11.1.0.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":1.7,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64756","epss":0.00038,"percentile":0.11365,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-64756","cwe":"CWE-78","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"glob","version":"10.4.5"}},"found":{"vulnerabilityID":"GHSA-5j98-mcp5-4vw2","versionConstraint":">=10.2.0,<10.5.0 (semantic)"},"fix":{"suggestedVersion":"10.5.0"}}],"artifact":{"id":"ba9bf93e12b9ecba","name":"glob","version":"10.4.5","type":"npm","locations":[{"path":"/juice-shop/node_modules/glob/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/glob/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:isaacs:glob:10.4.5:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/glob@10.4.5","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-21637","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-21637","namespace":"nvd:cpe","severity":"High","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"A flaw in Node.js TLS error handling allows remote attackers to crash or exhaust resources of a TLS server when `pskCallback` or `ALPNCallback` are in use. Synchronous exceptions thrown during these callbacks bypass standard TLS error handling paths (tlsClientError and error), causing either immediate process termination or silent file descriptor leaks that eventually lead to denial of service. Because these callbacks process attacker-controlled input during the TLS handshake, a remote client can repeatedly trigger the issue. This vulnerability affects TLS servers using PSK or ALPN callbacks across Node.js versions where these callbacks throw without being safely wrapped.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-21637","epss":0.00038,"percentile":0.1112,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-21637","cwe":"CWE-400","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.02698},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2026-21637","versionConstraint":"< 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-55131","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55131","namespace":"nvd:cpe","severity":"High","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"A flaw in Node.js's buffer allocation logic can expose uninitialized memory when allocations are interrupted, when using the `vm` module with the timeout option. Under specific timing conditions, buffers allocated with `Buffer.alloc` and other `TypedArray` instances like `Uint8Array` may contain leftover data from previous operations, allowing in-process secrets like tokens or passwords to leak or causing data corruption. While exploitation typically requires precise timing or in-process code execution, it can become remotely exploitable when untrusted input influences workload and timeouts, leading to potential confidentiality and integrity impact.","cvss":[{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:L","metrics":{"baseScore":7.1,"exploitabilityScore":1.7,"impactScore":5.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-55131","epss":0.00031,"percentile":0.08855,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-55131","cwe":"CWE-120","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.02263},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2025-55131","versionConstraint":"< 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qhxp-v273-g94h","dataSource":"https://github.com/advisories/GHSA-qhxp-v273-g94h","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2019-25225","https://github.com/apostrophecms/sanitize-html/issues/293","https://github.com/apostrophecms/sanitize-html/pull/156","https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3","https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225"],"description":"sanitize-html is vulnerable to XSS through incomprehensive sanitization","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-25225","epss":0.0004,"percentile":0.11959,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-25225","cwe":"CWE-79","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}],"fix":{"versions":["2.0.0-beta"],"state":"fixed","available":[{"version":"2.0.0-beta","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.022199999999999998},"relatedVulnerabilities":[{"id":"CVE-2019-25225","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-25225","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/Checkmarx/Vulnerabilities-Proofs-of-Concept/tree/main/2019/CVE-2019-25225","https://github.com/apostrophecms/sanitize-html/commit/712cb6895825c8bb6ede71a16b42bade42abcaf3","https://github.com/apostrophecms/sanitize-html/issues/293","https://github.com/apostrophecms/sanitize-html/pull/156"],"description":"`sanitize-html` prior to version 2.0.0-beta is vulnerable to Cross-site Scripting (XSS). The `sanitizeHtml()` function in `index.js` does not sanitize content when using the custom `transformTags` option, which is intended to convert attribute values into text. As a result, malicious input can be transformed into executable code.","cvss":[{"source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-25225","epss":0.0004,"percentile":0.11959,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-25225","cwe":"CWE-79","source":"596c5446-0ce5-4ba2-aa66-48b3b757a647","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"sanitize-html","version":"1.4.2"}},"found":{"vulnerabilityID":"GHSA-qhxp-v273-g94h","versionConstraint":"<2.0.0-beta (semantic)"},"fix":{"suggestedVersion":"2.0.0-beta"}}],"artifact":{"id":"5de04e7baabe2ecd","name":"sanitize-html","version":"1.4.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/sanitize-html/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sanitize-html/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:apostrophecms:sanitize-html:1.4.2:*:*:*:*:node.js:*:*","cpe:2.3:a:punkave:sanitize-html:1.4.2:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/sanitize-html@1.4.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-vj76-c3g6-qr5v","dataSource":"https://github.com/advisories/GHSA-vj76-c3g6-qr5v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v","https://nvd.nist.gov/vuln/detail/CVE-2025-59343","https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09","https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html"],"description":"tar-fs has a symlink validation bypass if destination directory is predictable with a specific tarball","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59343","epss":0.00027,"percentile":0.07193,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-59343","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-59343","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.1.4"],"state":"fixed","available":[{"version":"2.1.4","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.021869999999999997},"relatedVulnerabilities":[{"id":"CVE-2025-59343","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59343","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/mafintosh/tar-fs/commit/0bd54cdf06da2b7b5b95cd4b062c9f4e0a8c4e09","https://github.com/mafintosh/tar-fs/security/advisories/GHSA-vj76-c3g6-qr5v","https://lists.debian.org/debian-lts-announce/2025/09/msg00028.html"],"description":"tar-fs provides filesystem bindings for tar-stream. Versions prior to 3.1.1, 2.1.3, and 1.16.5 are vulnerable to symlink validation bypass if the destination directory is predictable with a specific tarball. This issue has been patched in version 3.1.1, 2.1.4, and 1.16.6. A workaround involves using the ignore option on non files/directories.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59343","epss":0.00027,"percentile":0.07193,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-59343","cwe":"CWE-22","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2025-59343","cwe":"CWE-61","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar-fs","version":"2.1.3"}},"found":{"vulnerabilityID":"GHSA-vj76-c3g6-qr5v","versionConstraint":">=2.0.0,<2.1.4 (semantic)"},"fix":{"suggestedVersion":"2.1.4"}}],"artifact":{"id":"9680d7d122bfb97a","name":"tar-fs","version":"2.1.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/tar-fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:mafintosh:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:mafintosh:tar_fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar-fs:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar-fs:tar_fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar_fs:tar_fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar-fs:2.1.3:*:*:*:*:*:*:*","cpe:2.3:a:tar:tar_fs:2.1.3:*:*:*:*:*:*:*"],"purl":"pkg:npm/tar-fs@2.1.3","upstreams":[]}},{"vulnerability":{"id":"CVE-2010-4756","dataSource":"https://security-tracker.debian.org/tracker/CVE-2010-4756","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.","cvss":[],"epss":[{"cve":"CVE-2010-4756","epss":0.00394,"percentile":0.59984,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.019700000000000002},"relatedVulnerabilities":[{"id":"CVE-2010-4756","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2010-4756","namespace":"nvd:cpe","severity":"Medium","urls":["http://cxib.net/stuff/glob-0day.c","http://securityreason.com/achievement_securityalert/89","http://securityreason.com/exploitalert/9223","https://bugzilla.redhat.com/show_bug.cgi?id=681681","https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2010-4756","https://security.netapp.com/advisory/ntap-20241108-0002/"],"description":"The glob implementation in the GNU C Library (aka glibc or libc6) allows remote authenticated users to cause a denial of service (CPU and memory consumption) via crafted glob expressions that do not match any pathnames, as demonstrated by glob expressions in STAT commands to an FTP daemon, a different vulnerability than CVE-2010-2632.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:S/C:N/I:N/A:P","metrics":{"baseScore":4,"exploitabilityScore":8,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2010-4756","epss":0.00394,"percentile":0.59984,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2010-4756","cwe":"CWE-399","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2010-4756","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-9965-vmph-33xx","dataSource":"https://github.com/advisories/GHSA-9965-vmph-33xx","namespace":"github:language:javascript","severity":"Medium","urls":["https://nvd.nist.gov/vuln/detail/CVE-2025-56200","https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666","https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596","https://github.com/validatorjs/validator.js","http://validatorjs.com","https://github.com/validatorjs/validator.js/issues/2600","https://github.com/validatorjs/validator.js/pull/2608","https://github.com/validatorjs/validator.js/commit/cbef5088f02d36caf978f378bb845fe49bdc0809","https://github.com/validatorjs/validator.js/releases/tag/13.15.20"],"description":"validator.js has a URL validation bypass vulnerability in its isURL function","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-56200","epss":0.00035,"percentile":0.09994,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-56200","cwe":"CWE-79","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["13.15.20"],"state":"fixed","available":[{"version":"13.15.20","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.019424999999999998},"relatedVulnerabilities":[{"id":"CVE-2025-56200","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-56200","namespace":"nvd:cpe","severity":"Medium","urls":["http://validatorjs.com","https://gist.github.com/junan-98/27ae092aa40e2a057d41a0f95148f666","https://gist.github.com/junan-98/a93130505b258b9e4ec9f393e7533596","https://github.com/validatorjs/validator.js"],"description":"A URL validation bypass vulnerability exists in validator.js through version 13.15.15. The isURL() function uses '://' as a delimiter to parse protocols, while browsers use ':' as the delimiter. This parsing difference allows attackers to bypass protocol and domain validation by crafting URLs leading to XSS and Open Redirect attacks.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":2.9,"impactScore":2.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-56200","epss":0.00035,"percentile":0.09994,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-56200","cwe":"CWE-79","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"validator","version":"13.15.15"}},"found":{"vulnerabilityID":"GHSA-9965-vmph-33xx","versionConstraint":"<13.15.20 (semantic)"},"fix":{"suggestedVersion":"13.15.20"}}],"artifact":{"id":"3b9b91f7d23a3503","name":"validator","version":"13.15.15","type":"npm","locations":[{"path":"/juice-shop/node_modules/validator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/validator/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:validator_project:validator:13.15.15:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/validator@13.15.15","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-9230","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-9230","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Issue summary: An application trying to decrypt CMS messages encrypted using password based encryption can trigger an out-of-bounds read and write. Impact summary: This out-of-bounds read may trigger a crash which leads to Denial of Service for an application. The out-of-bounds write can cause a memory corruption which can have various consequences including a Denial of Service or Execution of attacker-supplied code. Although the consequences of a successful exploit of this vulnerability could be severe, the probability that the attacker would be able to perform it is low. Besides, password based (PWRI) encryption support in CMS messages is very rarely used. For that reason the issue was assessed as Moderate severity according to our Security Policy. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the CMS implementation is outside the OpenSSL FIPS module boundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9230","epss":0.00022,"percentile":0.0571,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","source":"openssl-security@openssl.org","type":"Secondary"},{"cve":"CVE-2025-9230","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.17-1~deb12u3"],"state":"fixed","available":[{"version":"3.0.17-1~deb12u3","date":"2025-10-01","kind":"advisory"}]},"advisories":[{"id":"DSA-6015-1","link":"https://security-tracker.debian.org/tracker/DSA-6015-1"}],"risk":0.0165},"relatedVulnerabilities":[{"id":"CVE-2025-9230","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9230","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/openssl/openssl/commit/5965ea5dd6960f36d8b7f74f8eac67a8eb8f2b45","https://github.com/openssl/openssl/commit/9e91358f365dee6c446dcdcdb01c04d2743fd280","https://github.com/openssl/openssl/commit/a79c4ce559c6a3a8fd4109e9f33c1185d5bf2def","https://github.com/openssl/openssl/commit/b5282d677551afda7d20e9c00e09561b547b2dfd","https://github.com/openssl/openssl/commit/bae259a211ada6315dc50900686daaaaaa55f482","https://github.openssl.org/openssl/extended-releases/commit/c2b96348bfa662f25f4fabf81958ae822063dae3","https://github.openssl.org/openssl/extended-releases/commit/dfbaf161d8dafc1132dd88cd48ad990ed9b4c8ba","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5","https://lists.debian.org/debian-lts-announce/2025/10/msg00001.html"],"description":"Issue summary: An application trying to decrypt CMS messages encrypted using\npassword based encryption can trigger an out-of-bounds read and write.\n\nImpact summary: This out-of-bounds read may trigger a crash which leads to\nDenial of Service for an application. The out-of-bounds write can cause\na memory corruption which can have various consequences including\na Denial of Service or Execution of attacker-supplied code.\n\nAlthough the consequences of a successful exploit of this vulnerability\ncould be severe, the probability that the attacker would be able to\nperform it is low. Besides, password based (PWRI) encryption support in CMS\nmessages is very rarely used. For that reason the issue was assessed as\nModerate severity according to our Security Policy.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the CMS implementation is outside the OpenSSL FIPS module\nboundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9230","epss":0.00022,"percentile":0.0571,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-9230","cwe":"CWE-125","source":"openssl-security@openssl.org","type":"Secondary"},{"cve":"CVE-2025-9230","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-9230","versionConstraint":"< 3.0.17-1~deb12u3 (deb)"},"fix":{"suggestedVersion":"3.0.17-1~deb12u3"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2019-1010023","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010023","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[],"epss":[{"cve":"CVE-2019-1010023","epss":0.00322,"percentile":0.54971,"date":"2026-03-01"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0161},"relatedVulnerabilities":[{"id":"CVE-2019-1010023","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010023","namespace":"nvd:cpe","severity":"High","urls":["http://www.securityfocus.com/bid/109167","https://security-tracker.debian.org/tracker/CVE-2019-1010023","https://sourceware.org/bugzilla/show_bug.cgi?id=22851","https://support.f5.com/csp/article/K11932200?utm_source=f5support&%3Butm_medium=RSS","https://ubuntu.com/security/CVE-2019-1010023"],"description":"GNU Libc current is affected by: Re-mapping current loaded library with malicious ELF file. The impact is: In worst case attacker may evaluate privileges. The component is: libld. The attack vector is: Attacker sends 2 ELF files to victim and asks to run ldd on it. ldd execute code. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","metrics":{"baseScore":6.8,"exploitabilityScore":8.6,"impactScore":6.5},"vendorMetadata":{}},{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","metrics":{"baseScore":5.4,"exploitabilityScore":2.9,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010023","epss":0.00322,"percentile":0.54971,"date":"2026-03-01"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010023","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2025-59466","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-59466","namespace":"nvd:cpe","severity":"High","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"We have identified a bug in Node.js error handling where \"Maximum call stack size exceeded\" errors become uncatchable when `async_hooks.createHook()` is enabled. Instead of reaching `process.on('uncaughtException')`, the process terminates, making the crash unrecoverable. Applications that rely on `AsyncLocalStorage` (v22, v20) or `async_hooks.createHook()` (v24, v22, v20) become vulnerable to denial-of-service crashes triggered by deep recursion under specific conditions.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-59466","epss":0.00022,"percentile":0.05615,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-59466","cwe":"CWE-248","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.01562},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2025-59466","versionConstraint":"< 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-xxjr-mmjv-4gpg","dataSource":"https://github.com/advisories/GHSA-xxjr-mmjv-4gpg","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg","https://nvd.nist.gov/vuln/detail/CVE-2025-13465","https://github.com/lodash/lodash/commit/edadd452146f7e4bad4ea684e955708931d84d81"],"description":"Lodash has Prototype Pollution Vulnerability in `_.unset` and `_.omit` functions","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","metrics":{"baseScore":6.5,"exploitabilityScore":3.9,"impactScore":2.6},"vendorMetadata":{}},{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.00025,"percentile":0.06755,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["4.17.23"],"state":"fixed","available":[{"version":"4.17.23","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.014625},"relatedVulnerabilities":[{"id":"CVE-2025-13465","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-13465","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/lodash/lodash/security/advisories/GHSA-xxjr-mmjv-4gpg"],"description":"Lodash versions 4.0.0 through 4.17.22 are vulnerable to prototype pollution in the _.unset and _.omit functions. An attacker can pass crafted paths which cause Lodash to delete methods from global prototypes.\n\nThe issue permits deletion of properties but does not allow overwriting their original behavior.\n\nThis issue is patched on 4.17.23","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:L/SC:H/SI:H/SA:H/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-13465","epss":0.00025,"percentile":0.06755,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-13465","cwe":"CWE-1321","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"lodash","version":"4.17.21"}},"found":{"vulnerabilityID":"GHSA-xxjr-mmjv-4gpg","versionConstraint":">=4.0.0,<=4.17.22 (semantic)"},"fix":{"suggestedVersion":"4.17.23"}}],"artifact":{"id":"32afa1bf90ac61bc","name":"lodash","version":"4.17.21","type":"npm","locations":[{"path":"/juice-shop/node_modules/lodash/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/lodash/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:lodash:lodash:4.17.21:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/lodash@4.17.21","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-0915","dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-0915","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-0915","epss":0.00019,"percentile":0.04712,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.014249999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-0915","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0915","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33802","http://www.openwall.com/lists/oss-security/2026/01/16/6"],"description":"Calling getnetbyaddr or getnetbyaddr_r with a configured nsswitch.conf that specifies the library's DNS backend for networks and queries for a zero-valued network in the GNU C Library version 2.0 to version 2.42 can leak stack contents to the configured DNS resolver.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-0915","epss":0.00019,"percentile":0.04712,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-0915","cwe":"CWE-908","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2026-0915","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-w7fw-mjwx-w883","dataSource":"https://github.com/advisories/GHSA-w7fw-mjwx-w883","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883","https://nvd.nist.gov/vuln/detail/CVE-2026-2391","https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482"],"description":"qs's arrayLimit bypass in comma parsing allows denial of service","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00039,"percentile":0.11794,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}],"fix":{"versions":["6.14.2"],"state":"fixed","available":[{"version":"6.14.2","date":"2026-02-14","kind":"first-observed"}]},"advisories":[],"risk":0.013064999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-2391","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-2391","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/ljharb/qs/commit/f6a7abff1f13d644db9b05fe4f2c98ada6bf8482","https://github.com/ljharb/qs/security/advisories/GHSA-w7fw-mjwx-w883"],"description":"### Summary\nThe `arrayLimit` option in qs does not enforce limits for comma-separated values when `comma: true` is enabled, allowing attackers to cause denial-of-service via memory exhaustion. This is a bypass of the array limit enforcement, similar to the bracket notation bypass addressed in GHSA-6rw7-vpxm-498p (CVE-2025-15284).\n\n### Details\nWhen the `comma` option is set to `true` (not the default, but configurable in applications), qs allows parsing comma-separated strings as arrays (e.g., `?param=a,b,c` becomes `['a', 'b', 'c']`). However, the limit check for `arrayLimit` (default: 20) and the optional throwOnLimitExceeded occur after the comma-handling logic in `parseArrayValue`, enabling a bypass. This permits creation of arbitrarily large arrays from a single parameter, leading to excessive memory allocation.\n\n**Vulnerable code** (lib/parse.js: lines ~40-50):\n```js\nif (val && typeof val === 'string' && options.comma && val.indexOf(',') > -1) {\n return val.split(',');\n}\n\nif (options.throwOnLimitExceeded && currentArrayLength >= options.arrayLimit) {\n throw new RangeError('Array limit exceeded. Only ' + options.arrayLimit + ' element' + (options.arrayLimit === 1 ? '' : 's') + ' allowed in an array.');\n}\n\nreturn val;\n```\nThe `split(',')` returns the array immediately, skipping the subsequent limit check. Downstream merging via `utils.combine` does not prevent allocation, even if it marks overflows for sparse arrays.This discrepancy allows attackers to send a single parameter with millions of commas (e.g., `?param=,,,,,,,,...`), allocating massive arrays in memory without triggering limits. It bypasses the intent of `arrayLimit`, which is enforced correctly for indexed (`a[0]=`) and bracket (`a[]=`) notations (the latter fixed in v6.14.1 per GHSA-6rw7-vpxm-498p).\n\n### PoC\n**Test 1 - Basic bypass:**\n```\nnpm install qs\n```\n\n```js\nconst qs = require('qs');\n\nconst payload = 'a=' + ','.repeat(25); // 26 elements after split (bypasses arrayLimit: 5)\nconst options = { comma: true, arrayLimit: 5, throwOnLimitExceeded: true };\n\ntry {\n const result = qs.parse(payload, options);\n console.log(result.a.length); // Outputs: 26 (bypass successful)\n} catch (e) {\n console.log('Limit enforced:', e.message); // Not thrown\n}\n```\n**Configuration:**\n- `comma: true`\n- `arrayLimit: 5`\n- `throwOnLimitExceeded: true`\n\nExpected: Throws \"Array limit exceeded\" error.\nActual: Parses successfully, creating an array of length 26.\n\n\n### Impact\nDenial of Service (DoS) via memory exhaustion.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":6.3},"vendorMetadata":{}},{"source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L","metrics":{"baseScore":3.7,"exploitabilityScore":2.3,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-2391","epss":0.00039,"percentile":0.11794,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-2391","cwe":"CWE-20","source":"7ffcee3d-2c14-4c3e-b844-86c6a321a158","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"qs","version":"6.13.0"}},"found":{"vulnerabilityID":"GHSA-w7fw-mjwx-w883","versionConstraint":">=6.7.0,<=6.14.1 (semantic)"},"fix":{"suggestedVersion":"6.14.2"}}],"artifact":{"id":"f1485a5d8cce1397","name":"qs","version":"6.13.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/qs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/qs/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:qs_project:qs:6.13.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/qs@6.13.0","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-9232","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-9232","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"Issue summary: An application using the OpenSSL HTTP client API functions may trigger an out-of-bounds read if the 'no_proxy' environment variable is set and the host portion of the authority component of the HTTP URL is an IPv6 address. Impact summary: An out-of-bounds read can trigger a crash which leads to Denial of Service for an application. The OpenSSL HTTP client API functions can be used directly by applications but they are also used by the OCSP client functions and CMP (Certificate Management Protocol) client implementation in OpenSSL. However the URLs used by these implementations are unlikely to be controlled by an attacker. In this vulnerable code the out of bounds read can only trigger a crash. Furthermore the vulnerability requires an attacker-controlled URL to be passed from an application to the OpenSSL function and the user has to have a 'no_proxy' environment variable set. For the aforementioned reasons the issue was assessed as Low severity. The vulnerable code was introduced in the following patch releases: 3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0. The FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this issue, as the HTTP client implementation is outside the OpenSSL FIPS module boundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9232","epss":0.00023,"percentile":0.06034,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.17-1~deb12u3"],"state":"fixed","available":[{"version":"3.0.17-1~deb12u3","date":"2025-10-01","kind":"advisory"}]},"advisories":[{"id":"DSA-6015-1","link":"https://security-tracker.debian.org/tracker/DSA-6015-1"}],"risk":0.012535000000000001},"relatedVulnerabilities":[{"id":"CVE-2025-9232","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-9232","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/commit/2b4ec20e47959170422922eaff25346d362dcb35","https://github.com/openssl/openssl/commit/654dc11d23468a74fc8ea4672b702dd3feb7be4b","https://github.com/openssl/openssl/commit/7cf21a30513c9e43c4bc3836c237cf086e194af3","https://github.com/openssl/openssl/commit/89e790ac431125a4849992858490bed6b225eadf","https://github.com/openssl/openssl/commit/bbf38c034cdabd0a13330abcc4855c866f53d2e0","https://openssl-library.org/news/secadv/20250930.txt","http://www.openwall.com/lists/oss-security/2025/09/30/5"],"description":"Issue summary: An application using the OpenSSL HTTP client API functions may\ntrigger an out-of-bounds read if the 'no_proxy' environment variable is set and\nthe host portion of the authority component of the HTTP URL is an IPv6 address.\n\nImpact summary: An out-of-bounds read can trigger a crash which leads to\nDenial of Service for an application.\n\nThe OpenSSL HTTP client API functions can be used directly by applications\nbut they are also used by the OCSP client functions and CMP (Certificate\nManagement Protocol) client implementation in OpenSSL. However the URLs used\nby these implementations are unlikely to be controlled by an attacker.\n\nIn this vulnerable code the out of bounds read can only trigger a crash.\nFurthermore the vulnerability requires an attacker-controlled URL to be\npassed from an application to the OpenSSL function and the user has to have\na 'no_proxy' environment variable set. For the aforementioned reasons the\nissue was assessed as Low severity.\n\nThe vulnerable code was introduced in the following patch releases:\n3.0.16, 3.1.8, 3.2.4, 3.3.3, 3.4.0 and 3.5.0.\n\nThe FIPS modules in 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected by this\nissue, as the HTTP client implementation is outside the OpenSSL FIPS module\nboundary.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-9232","epss":0.00023,"percentile":0.06034,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-9232","cwe":"CWE-125","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-9232","versionConstraint":"< 3.0.17-1~deb12u3 (deb)"},"fix":{"suggestedVersion":"3.0.17-1~deb12u3"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2025-4802","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-4802","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-4802","epss":0.00016,"percentile":0.03469,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-4802","cwe":"CWE-426","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":["2.36-9+deb12u11"],"state":"fixed","available":[{"version":"2.36-9+deb12u11","date":"2025-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.012240000000000003},"relatedVulnerabilities":[{"id":"CVE-2025-4802","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-4802","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=32976","https://sourceware.org/cgit/glibc/commit/?id=1e18586c5820e329f741d5c710275e165581380e","http://www.openwall.com/lists/oss-security/2025/05/16/7","http://www.openwall.com/lists/oss-security/2025/05/17/2","https://lists.debian.org/debian-lts-announce/2025/05/msg00033.html"],"description":"Untrusted LD_LIBRARY_PATH environment variable vulnerability in the GNU C Library version 2.27 to 2.38 allows attacker controlled loading of dynamically shared library in statically compiled setuid binaries that call dlopen (including internal dlopen calls after setlocale or calls to NSS functions such as getaddrinfo).","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H","metrics":{"baseScore":7.8,"exploitabilityScore":1.9,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-4802","epss":0.00016,"percentile":0.03469,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-4802","cwe":"CWE-426","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-4802","versionConstraint":"< 2.36-9+deb12u11 (deb)"},"fix":{"suggestedVersion":"2.36-9+deb12u11"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00014,"percentile":0.02211,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.010989999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00014,"percentile":0.02211,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"f42c59d94c10b95d","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00014,"percentile":0.02211,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.010989999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00014,"percentile":0.02211,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"09de397807f7641f","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-34x7-hfp2-rc4v","dataSource":"https://github.com/advisories/GHSA-34x7-hfp2-rc4v","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v","https://nvd.nist.gov/vuln/detail/CVE-2026-24842","https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46"],"description":"node-tar Vulnerable to Arbitrary File Creation/Overwrite via Hardlink Path Traversal","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00014,"percentile":0.02211,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.7"],"state":"fixed","available":[{"version":"7.5.7","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.010989999999999998},"relatedVulnerabilities":[{"id":"CVE-2026-24842","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24842","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/f4a7aa9bc3d717c987fdf1480ff7a64e87ffdb46","https://github.com/isaacs/node-tar/security/advisories/GHSA-34x7-hfp2-rc4v"],"description":"node-tar,a Tar for Node.js, contains a vulnerability in versions prior to 7.5.7 where the security check for hardlink entries uses different path resolution semantics than the actual hardlink creation logic. This mismatch allows an attacker to craft a malicious TAR archive that bypasses path traversal protections and creates hardlinks to arbitrary files outside the extraction directory. Version 7.5.7 contains a fix for the issue.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N","metrics":{"baseScore":8.2,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24842","epss":0.00014,"percentile":0.02211,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-24842","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-24842","cwe":"CWE-59","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.4.3"}},"found":{"vulnerabilityID":"GHSA-34x7-hfp2-rc4v","versionConstraint":"<7.5.7 (semantic)"},"fix":{"suggestedVersion":"7.5.7"}}],"artifact":{"id":"328bcb4be5561b99","name":"tar","version":"7.4.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:7.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:7.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-mh29-5h37-fv8m","dataSource":"https://github.com/advisories/GHSA-mh29-5h37-fv8m","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://nvd.nist.gov/vuln/detail/CVE-2025-64718","https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876"],"description":"js-yaml has prototype pollution in merge (<<)","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.0002,"percentile":0.0501,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.14.2"],"state":"fixed","available":[{"version":"3.14.2","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.0103},"relatedVulnerabilities":[{"id":"CVE-2025-64718","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-64718","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/nodeca/js-yaml/commit/383665ff4248ec2192d1274e934462bb30426879","https://github.com/nodeca/js-yaml/commit/5278870a17454fe8621dbd8c445c412529525266","https://github.com/nodeca/js-yaml/issues/730#issuecomment-3549635876","https://github.com/nodeca/js-yaml/security/advisories/GHSA-mh29-5h37-fv8m","https://github.com/advisories/GHSA-mh29-5h37-fv8m"],"description":"js-yaml is a JavaScript YAML parser and dumper. In js-yaml before 4.1.1 and 3.14.2, it's possible for an attacker to modify the prototype of the result of a parsed yaml document via prototype pollution (`__proto__`). All users who parse untrusted yaml documents may be impacted. The problem is patched in js-yaml 4.1.1 and 3.14.2. Users can protect against this kind of attack on the server by using `node --disable-proto=delete` or `deno` (in Deno, pollution protection is on by default).","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-64718","epss":0.0002,"percentile":0.0501,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-64718","cwe":"CWE-1321","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"js-yaml","version":"3.14.1"}},"found":{"vulnerabilityID":"GHSA-mh29-5h37-fv8m","versionConstraint":"<3.14.2 (semantic)"},"fix":{"suggestedVersion":"3.14.2"}}],"artifact":{"id":"2ec6fdae7536262a","name":"js-yaml","version":"3.14.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/js-yaml/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/js-yaml/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:nodeca:js-yaml:3.14.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/js-yaml@3.14.1","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-55130","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55130","namespace":"nvd:cpe","severity":"Critical","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"A flaw in Node.js’s Permissions model allows attackers to bypass `--allow-fs-read` and `--allow-fs-write` restrictions using crafted relative symlink paths. By chaining directories and symlinks, a script granted access only to the current directory can escape the allowed path and read sensitive files. This breaks the expected isolation guarantees and enables arbitrary file read/write, leading to potential system compromise.\nThis vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":9.1,"exploitabilityScore":3.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-55130","epss":0.00012,"percentile":0.01808,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-55130","cwe":"CWE-289","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.01026},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2025-55130","versionConstraint":">= 20, < 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qwph-4952-7xr6","dataSource":"https://github.com/advisories/GHSA-qwph-4952-7xr6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23540","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00017,"percentile":0.04044,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23540","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23540","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.00969},"relatedVulnerabilities":[{"id":"CVE-2022-23540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23540","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00017,"percentile":0.04044,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23540","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23540","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.1.0"}},"found":{"vulnerabilityID":"GHSA-qwph-4952-7xr6","versionConstraint":"<9.0.0 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"c29669d438fb9e38","name":"jsonwebtoken","version":"0.1.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express-jwt/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.1.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.1.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-qwph-4952-7xr6","dataSource":"https://github.com/advisories/GHSA-qwph-4952-7xr6","namespace":"github:language:javascript","severity":"Medium","urls":["https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://nvd.nist.gov/vuln/detail/CVE-2022-23540","https://security.netapp.com/advisory/ntap-20240621-0007"],"description":"jsonwebtoken vulnerable to signature validation bypass due to insecure default algorithm in jwt.verify()","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00017,"percentile":0.04044,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23540","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23540","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["9.0.0"],"state":"fixed","available":[{"version":"9.0.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.00969},"relatedVulnerabilities":[{"id":"CVE-2022-23540","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-23540","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jsonwebtoken/commit/e1fa9dcc12054a8681db4e6373da1b30cf7016e3","https://github.com/auth0/node-jsonwebtoken/security/advisories/GHSA-qwph-4952-7xr6","https://security.netapp.com/advisory/ntap-20240621-0007/"],"description":"In versions `<=8.5.1` of `jsonwebtoken` library, lack of algorithm definition in the `jwt.verify()` function can lead to signature validation bypass due to defaulting to the `none` algorithm for signature verification. Users are affected if you do not specify algorithms in the `jwt.verify()` function. This issue has been fixed, please update to version 9.0.0 which removes the default support for the none algorithm in the `jwt.verify()` method. There will be no impact, if you update to version 9.0.0 and you don’t need to allow for the `none` algorithm. If you need 'none' algorithm, you have to explicitly specify that in `jwt.verify()` options.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":7.6,"exploitabilityScore":2.9,"impactScore":4.8},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L","metrics":{"baseScore":6.4,"exploitabilityScore":1.7,"impactScore":4.8},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-23540","epss":0.00017,"percentile":0.04044,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-23540","cwe":"CWE-287","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2022-23540","cwe":"CWE-347","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jsonwebtoken","version":"0.4.0"}},"found":{"vulnerabilityID":"GHSA-qwph-4952-7xr6","versionConstraint":"<9.0.0 (semantic)"},"fix":{"suggestedVersion":"9.0.0"}}],"artifact":{"id":"1e23bc54c16fbe6d","name":"jsonwebtoken","version":"0.4.0","type":"npm","locations":[{"path":"/juice-shop/node_modules/jsonwebtoken/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jsonwebtoken/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:auth0:jsonwebtoken:0.4.0:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/jsonwebtoken@0.4.0","upstreams":[]}},{"vulnerability":{"id":"GHSA-fjgf-rc76-4x9p","dataSource":"https://github.com/advisories/GHSA-fjgf-rc76-4x9p","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p","https://nvd.nist.gov/vuln/detail/CVE-2025-7338","https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b","https://cna.openjsf.org/security-advisories.html"],"description":"Multer vulnerable to Denial of Service via unhandled exception from malformed request","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7338","epss":0.00012,"percentile":0.01472,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-7338","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}],"fix":{"versions":["2.0.2"],"state":"fixed","available":[{"version":"2.0.2","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.009000000000000001},"relatedVulnerabilities":[{"id":"CVE-2025-7338","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-7338","namespace":"nvd:cpe","severity":"High","urls":["https://cna.openjsf.org/security-advisories.html","https://github.com/expressjs/multer/commit/adfeaf669f0e7fe953eab191a762164a452d143b","https://github.com/expressjs/multer/security/advisories/GHSA-fjgf-rc76-4x9p"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.2 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.2 to receive a patch. No known workarounds are available.","cvss":[{"source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-7338","epss":0.00012,"percentile":0.01472,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-7338","cwe":"CWE-248","source":"ce714d77-add3-4f53-aff5-83d477b104bb","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-fjgf-rc76-4x9p","versionConstraint":">=1.4.4-lts.1,<2.0.2 (semantic)"},"fix":{"suggestedVersion":"2.0.2"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"CVE-2026-22795","dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-22795","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"Issue summary: An invalid or NULL pointer dereference can happen in an application processing a malformed PKCS#12 file. Impact summary: An application processing a malformed PKCS#12 file can be caused to dereference an invalid or NULL pointer on memory read, resulting in a Denial of Service. A type confusion vulnerability exists in PKCS#12 parsing code where an ASN1_TYPE union member is accessed without first validating the type, causing an invalid pointer read. The location is constrained to a 1-byte address space, meaning any attempted pointer manipulation can only target addresses between 0x00 and 0xFF. This range corresponds to the zero page, which is unmapped on most modern operating systems and will reliably result in a crash, leading only to a Denial of Service. Exploiting this issue also requires a user or application to process a maliciously crafted PKCS#12 file. It is uncommon to accept untrusted PKCS#12 files in applications as they are usually used to store private keys which are trusted by definition. For these reasons, the issue was assessed as Low severity. The FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the PKCS12 implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue. OpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22795","epss":0.00017,"percentile":0.03768,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-22795","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.008925},"relatedVulnerabilities":[{"id":"CVE-2026-22795","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-22795","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/commit/2502e7b7d4c0cf4f972a881641fe09edc67aeec4","https://github.com/openssl/openssl/commit/572844beca95068394c916626a6d3a490f831a49","https://github.com/openssl/openssl/commit/7bbca05be55b129651d9df4bdb92becc45002c12","https://github.com/openssl/openssl/commit/eeee3cbd4d682095ed431052f00403004596373e","https://github.com/openssl/openssl/commit/ef2fb66ec571564d64d1c74a12e388a2a54d05d2","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: An invalid or NULL pointer dereference can happen in\nan application processing a malformed PKCS#12 file.\n\nImpact summary: An application processing a malformed PKCS#12 file can be\ncaused to dereference an invalid or NULL pointer on memory read, resulting\nin a Denial of Service.\n\nA type confusion vulnerability exists in PKCS#12 parsing code where\nan ASN1_TYPE union member is accessed without first validating the type,\ncausing an invalid pointer read.\n\nThe location is constrained to a 1-byte address space, meaning any\nattempted pointer manipulation can only target addresses between 0x00 and 0xFF.\nThis range corresponds to the zero page, which is unmapped on most modern\noperating systems and will reliably result in a crash, leading only to a\nDenial of Service. Exploiting this issue also requires a user or application\nto process a maliciously crafted PKCS#12 file. It is uncommon to accept\nuntrusted PKCS#12 files in applications as they are usually used to store\nprivate keys which are trusted by definition. For these reasons, the issue\nwas assessed as Low severity.\n\nThe FIPS modules in 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the PKCS12 implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.\n\nOpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-22795","epss":0.00017,"percentile":0.03768,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-22795","cwe":"CWE-754","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2026-22795","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00012,"percentile":0.01775,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.00876},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00012,"percentile":0.01775,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"f42c59d94c10b95d","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00012,"percentile":0.01775,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.00876},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00012,"percentile":0.01775,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"09de397807f7641f","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-83g3-92jg-28cx","dataSource":"https://github.com/advisories/GHSA-83g3-92jg-28cx","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx","https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://nvd.nist.gov/vuln/detail/CVE-2026-26960"],"description":"Arbitrary File Read/Write via Hardlink Target Escape Through Symlink Chain in node-tar Extraction","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00012,"percentile":0.01775,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.8"],"state":"fixed","available":[{"version":"7.5.8","date":"2026-02-19","kind":"first-observed"}]},"advisories":[],"risk":0.00876},"relatedVulnerabilities":[{"id":"CVE-2026-26960","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-26960","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/isaacs/node-tar/commit/2cb1120bcefe28d7ecc719b41441ade59c52e384","https://github.com/isaacs/node-tar/commit/d18e4e1f846f4ddddc153b0f536a19c050e7499f","https://github.com/isaacs/node-tar/security/advisories/GHSA-83g3-92jg-28cx"],"description":"node-tar is a full-featured Tar for Node.js. When using default options in versions 7.5.7 and below, an attacker-controlled archive can create a hardlink inside the extraction directory that points to a file outside the extraction root, enabling arbitrary file read and write as the extracting user. Severity is high because the primitive bypasses path protections and turns archive extraction into a direct filesystem access primitive. This issue has been fixed in version 7.5.8.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","metrics":{"baseScore":7.1,"exploitabilityScore":1.9,"impactScore":5.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-26960","epss":0.00012,"percentile":0.01775,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-26960","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.4.3"}},"found":{"vulnerabilityID":"GHSA-83g3-92jg-28cx","versionConstraint":"<7.5.8 (semantic)"},"fix":{"suggestedVersion":"7.5.8"}}],"artifact":{"id":"328bcb4be5561b99","name":"tar","version":"7.4.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:7.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:7.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-4pg4-qvpc-4q3h","dataSource":"https://github.com/advisories/GHSA-4pg4-qvpc-4q3h","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h","https://nvd.nist.gov/vuln/detail/CVE-2025-47944","https://github.com/expressjs/multer/issues/1176","https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665"],"description":"Multer vulnerable to Denial of Service from maliciously crafted requests","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47944","epss":0.00011,"percentile":0.01408,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-47944","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["2.0.0"],"state":"fixed","available":[{"version":"2.0.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.00825},"relatedVulnerabilities":[{"id":"CVE-2025-47944","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-47944","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/expressjs/multer/commit/2c8505f207d923dd8de13a9f93a4563e59933665","https://github.com/expressjs/multer/issues/1176","https://github.com/expressjs/multer/security/advisories/GHSA-4pg4-qvpc-4q3h"],"description":"Multer is a node.js middleware for handling `multipart/form-data`. A vulnerability that is present starting in version 1.4.4-lts.1 and prior to version 2.0.0 allows an attacker to trigger a Denial of Service (DoS) by sending a malformed multi-part upload request. This request causes an unhandled exception, leading to a crash of the process. Users should upgrade to version 2.0.0 to receive a patch. No known workarounds are available.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-47944","epss":0.00011,"percentile":0.01408,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-47944","cwe":"CWE-248","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"multer","version":"1.4.5-lts.2"}},"found":{"vulnerabilityID":"GHSA-4pg4-qvpc-4q3h","versionConstraint":">=1.4.4-lts.1,<2.0.0 (semantic)"},"fix":{"suggestedVersion":"2.0.0"}}],"artifact":{"id":"cce9b5dd2cb3fe54","name":"multer","version":"1.4.5-lts.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/multer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/multer/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:multer:multer:1.4.5-lts.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/multer@1.4.5-lts.2","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-68160","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-68160","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"Issue summary: Writing large, newline-free data into a BIO chain using the line-buffering filter where the next BIO performs short writes can trigger a heap-based out-of-bounds write. Impact summary: This out-of-bounds write can cause memory corruption which typically results in a crash, leading to Denial of Service for an application. The line-buffering BIO filter (BIO_f_linebuffer) is not used by default in TLS/SSL data paths. In OpenSSL command-line applications, it is typically only pushed onto stdout/stderr on VMS systems. Third-party applications that explicitly use this filter with a BIO chain that can short-write and that write large, newline-free data influenced by an attacker would be affected. However, the circumstances where this could happen are unlikely to be under attacker control, and BIO_f_linebuffer is unlikely to be handling non-curated data controlled by an attacker. For that reason the issue was assessed as Low severity. The FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue, as the BIO implementation is outside the OpenSSL FIPS module boundary. OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68160","epss":0.00016,"percentile":0.03638,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-68160","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.00776},"relatedVulnerabilities":[{"id":"CVE-2025-68160","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-68160","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/commit/384011202af92605d926fafe4a0bcd6b65d162ad","https://github.com/openssl/openssl/commit/475c466ef2fbd8fc1df6fae1c3eed9c813fc8ff6","https://github.com/openssl/openssl/commit/4c96fbba618e1940f038012506ee9e21d32ee12c","https://github.com/openssl/openssl/commit/6845c3b6460a98b1ec4e463baa2ea1a63a32d7c0","https://github.com/openssl/openssl/commit/68a7cd2e2816c3a02f4d45a2ce43fc04fac97096","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: Writing large, newline-free data into a BIO chain using the\nline-buffering filter where the next BIO performs short writes can trigger\na heap-based out-of-bounds write.\n\nImpact summary: This out-of-bounds write can cause memory corruption which\ntypically results in a crash, leading to Denial of Service for an application.\n\nThe line-buffering BIO filter (BIO_f_linebuffer) is not used by default in\nTLS/SSL data paths. In OpenSSL command-line applications, it is typically\nonly pushed onto stdout/stderr on VMS systems. Third-party applications that\nexplicitly use this filter with a BIO chain that can short-write and that\nwrite large, newline-free data influenced by an attacker would be affected.\nHowever, the circumstances where this could happen are unlikely to be under\nattacker control, and BIO_f_linebuffer is unlikely to be handling non-curated\ndata controlled by an attacker. For that reason the issue was assessed as\nLow severity.\n\nThe FIPS modules in 3.6, 3.5, 3.4, 3.3 and 3.0 are not affected by this issue,\nas the BIO implementation is outside the OpenSSL FIPS module boundary.\n\nOpenSSL 3.6, 3.5, 3.4, 3.3, 3.0, 1.1.1 and 1.0.2 are vulnerable to this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H","metrics":{"baseScore":4.7,"exploitabilityScore":1.1,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-68160","epss":0.00016,"percentile":0.03638,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-68160","cwe":"CWE-787","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-68160","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-869p-cjfg-cm3x","dataSource":"https://github.com/advisories/GHSA-869p-cjfg-cm3x","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x","https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e","https://github.com/auth0/node-jws/commit/4f6e73f24df42f07d632dec6431ade8eda8d11a6","https://github.com/auth0/node-jws/releases/tag/v3.2.3","https://github.com/auth0/node-jws/releases/tag/v4.0.1","https://nvd.nist.gov/vuln/detail/CVE-2025-65945"],"description":"auth0/node-jws Improperly Verifies HMAC Signature","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-65945","epss":0.00009,"percentile":0.00908,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-65945","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["3.2.3"],"state":"fixed","available":[{"version":"3.2.3","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.00675},"relatedVulnerabilities":[{"id":"CVE-2025-65945","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-65945","namespace":"nvd:cpe","severity":"High","urls":["https://github.com/auth0/node-jws/commit/34c45b2c04434f925b638de6a061de9339c0ea2e","https://github.com/auth0/node-jws/security/advisories/GHSA-869p-cjfg-cm3x"],"description":"auth0/node-jws is a JSON Web Signature implementation for Node.js. In versions 3.2.2 and earlier and version 4.0.0, auth0/node-jws has an improper signature verification vulnerability when using the HS256 algorithm under specific conditions. Applications are affected when they use the jws.createVerify() function for HMAC algorithms and use user-provided data from the JSON Web Signature protected header or payload in HMAC secret lookup routines, which can allow attackers to bypass signature verification. This issue has been patched in versions 3.2.3 and 4.0.1.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":7.5,"exploitabilityScore":3.9,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-65945","epss":0.00009,"percentile":0.00908,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-65945","cwe":"CWE-347","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jws","version":"0.2.6"}},"found":{"vulnerabilityID":"GHSA-869p-cjfg-cm3x","versionConstraint":"<3.2.3 (semantic)"},"fix":{"suggestedVersion":"3.2.3"}}],"artifact":{"id":"e3ae0c46d846c3b2","name":"jws","version":"0.2.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/jws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jws/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:brianloveswords:jws:0.2.6:*:*:*:*:*:*:*","cpe:2.3:a:jws:jws:0.2.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/jws@0.2.6","upstreams":[]}},{"vulnerability":{"id":"CVE-2019-1010022","dataSource":"https://security-tracker.debian.org/tracker/CVE-2019-1010022","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[],"epss":[{"cve":"CVE-2019-1010022","epss":0.00131,"percentile":0.3281,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.00655},"relatedVulnerabilities":[{"id":"CVE-2019-1010022","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2019-1010022","namespace":"nvd:cpe","severity":"Critical","urls":["https://security-tracker.debian.org/tracker/CVE-2019-1010022","https://sourceware.org/bugzilla/show_bug.cgi?id=22850","https://sourceware.org/bugzilla/show_bug.cgi?id=22850#c3","https://ubuntu.com/security/CVE-2019-1010022"],"description":"GNU Libc current is affected by: Mitigation bypass. The impact is: Attacker may bypass stack guard protection. The component is: nptl. The attack vector is: Exploit stack buffer overflow vulnerability and use this bypass vulnerability to bypass stack guard. NOTE: Upstream comments indicate \"this is being treated as a non-security bug and no real threat.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.0","vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":9.8,"exploitabilityScore":3.9,"impactScore":5.9},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","metrics":{"baseScore":7.5,"exploitabilityScore":10,"impactScore":6.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2019-1010022","epss":0.00131,"percentile":0.3281,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2019-1010022","cwe":"CWE-119","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2019-1010022","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2026-0861","dataSource":"https://security-tracker.debian.org/tracker/CVE-2026-0861","namespace":"debian:distro:debian:12","severity":"High","urls":[],"description":"Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption. Note that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc. Typically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-0861","epss":0.00008,"percentile":0.00643,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-0861","cwe":"CWE-190","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":[],"state":"wont-fix"},"advisories":[],"risk":0.006360000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-0861","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-0861","namespace":"nvd:cpe","severity":"High","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33796","https://sourceware.org/git/?p=glibc.git;a=blob_plain;f=advisories/GLIBC-SA-2026-0001","http://www.openwall.com/lists/oss-security/2026/01/16/5"],"description":"Passing too large an alignment to the memalign suite of functions (memalign, posix_memalign, aligned_alloc) in the GNU C Library version 2.30 to 2.42 may result in an integer overflow, which could consequently result in a heap corruption.\n\nNote that the attacker must have control over both, the size as well as the alignment arguments of the memalign function to be able to exploit this. The size parameter must be close enough to PTRDIFF_MAX so as to overflow size_t along with the large alignment argument. This limits the malicious inputs for the alignment for memalign to the range [1<<62+ 1, 1<<63] and exactly 1<<63 for posix_memalign and aligned_alloc.\n\nTypically the alignment argument passed to such functions is a known constrained quantity (e.g. page size, block size, struct sizes) and is not attacker controlled, because of which this may not be easily exploitable in practice. An application bug could potentially result in the input alignment being too large, e.g. due to a different buffer overflow or integer overflow in the application or its dependent libraries, but that is again an uncommon usage pattern given typical sources of alignments.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","metrics":{"baseScore":8.4,"exploitabilityScore":2.6,"impactScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-0861","epss":0.00008,"percentile":0.00643,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-0861","cwe":"CWE-190","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2026-0861","versionConstraint":"none (unknown)"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"GHSA-73rr-hh4g-fpgx","dataSource":"https://github.com/advisories/GHSA-73rr-hh4g-fpgx","namespace":"github:language:javascript","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://nvd.nist.gov/vuln/detail/CVE-2026-24001"],"description":"jsdiff has a Denial of Service vulnerability in parsePatch and applyPatch","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.0002,"percentile":0.04927,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}],"fix":{"versions":["4.0.4"],"state":"fixed","available":[{"version":"4.0.4","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.005700000000000001},"relatedVulnerabilities":[{"id":"CVE-2026-24001","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-24001","namespace":"nvd:cpe","severity":"Low","urls":["https://github.com/kpdecker/jsdiff/commit/15a1585230748c8ae6f8274c202e0c87309142f5","https://github.com/kpdecker/jsdiff/issues/653","https://github.com/kpdecker/jsdiff/pull/649","https://github.com/kpdecker/jsdiff/security/advisories/GHSA-73rr-hh4g-fpgx"],"description":"jsdiff is a JavaScript text differencing implementation. Prior to versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1, attempting to parse a patch whose filename headers contain the line break characters `\\r`, `\\u2028`, or `\\u2029` can cause the `parsePatch` method to enter an infinite loop. It then consumes memory without limit until the process crashes due to running out of memory. Applications are therefore likely to be vulnerable to a denial-of-service attack if they call `parsePatch` with a user-provided patch as input. A large payload is not needed to trigger the vulnerability, so size limits on user input do not provide any protection. Furthermore, some applications may be vulnerable even when calling `parsePatch` on a patch generated by the application itself if the user is nonetheless able to control the filename headers (e.g. by directly providing the filenames of the files to be diffed). The `applyPatch` method is similarly affected if (and only if) called with a string representation of a patch as an argument, since under the hood it parses that string using `parsePatch`. Other methods of the library are unaffected. Finally, a second and lesser interdependent bug - a ReDOS - also exhibits when those same line break characters are present in a patch's *patch* header (also known as its \"leading garbage\"). A maliciously-crafted patch header of length *n* can take `parsePatch` O(*n*³) time to parse. Versions 8.0.3, 5.2.2, 4.0.4, and 3.5.1 contain a fix. As a workaround, do not attempt to parse patches that contain any of these characters: `\\r`, `\\u2028`, or `\\u2029`.","cvss":[{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":2.7},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-24001","epss":0.0002,"percentile":0.04927,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-24001","cwe":"CWE-400","source":"security-advisories@github.com","type":"Secondary"},{"cve":"CVE-2026-24001","cwe":"CWE-1333","source":"security-advisories@github.com","type":"Secondary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"diff","version":"4.0.2"}},"found":{"vulnerabilityID":"GHSA-73rr-hh4g-fpgx","versionConstraint":">=4.0.0,<4.0.4 (semantic)"},"fix":{"suggestedVersion":"4.0.4"}}],"artifact":{"id":"a4cf03c6615f9d2d","name":"diff","version":"4.0.2","type":"npm","locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/diff/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/diff/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["BSD-3-Clause"],"cpes":["cpe:2.3:a:kpdecker:diff:4.0.2:*:*:*:*:*:*:*","cpe:2.3:a:diff:diff:4.0.2:*:*:*:*:*:*:*"],"purl":"pkg:npm/diff@4.0.2","upstreams":[]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00007,"percentile":0.0058,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.005494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00007,"percentile":0.0058,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"f42c59d94c10b95d","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00007,"percentile":0.0058,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.005494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00007,"percentile":0.0058,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"09de397807f7641f","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-8qq5-rm4j-mr97","dataSource":"https://github.com/advisories/GHSA-8qq5-rm4j-mr97","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97","https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://nvd.nist.gov/vuln/detail/CVE-2026-23745"],"description":"node-tar is Vulnerable to Arbitrary File Overwrite and Symlink Poisoning via Insufficient Path Sanitization","cvss":[{"type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00007,"percentile":0.0058,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}],"fix":{"versions":["7.5.3"],"state":"fixed","available":[{"version":"7.5.3","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.005494999999999999},"relatedVulnerabilities":[{"id":"CVE-2026-23745","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23745","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/340eb285b6d986e91969a1170d7fe9b0face405e","https://github.com/isaacs/node-tar/security/advisories/GHSA-8qq5-rm4j-mr97"],"description":"node-tar is a Tar for Node.js. The node-tar library (<= 7.5.2) fails to sanitize the linkpath of Link (hardlink) and SymbolicLink entries when preservePaths is false (the default secure behavior). This allows malicious archives to bypass the extraction root restriction, leading to Arbitrary File Overwrite via hardlinks and Symlink Poisoning via absolute symlink targets. This vulnerability is fixed in 7.5.3.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N","metrics":{"baseScore":6.1,"exploitabilityScore":1.9,"impactScore":4.3},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:L/VA:N/SC:H/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":8.2},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23745","epss":0.00007,"percentile":0.0058,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23745","cwe":"CWE-22","source":"security-advisories@github.com","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.4.3"}},"found":{"vulnerabilityID":"GHSA-8qq5-rm4j-mr97","versionConstraint":"<=7.5.2 (semantic)"},"fix":{"suggestedVersion":"7.5.3"}}],"artifact":{"id":"328bcb4be5561b99","name":"tar","version":"7.4.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:7.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:7.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.4.3","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.003,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.00489},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.003,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"4.4.19"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"f42c59d94c10b95d","name":"tar","version":"4.4.19","type":"npm","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:4.4.19:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:4.4.19:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@4.4.19","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.003,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.00489},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.003,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"6.2.1"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"09de397807f7641f","name":"tar","version":"6.2.1","type":"npm","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:6.2.1:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:6.2.1:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@6.2.1","upstreams":[]}},{"vulnerability":{"id":"GHSA-r6q2-hw4h-h46w","dataSource":"https://github.com/advisories/GHSA-r6q2-hw4h-h46w","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w","https://nvd.nist.gov/vuln/detail/CVE-2026-23950","https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6"],"description":"Race Condition in node-tar Path Reservations via Unicode Ligature Collisions on macOS APFS","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.003,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":["7.5.4"],"state":"fixed","available":[{"version":"7.5.4","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0.00489},"relatedVulnerabilities":[{"id":"CVE-2026-23950","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2026-23950","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/isaacs/node-tar/commit/3b1abfae650056edfabcbe0a0df5954d390521e6","https://github.com/isaacs/node-tar/security/advisories/GHSA-r6q2-hw4h-h46w"],"description":"node-tar,a Tar for Node.js, has a race condition vulnerability in versions up to and including 7.5.3. This is due to an incomplete handling of Unicode path collisions in the `path-reservations` system. On case-insensitive or normalization-insensitive filesystems (such as macOS APFS, In which it has been tested), the library fails to lock colliding paths (e.g., `ß` and `ss`), allowing them to be processed in parallel. This bypasses the library's internal concurrency safeguards and permits Symlink Poisoning attacks via race conditions. The library uses a `PathReservations` system to ensure that metadata checks and file operations for the same path are serialized. This prevents race conditions where one entry might clobber another concurrently. This is a Race Condition which enables Arbitrary File Overwrite. This vulnerability affects users and systems using node-tar on macOS (APFS/HFS+). Because of using `NFD` Unicode normalization (in which `ß` and `ss` are different), conflicting paths do not have their order properly preserved under filesystems that ignore Unicode normalization (e.g., APFS (in which `ß` causes an inode collision with `ss`)). This enables an attacker to circumvent internal parallelization locks (`PathReservations`) using conflicting filenames within a malicious tar archive. The patch in version 7.5.4 updates `path-reservations.js` to use a normalization form that matches the target filesystem's behavior (e.g., `NFKD`), followed by first `toLocaleLowerCase('en')` and then `toLocaleUpperCase('en')`. As a workaround, users who cannot upgrade promptly, and who are programmatically using `node-tar` to extract arbitrary tarball data should filter out all `SymbolicLink` entries (as npm does) to defend against arbitrary file writes via this file system entry name collision issue.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N","metrics":{"baseScore":5.9,"exploitabilityScore":2.3,"impactScore":3.6},"vendorMetadata":{}},{"source":"security-advisories@github.com","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:H/A:L","metrics":{"baseScore":8.8,"exploitabilityScore":2.9,"impactScore":5.3},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2026-23950","epss":0.00006,"percentile":0.003,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2026-23950","cwe":"CWE-176","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-352","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"security-advisories@github.com","type":"Primary"},{"cve":"CVE-2026-23950","cwe":"CWE-367","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"tar","version":"7.4.3"}},"found":{"vulnerabilityID":"GHSA-r6q2-hw4h-h46w","versionConstraint":"<=7.5.3 (semantic)"},"fix":{"suggestedVersion":"7.5.4"}}],"artifact":{"id":"328bcb4be5561b99","name":"tar","version":"7.4.3","type":"npm","locations":[{"path":"/juice-shop/node_modules/tar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["ISC"],"cpes":["cpe:2.3:a:tar_project:tar:7.4.3:*:*:*:*:node.js:*:*","cpe:2.3:a:isaacs:tar:7.4.3:*:*:*:*:node.js:*:*"],"purl":"pkg:npm/tar@7.4.3","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-55132","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-55132","namespace":"nvd:cpe","severity":"Medium","urls":["https://nodejs.org/en/blog/vulnerability/december-2025-security-releases"],"description":"A flaw in Node.js's permission model allows a file's access and modification timestamps to be changed via `futimes()` even when the process has only read permissions. Unlike `utimes()`, `futimes()` does not apply the expected write-permission checks, which means file metadata can be modified in read-only directories. This behavior could be used to alter timestamps in ways that obscure activity, reducing the reliability of logs. This vulnerability affects users of the permission model on Node.js v20, v22, v24, and v25.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":3.9,"impactScore":1.5},"vendorMetadata":{}},{"source":"support@hackerone.com","type":"Secondary","version":"3.0","vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N","metrics":{"baseScore":2.8,"exploitabilityScore":1.4,"impactScore":1.5},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-55132","epss":0.0001,"percentile":0.01098,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-55132","cwe":"CWE-276","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":["20.20.0","22.22.0","24.13.0","25.3.0"],"state":"fixed","available":[{"version":"20.20.0","date":"2026-02-07","kind":"first-observed"},{"version":"22.22.0","date":"2026-02-07","kind":"first-observed"},{"version":"24.13.0","date":"2026-02-07","kind":"first-observed"},{"version":"25.3.0","date":"2026-02-07","kind":"first-observed"}]},"advisories":[],"risk":0.004525},"relatedVulnerabilities":[],"matchDetails":[{"type":"cpe-match","matcher":"stock-matcher","searchedBy":{"namespace":"nvd:cpe","cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"package":{"name":"node","version":"22.18.0"}},"found":{"vulnerabilityID":"CVE-2025-55132","versionConstraint":">= 20, < 20.20.0,>= 21, < 22.22.0,>= 23, < 24.13.0,>= 25, < 25.3.0 (unknown)","cpes":["cpe:2.3:a:nodejs:node.js:*:*:*:*:*:*:*:*"]},"fix":{"suggestedVersion":"22.22.0"}}],"artifact":{"id":"0f112df19132fab3","name":"node","version":"22.18.0","type":"binary","locations":[{"path":"/nodejs/bin/node","layerID":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","accessPath":"/nodejs/bin/node","annotations":{"evidence":"primary"}}],"language":"","licenses":[],"cpes":["cpe:2.3:a:nodejs:node.js:22.18.0:*:*:*:*:*:*:*"],"purl":"pkg:generic/node@22.18.0","upstreams":[]}},{"vulnerability":{"id":"CVE-2025-8058","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-8058","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"The regcomp function in the GNU C library version from 2.4 to 2.41 is subject to a double free if some previous allocation fails. It can be accomplished either by a malloc failure or by using an interposed malloc that injects random malloc failures. The double free can allow buffer manipulation depending of how the regex is constructed. This issue affects all architectures and ABIs supported by the GNU C library.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-8058","epss":0.00007,"percentile":0.00494,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-8058","cwe":"CWE-415","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}],"fix":{"versions":["2.36-9+deb12u13"],"state":"fixed","available":[{"version":"2.36-9+deb12u13","date":"2025-09-11","kind":"first-observed"}]},"advisories":[],"risk":0.003815},"relatedVulnerabilities":[{"id":"CVE-2025-8058","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-8058","namespace":"nvd:cpe","severity":"Medium","urls":["https://sourceware.org/bugzilla/show_bug.cgi?id=33185","https://sourceware.org/git/?p=glibc.git;a=commit;h=3ff17af18c38727b88d9115e536c069e6b5d601f","http://www.openwall.com/lists/oss-security/2025/07/23/1"],"description":"The regcomp function in the GNU C library version from 2.4 to 2.41 is \nsubject to a double free if some previous allocation fails. It can be \naccomplished either by a malloc failure or by using an interposed malloc\n that injects random malloc failures. The double free can allow buffer \nmanipulation depending of how the regex is constructed. This issue \naffects all architectures and ABIs supported by the GNU C library.","cvss":[{"source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary","version":"4.0","vector":"CVSS:4.0/AV:L/AC:H/AT:P/PR:L/UI:P/VC:L/VI:L/VA:H/SC:L/SI:L/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","metrics":{"baseScore":5.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-8058","epss":0.00007,"percentile":0.00494,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-8058","cwe":"CWE-415","source":"3ff69d7a-14f2-4f67-a097-88dee7810d18","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"glibc","version":"2.36-9+deb12u10"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-8058","versionConstraint":"< 2.36-9+deb12u13 (deb)"},"fix":{"suggestedVersion":"2.36-9+deb12u13"}}],"artifact":{"id":"c924a822eab59d9a","name":"libc6","version":"2.36-9+deb12u10","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libc6","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libc6/copyright","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/usr/share/doc/libc6/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libc6.md5sums","layerID":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","accessPath":"/var/lib/dpkg/status.d/libc6.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["GPL-2","LGPL-2.1"],"cpes":["cpe:2.3:a:libc6:libc6:2.36-9\\+deb12u10:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libc6@2.36-9%2Bdeb12u10?arch=amd64&distro=debian-12&upstream=glibc","upstreams":[{"name":"glibc"}]}},{"vulnerability":{"id":"CVE-2025-27587","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-27587","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","cvss":[],"epss":[{"cve":"CVE-2025-27587","epss":0.00051,"percentile":0.1579,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-27587","cwe":"CWE-385","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.00255},"relatedVulnerabilities":[{"id":"CVE-2025-27587","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-27587","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/issues/24253","https://minerva.crocs.fi.muni.cz"],"description":"OpenSSL 3.0.0 through 3.3.2 on the PowerPC architecture is vulnerable to a Minerva attack, exploitable by measuring the time of signing of random messages using the EVP_DigestSign API, and then using the private key to extract the K value (nonce) from the signatures. Next, based on the bit size of the extracted nonce, one can compare the signing time of full-sized nonces to signatures that used smaller nonces, via statistical tests. There is a side-channel in the P-364 curve that allows private key extraction (also, there is a dependency between the bit size of K and the size of the side channel). NOTE: This CVE is disputed because the OpenSSL security policy explicitly notes that any side channels which require same physical system to be detected are outside of the threat model for the software. The timing signal is so small that it is infeasible to be detected without having the attacking process running on the same physical system.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","metrics":{"baseScore":5.3,"exploitabilityScore":1.7,"impactScore":3.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-27587","epss":0.00051,"percentile":0.1579,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-27587","cwe":"CWE-385","source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-27587","versionConstraint":"none (unknown)"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15358,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0025},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15358,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"0a534483a88e1e33","name":"gcc-12-base","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/gcc-12-base","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/var/lib/dpkg/status.d/gcc-12-base","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/gcc-12-base/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/gcc-12-base.md5sums","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/var/lib/dpkg/status.d/gcc-12-base.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:gcc-12-base:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12-base:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12_base:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc-12:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc_12:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc-12-base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:gcc:gcc_12_base:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/gcc-12-base@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15358,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0025},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15358,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"74f0cf86f14f0675","name":"libgcc-s1","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libgcc-s1","layerID":"sha256:c3abae442368dc447f15c468933843c361f227f5d87b2bb86515b49f40583ed9","accessPath":"/var/lib/dpkg/status.d/libgcc-s1","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/libgcc-s1/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libgcc-s1.md5sums","layerID":"sha256:c3abae442368dc447f15c468933843c361f227f5d87b2bb86515b49f40583ed9","accessPath":"/var/lib/dpkg/status.d/libgcc-s1.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:libgcc-s1:libgcc-s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc-s1:libgcc_s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc-s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc_s1:libgcc_s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc-s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*","cpe:2.3:a:libgcc:libgcc_s1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libgcc-s1@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15358,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0025},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15358,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"cd7473971e9d06dd","name":"libgomp1","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libgomp1","layerID":"sha256:2401c5ea32a75452bc4b02a664c80cf63f197704653926fca19e22e6cbc85652","accessPath":"/var/lib/dpkg/status.d/libgomp1","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/status.d/libgomp1.md5sums","layerID":"sha256:2401c5ea32a75452bc4b02a664c80cf63f197704653926fca19e22e6cbc85652","accessPath":"/var/lib/dpkg/status.d/libgomp1.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/libgomp1/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:libgomp1:libgomp1:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libgomp1@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2022-27943","dataSource":"https://security-tracker.debian.org/tracker/CVE-2022-27943","namespace":"debian:distro:debian:12","severity":"Negligible","urls":[],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15358,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0.0025},"relatedVulnerabilities":[{"id":"CVE-2022-27943","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2022-27943","namespace":"nvd:cpe","severity":"Medium","urls":["https://gcc.gnu.org/bugzilla/show_bug.cgi?id=105039","https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/H424YXGW7OKXS2NCAP35OP6Y4P4AW6VG/","https://sourceware.org/bugzilla/show_bug.cgi?id=28995"],"description":"libiberty/rust-demangle.c in GNU GCC 11.2 allows stack consumption in demangle_const, as demonstrated by nm-new.","cvss":[{"source":"nvd@nist.gov","type":"Primary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:H","metrics":{"baseScore":5.5,"exploitabilityScore":1.9,"impactScore":3.6},"vendorMetadata":{}},{"source":"nvd@nist.gov","type":"Primary","version":"2.0","vector":"AV:N/AC:M/Au:N/C:N/I:N/A:P","metrics":{"baseScore":4.3,"exploitabilityScore":8.6,"impactScore":2.9},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2022-27943","epss":0.0005,"percentile":0.15358,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2022-27943","cwe":"CWE-674","source":"nvd@nist.gov","type":"Primary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"gcc-12","version":"12.2.0-14+deb12u1"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2022-27943","versionConstraint":"none (unknown)"}}],"artifact":{"id":"9a37debf0d05047e","name":"libstdc++6","version":"12.2.0-14+deb12u1","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libstdc++6","layerID":"sha256:6819a1af097df543d58dc30b51f737e55f3f42a9a04e641f175834a55bf0629c","accessPath":"/var/lib/dpkg/status.d/libstdc++6","annotations":{"evidence":"primary"}},{"path":"/var/lib/dpkg/status.d/libstdc++6.md5sums","layerID":"sha256:6819a1af097df543d58dc30b51f737e55f3f42a9a04e641f175834a55bf0629c","accessPath":"/var/lib/dpkg/status.d/libstdc++6.md5sums","annotations":{"evidence":"supporting"}},{"path":"/usr/share/doc/gcc-12-base/copyright","layerID":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","accessPath":"/usr/share/doc/libstdc++6/copyright","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Artistic","GFDL-1.2","GPL","GPL-2","GPL-3","LGPL"],"cpes":["cpe:2.3:a:libstdc\\+\\+6:libstdc\\+\\+6:12.2.0-14\\+deb12u1:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libstdc%2B%2B6@12.2.0-14%2Bdeb12u1?arch=amd64&distro=debian-12&upstream=gcc-12","upstreams":[{"name":"gcc-12"}]}},{"vulnerability":{"id":"CVE-2025-69418","dataSource":"https://security-tracker.debian.org/tracker/CVE-2025-69418","namespace":"debian:distro:debian:12","severity":"Medium","urls":[],"description":"Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the buffer while
leaving the actual trailing bytes unprocessed. The authentication checksum
also excludes the true tail bytes.
However, typical OpenSSL consumers using EVP are not affected because the
higher-level EVP and provider OCB implementations split inputs so that full
blocks and trailing partial blocks are processed in separate calls, avoiding
the problematic code path. Additionally, TLS does not use OCB ciphersuites.
The vulnerability only affects applications that call the low-level
CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with
non-block-aligned lengths in a single call on hardware-accelerated builds.
For these reasons the issue was assessed as Low severity.
The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected
by this issue, as OCB mode is not a FIPS-approved algorithm.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
OpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4,"exploitabilityScore":1.5,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69418","epss":0.00005,"percentile":0.00245,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-69418","cwe":"CWE-325","source":"openssl-security@openssl.org","type":"Secondary"}],"fix":{"versions":["3.0.18-1~deb12u2"],"state":"fixed","available":[{"version":"3.0.18-1~deb12u2","date":"2026-01-27","kind":"advisory"}]},"advisories":[{"id":"DSA-6113-1","link":"https://security-tracker.debian.org/tracker/DSA-6113-1"}],"risk":0.0022500000000000003},"relatedVulnerabilities":[{"id":"CVE-2025-69418","dataSource":"https://nvd.nist.gov/vuln/detail/CVE-2025-69418","namespace":"nvd:cpe","severity":"Medium","urls":["https://github.com/openssl/openssl/commit/372fc5c77529695b05b4f5b5187691a57ef5dffc","https://github.com/openssl/openssl/commit/4016975d4469cd6b94927c607f7c511385f928d8","https://github.com/openssl/openssl/commit/52d23c86a54adab5ee9f80e48b242b52c4cc2347","https://github.com/openssl/openssl/commit/a7589230356d908c0eca4b969ec4f62106f4f5ae","https://github.com/openssl/openssl/commit/ed40856d7d4ba6cb42779b6770666a65f19cb977","https://openssl-library.org/news/secadv/20260127.txt"],"description":"Issue summary: When using the low-level OCB API directly with AES-NI or
other hardware-accelerated code paths, inputs whose length is not a multiple
of 16 bytes can leave the final partial block unencrypted and unauthenticated.
Impact summary: The trailing 1-15 bytes of a message may be exposed in
cleartext on encryption and are not covered by the authentication tag,
allowing an attacker to read or tamper with those bytes without detection.
The low-level OCB encrypt and decrypt routines in the hardware-accelerated
stream path process full 16-byte blocks but do not advance the input/output
pointers. The subsequent tail-handling code then operates on the original
base pointers, effectively reprocessing the beginning of the buffer while
leaving the actual trailing bytes unprocessed. The authentication checksum
also excludes the true tail bytes.
However, typical OpenSSL consumers using EVP are not affected because the
higher-level EVP and provider OCB implementations split inputs so that full
blocks and trailing partial blocks are processed in separate calls, avoiding
the problematic code path. Additionally, TLS does not use OCB ciphersuites.
The vulnerability only affects applications that call the low-level
CRYPTO_ocb128_encrypt() or CRYPTO_ocb128_decrypt() functions directly with
non-block-aligned lengths in a single call on hardware-accelerated builds.
For these reasons the issue was assessed as Low severity.
The FIPS modules in 3.6, 3.5, 3.4, 3.3, 3.2, 3.1 and 3.0 are not affected
by this issue, as OCB mode is not a FIPS-approved algorithm.
OpenSSL 3.6, 3.5, 3.4, 3.3, 3.0 and 1.1.1 are vulnerable to this issue.
OpenSSL 1.0.2 is not affected by this issue.","cvss":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N","metrics":{"baseScore":4,"exploitabilityScore":1.5,"impactScore":2.6},"vendorMetadata":{}}],"epss":[{"cve":"CVE-2025-69418","epss":0.00005,"percentile":0.00245,"date":"2026-03-01"}],"cwes":[{"cve":"CVE-2025-69418","cwe":"CWE-325","source":"openssl-security@openssl.org","type":"Secondary"}]}],"matchDetails":[{"type":"exact-indirect-match","matcher":"dpkg-matcher","searchedBy":{"distro":{"type":"debian","version":"12"},"package":{"name":"openssl","version":"3.0.17-1~deb12u2"},"namespace":"debian:distro:debian:12"},"found":{"vulnerabilityID":"CVE-2025-69418","versionConstraint":"< 3.0.18-1~deb12u2 (deb)"},"fix":{"suggestedVersion":"3.0.18-1~deb12u2"}}],"artifact":{"id":"0f919d6ebdb73625","name":"libssl3","version":"3.0.17-1~deb12u2","type":"deb","locations":[{"path":"/var/lib/dpkg/status.d/libssl3","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/libssl3/copyright","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/usr/share/doc/libssl3/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/libssl3.md5sums","layerID":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","accessPath":"/var/lib/dpkg/status.d/libssl3.md5sums","annotations":{"evidence":"supporting"}}],"language":"","licenses":["Apache-2.0","Artistic","GPL-1","GPL-1+"],"cpes":["cpe:2.3:a:libssl3:libssl3:3.0.17-1\\~deb12u2:*:*:*:*:*:*:*"],"purl":"pkg:deb/debian/libssl3@3.0.17-1~deb12u2?arch=amd64&distro=debian-12&upstream=openssl","upstreams":[{"name":"openssl"}]}},{"vulnerability":{"id":"GHSA-5mrr-rgp6-x4gr","dataSource":"https://github.com/advisories/GHSA-5mrr-rgp6-x4gr","namespace":"github:language:javascript","severity":"Critical","urls":["https://github.com/bkimminich/juice-shop/issues/1173","https://www.npmjs.com/advisories/1122"],"description":"Command Injection in marsdb","cvss":[],"fix":{"versions":[],"state":"not-fixed"},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"marsdb","version":"0.6.11"}},"found":{"vulnerabilityID":"GHSA-5mrr-rgp6-x4gr","versionConstraint":">=0.0.0 (semantic)"}}],"artifact":{"id":"92d5870e9d43058d","name":"marsdb","version":"0.6.11","type":"npm","locations":[{"path":"/juice-shop/node_modules/marsdb/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/marsdb/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:marsdb:marsdb:0.6.11:*:*:*:*:*:*:*","cpe:2.3:a:c58:marsdb:0.6.11:*:*:*:*:*:*:*"],"purl":"pkg:npm/marsdb@0.6.11","upstreams":[]}},{"vulnerability":{"id":"GHSA-gjcw-v447-2w7q","dataSource":"https://github.com/advisories/GHSA-gjcw-v447-2w7q","namespace":"github:language:javascript","severity":"High","urls":["https://github.com/brianloveswords/node-jws/commit/585d0e1e97b6747c10cf5b7689ccc5618a89b299#diff-4ac32a78649ca5bdd8e0ba38b7006a1e","https://auth0.com/blog/2015/03/31/critical-vulnerabilities-in-json-web-token-libraries/","https://www.npmjs.com/advisories/88","https://nvd.nist.gov/vuln/detail/CVE-2016-1000223","https://snyk.io/vuln/npm:jws:20160726"],"description":"Forgeable Public/Private Tokens in jws","cvss":[{"type":"Secondary","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","metrics":{"baseScore":8.7,"exploitabilityScore":2.3,"impactScore":5.8},"vendorMetadata":{}}],"fix":{"versions":["3.0.0"],"state":"fixed","available":[{"version":"3.0.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[{"id":"CVE-2016-1000223","dataSource":"nvd","namespace":"nvd:cpe","severity":"Unknown","urls":[],"cvss":[]}],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"jws","version":"0.2.6"}},"found":{"vulnerabilityID":"GHSA-gjcw-v447-2w7q","versionConstraint":"<3.0.0 (semantic)"},"fix":{"suggestedVersion":"3.0.0"}}],"artifact":{"id":"e3ae0c46d846c3b2","name":"jws","version":"0.2.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/jws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/jws/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:brianloveswords:jws:0.2.6:*:*:*:*:*:*:*","cpe:2.3:a:jws:jws:0.2.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/jws@0.2.6","upstreams":[]}},{"vulnerability":{"id":"GHSA-rvg8-pwq2-xj7q","dataSource":"https://github.com/advisories/GHSA-rvg8-pwq2-xj7q","namespace":"github:language:javascript","severity":"Medium","urls":["https://hackerone.com/reports/321687","https://github.com/brianloveswords/base64url/pull/25","https://github.com/brianloveswords/base64url/commit/4fbd954a0a69e9d898de2146557cc6e893e79542"],"description":"Out-of-bounds Read in base64url","cvss":[],"fix":{"versions":["3.0.0"],"state":"fixed","available":[{"version":"3.0.0","date":"2026-02-12","kind":"first-observed"}]},"advisories":[],"risk":0},"relatedVulnerabilities":[],"matchDetails":[{"type":"exact-direct-match","matcher":"javascript-matcher","searchedBy":{"language":"javascript","namespace":"github:language:javascript","package":{"name":"base64url","version":"0.0.6"}},"found":{"vulnerabilityID":"GHSA-rvg8-pwq2-xj7q","versionConstraint":"<3.0.0 (semantic)"},"fix":{"suggestedVersion":"3.0.0"}}],"artifact":{"id":"2f8a9d6c7656ba10","name":"base64url","version":"0.0.6","type":"npm","locations":[{"path":"/juice-shop/node_modules/base64url/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64url/package.json","annotations":{"evidence":"primary"}}],"language":"javascript","licenses":["MIT"],"cpes":["cpe:2.3:a:brianloveswords:base64url:0.0.6:*:*:*:*:*:*:*","cpe:2.3:a:base64url:base64url:0.0.6:*:*:*:*:*:*:*"],"purl":"pkg:npm/base64url@0.0.6","upstreams":[]}}],"source":{"type":"image","target":{"userInput":"bkimminich/juice-shop:v19.0.0","imageID":"sha256:37cc73163c4c269c044e890fee868d62637109cad126a26dab13dc442ef2ae76","manifestDigest":"sha256:121745476a7e0f53336dd9bf3412d4fabd5f8e79127f266d9aeff5c05bc64002","mediaType":"application/vnd.docker.distribution.manifest.v2+json","tags":["bkimminich/juice-shop:v19.0.0"],"imageSize":421051540,"layers":[{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","size":270682},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:8fa10c0194df9b7c054c90dbe482585f768a54428fc90a5b78a0066a123b1bba","size":22888},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:48c0fb67386ed713921fcc0468be23231d0872fa67ccc8ea3929df4656b6ddfc","size":1462778},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:114dde0fefebbca13165d0da9c500a66190e497a82a53dcaabc3172d630be1e9","size":82129},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:4d049f83d9cf21d1f5cc0e11deaf36df02790d0e60c1a3829538fb4b61685368","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:af5aa97ebe6ce1604747ec1e21af7136ded391bcabe4acef882e718a87c86bcc","size":149},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:6f1cdceb6a3146f0ccb986521156bef8a422cdbb0863396f7f751f575ba308f4","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:bbb6cacb8c82e4da4e8143e03351e939eab5e21ce0ef333c42e637af86c5217b","size":64},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2a92d6ac9e4fcc274d5168b217ca4458a9fec6f094ead68d99c77073f08caac1","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:1a73b54f556b477f0a8b939d13c504a3b4f4db71f7a09c63afbc10acb3de5849","size":497},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:f4aee9e53c42a22ed82451218c3ea03d1eea8d6ca8fbe8eb4e950304ba8a8bb3","size":346},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:bfe9137a1b044e8097cdfcb6899137a8a984ed70931ed1e8ef0cf7e023a139fc","size":235531},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:d5a3e014161bb602d87c2312e371ad2ea6f800c7f7af261af4faa67302b53c88","size":12820707},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2e4983c761ce4933ecec23c31173fed551a237c8d0ba359b697de64bd953a7c3","size":5901043},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:7095412417d2dce289b77f7a8c632a07c82b707fe43cfef7368c3b65c8d2538a","size":94016},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2401c5ea32a75452bc4b02a664c80cf63f197704653926fca19e22e6cbc85652","size":291001},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:6819a1af097df543d58dc30b51f737e55f3f42a9a04e641f175834a55bf0629c","size":2311333},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:c3abae442368dc447f15c468933843c361f227f5d87b2bb86515b49f40583ed9","size":126113},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:2f5239c7b2bfbda3e275a053ca0865fc4cb8aad6d1fd5aca22d3e1e54f32df99","size":121755661},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:3cd50cf8b20753e35bd3d82fb45a6a248ae993d889e104e0be02d309d2accbdc","size":0},{"mediaType":"application/vnd.docker.image.rootfs.diff.tar.gzip","digest":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","size":275676602}],"manifest":"eyJzY2hlbWFWZXJzaW9uIjoyLCJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmRpc3RyaWJ1dGlvbi5tYW5pZmVzdC52Mitqc29uIiwiY29uZmlnIjp7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuY29udGFpbmVyLmltYWdlLnYxK2pzb24iLCJzaXplIjo1MzA5LCJkaWdlc3QiOiJzaGEyNTY6MzdjYzczMTYzYzRjMjY5YzA0NGU4OTBmZWU4NjhkNjI2MzcxMDljYWQxMjZhMjZkYWIxM2RjNDQyZWYyYWU3NiJ9LCJsYXllcnMiOlt7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjozMjc2ODAsImRpZ2VzdCI6InNoYTI1NjpmNDY0YWY0YjliMjUxZWJlOGE3YzJmMTg2YWZmNjU2ZjA4OTJmNmNiMTU5ODM3YTZjZThmZDYzODQyZTgzZTM1In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6NDA5NjAsImRpZ2VzdCI6InNoYTI1Njo4ZmExMGMwMTk0ZGY5YjdjMDU0YzkwZGJlNDgyNTg1Zjc2OGE1NDQyOGZjOTBhNWI3OGEwMDY2YTEyM2IxYmJhIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjQwNjQwMCwiZGlnZXN0Ijoic2hhMjU2OjQ4YzBmYjY3Mzg2ZWQ3MTM5MjFmY2MwNDY4YmUyMzIzMWQwODcyZmE2N2NjYzhlYTM5MjlkZjQ2NTZiNmRkZmMifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoxMDI0MDAsImRpZ2VzdCI6InNoYTI1NjoxMTRkZGUwZmVmZWJiY2ExMzE2NWQwZGE5YzUwMGE2NjE5MGU0OTdhODJhNTNkY2FhYmMzMTcyZDYzMGJlMWU5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MTUzNiwiZGlnZXN0Ijoic2hhMjU2OjRkMDQ5ZjgzZDljZjIxZDFmNWNjMGUxMWRlYWYzNmRmMDI3OTBkMGU2MGMxYTM4Mjk1MzhmYjRiNjE2ODUzNjgifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoyNTYwLCJkaWdlc3QiOiJzaGEyNTY6YWY1YWE5N2ViZTZjZTE2MDQ3NDdlYzFlMjFhZjcxMzZkZWQzOTFiY2FiZTRhY2VmODgyZTcxOGE4N2M4NmJjYyJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjI1NjAsImRpZ2VzdCI6InNoYTI1Njo2ZjFjZGNlYjZhMzE0NmYwY2NiOTg2NTIxMTU2YmVmOGE0MjJjZGJiMDg2MzM5NmY3Zjc1MWY1NzViYTMwOGY0In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjU2MCwiZGlnZXN0Ijoic2hhMjU2OmJiYjZjYWNiOGM4MmU0ZGE0ZTgxNDNlMDMzNTFlOTM5ZWFiNWUyMWNlMGVmMzMzYzQyZTYzN2FmODZjNTIxN2IifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoxNTM2LCJkaWdlc3QiOiJzaGEyNTY6MmE5MmQ2YWM5ZTRmY2MyNzRkNTE2OGIyMTdjYTQ0NThhOWZlYzZmMDk0ZWFkNjhkOTljNzcwNzNmMDhjYWFjMSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjEwMjQwLCJkaWdlc3QiOiJzaGEyNTY6MWE3M2I1NGY1NTZiNDc3ZjBhOGI5MzlkMTNjNTA0YTNiNGY0ZGI3MWY3YTA5YzYzYWZiYzEwYWNiM2RlNTg0OSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjMwNzIsImRpZ2VzdCI6InNoYTI1NjpmNGFlZTllNTNjNDJhMjJlZDgyNDUxMjE4YzNlYTAzZDFlZWE4ZDZjYThmYmU4ZWI0ZTk1MDMwNGJhOGE4YmIzIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MjQxNjY0LCJkaWdlc3QiOiJzaGEyNTY6YmZlOTEzN2ExYjA0NGU4MDk3Y2RmY2I2ODk5MTM3YThhOTg0ZWQ3MDkzMWVkMWU4ZWYwY2Y3ZTAyM2ExMzlmYyJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjEzMDU2MDAwLCJkaWdlc3QiOiJzaGEyNTY6ZDVhM2UwMTQxNjFiYjYwMmQ4N2MyMzEyZTM3MWFkMmVhNmY4MDBjN2Y3YWYyNjFhZjRmYWE2NzMwMmI1M2M4OCJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjU5MTg3MjAsImRpZ2VzdCI6InNoYTI1NjoyZTQ5ODNjNzYxY2U0OTMzZWNlYzIzYzMxMTczZmVkNTUxYTIzN2M4ZDBiYTM1OWI2OTdkZTY0YmQ5NTNhN2MzIn0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MTEyNjQwLCJkaWdlc3QiOiJzaGEyNTY6NzA5NTQxMjQxN2QyZGNlMjg5Yjc3ZjdhOGM2MzJhMDdjODJiNzA3ZmU0M2NmZWY3MzY4YzNiNjVjOGQyNTM4YSJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjMwNzIwMCwiZGlnZXN0Ijoic2hhMjU2OjI0MDFjNWVhMzJhNzU0NTJiYzRiMDJhNjY0YzgwY2Y2M2YxOTc3MDQ2NTM5MjZmY2ExOWUyMmU2Y2JjODU2NTIifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoyMzM0NzIwLCJkaWdlc3QiOiJzaGEyNTY6NjgxOWExYWYwOTdkZjU0M2Q1OGRjMzBiNTFmNzM3ZTU1ZjNmNDJhOWEwNGU2NDFmMTc1ODM0YTU1YmYwNjI5YyJ9LHsibWVkaWFUeXBlIjoiYXBwbGljYXRpb24vdm5kLmRvY2tlci5pbWFnZS5yb290ZnMuZGlmZi50YXIuZ3ppcCIsInNpemUiOjE0MzM2MCwiZGlnZXN0Ijoic2hhMjU2OmMzYWJhZTQ0MjM2OGRjNDQ3ZjE1YzQ2ODkzMzg0M2MzNjFmMjI3ZjVkODdiMmJiODY1MTViNDlmNDA1ODNlZDkifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoxMjE3NjM4NDAsImRpZ2VzdCI6InNoYTI1NjoyZjUyMzljN2IyYmZiZGEzZTI3NWEwNTNjYTA4NjVmYzRjYjhhYWQ2ZDFmZDVhY2EyMmQzZTFlNTRmMzJkZjk5In0seyJtZWRpYVR5cGUiOiJhcHBsaWNhdGlvbi92bmQuZG9ja2VyLmltYWdlLnJvb3Rmcy5kaWZmLnRhci5nemlwIiwic2l6ZSI6MTUzNiwiZGlnZXN0Ijoic2hhMjU2OjNjZDUwY2Y4YjIwNzUzZTM1YmQzZDgyZmI0NWE2YTI0OGFlOTkzZDg4OWUxMDRlMGJlMDJkMzA5ZDJhY2NiZGMifSx7Im1lZGlhVHlwZSI6ImFwcGxpY2F0aW9uL3ZuZC5kb2NrZXIuaW1hZ2Uucm9vdGZzLmRpZmYudGFyLmd6aXAiLCJzaXplIjoyOTU2MDAxMjgsImRpZ2VzdCI6InNoYTI1NjoxZThkYTY1NGIyZTA1N2VmNDNmMjYzODRhYTljNzFkMmJkYWZkYzRkZTAyNDhjZjFjZmQ0NGM0ODY3NTU5MTIzIn1dfQ==","config":"eyJhcmNoaXRlY3R1cmUiOiJhbWQ2NCIsImNvbmZpZyI6eyJVc2VyIjoiNjU1MzIiLCJFeHBvc2VkUG9ydHMiOnsiMzAwMC90Y3AiOnt9fSwiRW52IjpbIlBBVEg9L3Vzci9sb2NhbC9zYmluOi91c3IvbG9jYWwvYmluOi91c3Ivc2JpbjovdXNyL2Jpbjovc2JpbjovYmluIiwiU1NMX0NFUlRfRklMRT0vZXRjL3NzbC9jZXJ0cy9jYS1jZXJ0aWZpY2F0ZXMuY3J0Il0sIkVudHJ5cG9pbnQiOlsiL25vZGVqcy9iaW4vbm9kZSJdLCJDbWQiOlsiL2p1aWNlLXNob3AvYnVpbGQvYXBwLmpzIl0sIldvcmtpbmdEaXIiOiIvanVpY2Utc2hvcCIsIkxhYmVscyI6eyJtYWludGFpbmVyIjoiQmpvZXJuIEtpbW1pbmljaCBcdTAwM2Niam9lcm4ua2ltbWluaWNoQG93YXNwLm9yZ1x1MDAzZSIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5hdXRob3JzIjoiQmpvZXJuIEtpbW1pbmljaCBcdTAwM2Niam9lcm4ua2ltbWluaWNoQG93YXNwLm9yZ1x1MDAzZSIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5jcmVhdGVkIjoi4oCdMjAyNS0wOS0wNFQwNTozODoxMVrigJ0iLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UuZGVzY3JpcHRpb24iOiJQcm9iYWJseSB0aGUgbW9zdCBtb2Rlcm4gYW5kIHNvcGhpc3RpY2F0ZWQgaW5zZWN1cmUgd2ViIGFwcGxpY2F0aW9uIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRvY3VtZW50YXRpb24iOiJodHRwczovL2hlbHAub3dhc3AtanVpY2Uuc2hvcCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5saWNlbnNlcyI6Ik1JVCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5yZXZpc2lvbiI6IjM2ODcwY2IiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2Uuc291cmNlIjoiaHR0cHM6Ly9naXRodWIuY29tL2p1aWNlLXNob3AvanVpY2Utc2hvcCIsIm9yZy5vcGVuY29udGFpbmVycy5pbWFnZS50aXRsZSI6Ik9XQVNQIEp1aWNlIFNob3AiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudXJsIjoiaHR0cHM6Ly9vd2FzcC1qdWljZS5zaG9wIiwib3JnLm9wZW5jb250YWluZXJzLmltYWdlLnZlbmRvciI6Ik9wZW4gV29ybGR3aWRlIEFwcGxpY2F0aW9uIFNlY3VyaXR5IFByb2plY3QiLCJvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVyc2lvbiI6IjE5LjAuMCJ9LCJBcmdzRXNjYXBlZCI6dHJ1ZX0sImNyZWF0ZWQiOiIyMDI1LTA5LTA0VDA1OjQyOjI3LjI1NDQyNzU5NloiLCJoaXN0b3J5IjpbeyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIwMDAxLTAxLTAxVDAwOjAwOjAwWiJ9LHsiY3JlYXRlZCI6IjAwMDEtMDEtMDFUMDA6MDA6MDBaIn0seyJjcmVhdGVkIjoiMDAwMS0wMS0wMVQwMDowMDowMFoifSx7ImNyZWF0ZWQiOiIyMDI1LTA5LTA0VDA1OjM4OjE4Ljg4MDcyMTk0MloiLCJjcmVhdGVkX2J5IjoiQVJHIEJVSUxEX0RBVEU94oCdMjAyNS0wOS0wNFQwNTozODoxMVrigJ0iLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfSx7ImNyZWF0ZWQiOiIyMDI1LTA5LTA0VDA1OjM4OjE4Ljg4MDcyMTk0MloiLCJjcmVhdGVkX2J5IjoiQVJHIFZDU19SRUY9MzY4NzBjYiIsImNvbW1lbnQiOiJidWlsZGtpdC5kb2NrZXJmaWxlLnYwIiwiZW1wdHlfbGF5ZXIiOnRydWV9LHsiY3JlYXRlZCI6IjIwMjUtMDktMDRUMDU6Mzg6MTguODgwNzIxOTQyWiIsImNyZWF0ZWRfYnkiOiJMQUJFTCBtYWludGFpbmVyPUJqb2VybiBLaW1taW5pY2ggXHUwMDNjYmpvZXJuLmtpbW1pbmljaEBvd2FzcC5vcmdcdTAwM2Ugb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnRpdGxlPU9XQVNQIEp1aWNlIFNob3Agb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRlc2NyaXB0aW9uPVByb2JhYmx5IHRoZSBtb3N0IG1vZGVybiBhbmQgc29waGlzdGljYXRlZCBpbnNlY3VyZSB3ZWIgYXBwbGljYXRpb24gb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmF1dGhvcnM9QmpvZXJuIEtpbW1pbmljaCBcdTAwM2Niam9lcm4ua2ltbWluaWNoQG93YXNwLm9yZ1x1MDAzZSBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVuZG9yPU9wZW4gV29ybGR3aWRlIEFwcGxpY2F0aW9uIFNlY3VyaXR5IFByb2plY3Qgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmRvY3VtZW50YXRpb249aHR0cHM6Ly9oZWxwLm93YXNwLWp1aWNlLnNob3Agb3JnLm9wZW5jb250YWluZXJzLmltYWdlLmxpY2Vuc2VzPU1JVCBvcmcub3BlbmNvbnRhaW5lcnMuaW1hZ2UudmVyc2lvbj0xOS4wLjAgb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnVybD1odHRwczovL293YXNwLWp1aWNlLnNob3Agb3JnLm9wZW5jb250YWluZXJzLmltYWdlLnNvdXJjZT1odHRwczovL2dpdGh1Yi5jb20vanVpY2Utc2hvcC9qdWljZS1zaG9wIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5yZXZpc2lvbj0zNjg3MGNiIG9yZy5vcGVuY29udGFpbmVycy5pbWFnZS5jcmVhdGVkPeKAnTIwMjUtMDktMDRUMDU6Mzg6MTFa4oCdIiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNS0wOS0wNFQwNTozODoxOC44ODA3MjE5NDJaIiwiY3JlYXRlZF9ieSI6IldPUktESVIgL2p1aWNlLXNob3AiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjUtMDktMDRUMDU6NDI6MjcuMjU0NDI3NTk2WiIsImNyZWF0ZWRfYnkiOiJDT1BZIC0tY2hvd249NjU1MzI6MCAvanVpY2Utc2hvcCAuICMgYnVpbGRraXQiLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCJ9LHsiY3JlYXRlZCI6IjIwMjUtMDktMDRUMDU6NDI6MjcuMjU0NDI3NTk2WiIsImNyZWF0ZWRfYnkiOiJVU0VSIDY1NTMyIiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNS0wOS0wNFQwNTo0MjoyNy4yNTQ0Mjc1OTZaIiwiY3JlYXRlZF9ieSI6IkVYUE9TRSBtYXBbMzAwMC90Y3A6e31dIiwiY29tbWVudCI6ImJ1aWxka2l0LmRvY2tlcmZpbGUudjAiLCJlbXB0eV9sYXllciI6dHJ1ZX0seyJjcmVhdGVkIjoiMjAyNS0wOS0wNFQwNTo0MjoyNy4yNTQ0Mjc1OTZaIiwiY3JlYXRlZF9ieSI6IkNNRCBbXCIvanVpY2Utc2hvcC9idWlsZC9hcHAuanNcIl0iLCJjb21tZW50IjoiYnVpbGRraXQuZG9ja2VyZmlsZS52MCIsImVtcHR5X2xheWVyIjp0cnVlfV0sIm9zIjoibGludXgiLCJyb290ZnMiOnsidHlwZSI6ImxheWVycyIsImRpZmZfaWRzIjpbInNoYTI1NjpmNDY0YWY0YjliMjUxZWJlOGE3YzJmMTg2YWZmNjU2ZjA4OTJmNmNiMTU5ODM3YTZjZThmZDYzODQyZTgzZTM1Iiwic2hhMjU2OjhmYTEwYzAxOTRkZjliN2MwNTRjOTBkYmU0ODI1ODVmNzY4YTU0NDI4ZmM5MGE1Yjc4YTAwNjZhMTIzYjFiYmEiLCJzaGEyNTY6NDhjMGZiNjczODZlZDcxMzkyMWZjYzA0NjhiZTIzMjMxZDA4NzJmYTY3Y2NjOGVhMzkyOWRmNDY1NmI2ZGRmYyIsInNoYTI1NjoxMTRkZGUwZmVmZWJiY2ExMzE2NWQwZGE5YzUwMGE2NjE5MGU0OTdhODJhNTNkY2FhYmMzMTcyZDYzMGJlMWU5Iiwic2hhMjU2OjRkMDQ5ZjgzZDljZjIxZDFmNWNjMGUxMWRlYWYzNmRmMDI3OTBkMGU2MGMxYTM4Mjk1MzhmYjRiNjE2ODUzNjgiLCJzaGEyNTY6YWY1YWE5N2ViZTZjZTE2MDQ3NDdlYzFlMjFhZjcxMzZkZWQzOTFiY2FiZTRhY2VmODgyZTcxOGE4N2M4NmJjYyIsInNoYTI1Njo2ZjFjZGNlYjZhMzE0NmYwY2NiOTg2NTIxMTU2YmVmOGE0MjJjZGJiMDg2MzM5NmY3Zjc1MWY1NzViYTMwOGY0Iiwic2hhMjU2OmJiYjZjYWNiOGM4MmU0ZGE0ZTgxNDNlMDMzNTFlOTM5ZWFiNWUyMWNlMGVmMzMzYzQyZTYzN2FmODZjNTIxN2IiLCJzaGEyNTY6MmE5MmQ2YWM5ZTRmY2MyNzRkNTE2OGIyMTdjYTQ0NThhOWZlYzZmMDk0ZWFkNjhkOTljNzcwNzNmMDhjYWFjMSIsInNoYTI1NjoxYTczYjU0ZjU1NmI0NzdmMGE4YjkzOWQxM2M1MDRhM2I0ZjRkYjcxZjdhMDljNjNhZmJjMTBhY2IzZGU1ODQ5Iiwic2hhMjU2OmY0YWVlOWU1M2M0MmEyMmVkODI0NTEyMThjM2VhMDNkMWVlYThkNmNhOGZiZThlYjRlOTUwMzA0YmE4YThiYjMiLCJzaGEyNTY6YmZlOTEzN2ExYjA0NGU4MDk3Y2RmY2I2ODk5MTM3YThhOTg0ZWQ3MDkzMWVkMWU4ZWYwY2Y3ZTAyM2ExMzlmYyIsInNoYTI1NjpkNWEzZTAxNDE2MWJiNjAyZDg3YzIzMTJlMzcxYWQyZWE2ZjgwMGM3ZjdhZjI2MWFmNGZhYTY3MzAyYjUzYzg4Iiwic2hhMjU2OjJlNDk4M2M3NjFjZTQ5MzNlY2VjMjNjMzExNzNmZWQ1NTFhMjM3YzhkMGJhMzU5YjY5N2RlNjRiZDk1M2E3YzMiLCJzaGEyNTY6NzA5NTQxMjQxN2QyZGNlMjg5Yjc3ZjdhOGM2MzJhMDdjODJiNzA3ZmU0M2NmZWY3MzY4YzNiNjVjOGQyNTM4YSIsInNoYTI1NjoyNDAxYzVlYTMyYTc1NDUyYmM0YjAyYTY2NGM4MGNmNjNmMTk3NzA0NjUzOTI2ZmNhMTllMjJlNmNiYzg1NjUyIiwic2hhMjU2OjY4MTlhMWFmMDk3ZGY1NDNkNThkYzMwYjUxZjczN2U1NWYzZjQyYTlhMDRlNjQxZjE3NTgzNGE1NWJmMDYyOWMiLCJzaGEyNTY6YzNhYmFlNDQyMzY4ZGM0NDdmMTVjNDY4OTMzODQzYzM2MWYyMjdmNWQ4N2IyYmI4NjUxNWI0OWY0MDU4M2VkOSIsInNoYTI1NjoyZjUyMzljN2IyYmZiZGEzZTI3NWEwNTNjYTA4NjVmYzRjYjhhYWQ2ZDFmZDVhY2EyMmQzZTFlNTRmMzJkZjk5Iiwic2hhMjU2OjNjZDUwY2Y4YjIwNzUzZTM1YmQzZDgyZmI0NWE2YTI0OGFlOTkzZDg4OWUxMDRlMGJlMDJkMzA5ZDJhY2NiZGMiLCJzaGEyNTY6MWU4ZGE2NTRiMmUwNTdlZjQzZjI2Mzg0YWE5YzcxZDJiZGFmZGM0ZGUwMjQ4Y2YxY2ZkNDRjNDg2NzU1OTEyMyJdfX0=","repoDigests":["bkimminich/juice-shop@sha256:2765a26de7647609099a338d5b7f61085d95903c8703bb70f03fcc4b12f0818d"],"architecture":"amd64","os":"linux","labels":{"maintainer":"Bjoern Kimminich ","org.opencontainers.image.authors":"Bjoern Kimminich ","org.opencontainers.image.created":"”2025-09-04T05:38:11Z”","org.opencontainers.image.description":"Probably the most modern and sophisticated insecure web application","org.opencontainers.image.documentation":"https://help.owasp-juice.shop","org.opencontainers.image.licenses":"MIT","org.opencontainers.image.revision":"36870cb","org.opencontainers.image.source":"https://github.com/juice-shop/juice-shop","org.opencontainers.image.title":"OWASP Juice Shop","org.opencontainers.image.url":"https://owasp-juice.shop","org.opencontainers.image.vendor":"Open Worldwide Application Security Project","org.opencontainers.image.version":"19.0.0"}}},"distro":{"name":"debian","version":"12","idLike":[]},"descriptor":{"name":"grype","version":"0.109.0","configuration":{"output":["json"],"file":"","pretty":false,"distro":"","add-cpes-if-none":false,"output-template-file":"","check-for-app-update":true,"only-fixed":false,"only-notfixed":false,"ignore-wontfix":"","platform":"","search":{"scope":"squashed","unindexed-archives":false,"indexed-archives":true},"ignore":[{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"kernel-headers","version":"","language":"","type":"rpm","location":"","upstream-name":"kernel"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux(-.*)?-headers-.*","version":"","language":"","type":"deb","location":"","upstream-name":"linux.*"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"},{"vulnerability":"","include-aliases":false,"reason":"","namespace":"","fix-state":"","package":{"name":"linux-libc-dev","version":"","language":"","type":"deb","location":"","upstream-name":"linux"},"vex-status":"","vex-justification":"","match-type":"exact-indirect-match"}],"exclude":[],"externalSources":{"enable":false,"maven":{"searchUpstreamBySha1":true,"baseUrl":"https://search.maven.org/solrsearch/select","rateLimit":300000000}},"match":{"java":{"using-cpes":false},"jvm":{"using-cpes":true},"dotnet":{"using-cpes":false},"golang":{"using-cpes":false,"always-use-cpe-for-stdlib":true,"allow-main-module-pseudo-version-comparison":false},"javascript":{"using-cpes":false},"python":{"using-cpes":false},"ruby":{"using-cpes":false},"rust":{"using-cpes":false},"hex":{"using-cpes":false},"stock":{"using-cpes":true},"dpkg":{"using-cpes":false,"missing-epoch-strategy":"zero","use-cpes-for-eol":false},"rpm":{"using-cpes":false,"missing-epoch-strategy":"auto","use-cpes-for-eol":false}},"fail-on-severity":"","registry":{"insecure-skip-tls-verify":false,"insecure-use-http":false,"ca-cert":""},"show-suppressed":false,"by-cve":false,"SortBy":{"sort-by":"risk"},"name":"","default-image-pull-source":"","from":null,"vex-documents":[],"vex-add":[],"match-upstream-kernel-headers":false,"fix-channel":{"redhat-eus":{"apply":"auto","versions":">= 8.0"}},"timestamp":true,"alerts":{"enable-eol-distro-warnings":true},"db":{"cache-dir":"/.cache/grype/db","update-url":"https://grype.anchore.io/databases","ca-cert":"","auto-update":true,"validate-by-hash-on-start":true,"validate-age":true,"max-allowed-built-age":432000000000000,"require-update-check":false,"update-available-timeout":30000000000,"update-download-timeout":300000000000,"max-update-check-frequency":7200000000000},"exp":{},"dev":{"db":{"debug":false}}},"db":{"status":{"schemaVersion":"v6.1.4","from":"https://grype.anchore.io/databases/v6/vulnerability-db_v6.1.4_2026-03-01T16:12:17Z_1772432969.tar.zst?checksum=sha256%3Abf5880828dd2dd97848bec9398fb02efd7ccc37ff3fc5b0243394959fd93610f","built":"2026-03-02T06:29:29Z","path":"/.cache/grype/db/6/vulnerability.db","valid":true},"providers":{"alma":{"captured":"2026-03-02T00:29:35Z","input":"xxh64:a1027418f269feb8"},"alpine":{"captured":"2026-03-02T00:29:42Z","input":"xxh64:7e95cf83ea5fd01d"},"amazon":{"captured":"2026-03-02T00:29:52Z","input":"xxh64:c363d18b84d06274"},"arch":{"captured":"2026-03-02T00:29:40Z","input":"xxh64:e3e0b2148262146c"},"bitnami":{"captured":"2026-03-02T00:29:48Z","input":"xxh64:7b2154ed17439b77"},"chainguard":{"captured":"2026-03-02T00:29:42Z","input":"xxh64:c0f957cc24b8d7c3"},"chainguard-libraries":{"captured":"2026-03-02T00:29:35Z","input":"xxh64:d97ae42b6cba02f9"},"debian":{"captured":"2026-03-02T00:29:52Z","input":"xxh64:7bdfb8da29ecc231"},"echo":{"captured":"2026-03-02T00:29:47Z","input":"xxh64:4a9cac8c1185bd1a"},"eol":{"captured":"2026-03-02T00:29:58Z","input":"xxh64:a318c46ecded245a"},"epss":{"captured":"2026-03-02T00:29:44Z","input":"xxh64:6785b000bd1dd900"},"fedora":{"captured":"2026-03-02T00:30:02Z","input":"xxh64:c744d6a719608401"},"github":{"captured":"2026-03-02T00:29:47Z","input":"xxh64:6c1e519fc1fb3f44"},"kev":{"captured":"2026-03-02T00:29:34Z","input":"xxh64:e4fb3271793ad9d7"},"mariner":{"captured":"2026-03-02T00:29:50Z","input":"xxh64:3ea6373d7dbf99ce"},"minimos":{"captured":"2026-03-02T00:29:51Z","input":"xxh64:ac43ebba2a23a0aa"},"nvd":{"captured":"2026-03-02T00:30:01Z","input":"xxh64:d405c423617abf51"},"oracle":{"captured":"2026-03-02T00:29:36Z","input":"xxh64:f0de480dba75bf8b"},"photon":{"captured":"2026-03-02T00:29:39Z","input":"xxh64:30b5deaf9c0c2b5c"},"rhel":{"captured":"2026-03-02T00:30:24Z","input":"xxh64:9aa26af7c696781a"},"secureos":{"captured":"2026-03-02T00:29:38Z","input":"xxh64:5d76276350fca312"},"sles":{"captured":"2026-03-02T00:29:48Z","input":"xxh64:1406409f77f8ab96"},"ubuntu":{"captured":"2026-03-01T16:12:17Z","input":"xxh64:0296a4d7072e01d2"},"wolfi":{"captured":"2026-03-02T00:29:42Z","input":"xxh64:cf516c42c308c556"}}},"timestamp":"2026-03-02T17:13:20.450773285Z"}}
diff --git a/labs/lab4/syft/grype-vuln-table.txt b/labs/lab4/syft/grype-vuln-table.txt
new file mode 100644
index 00000000..26fbe70b
--- /dev/null
+++ b/labs/lab4/syft/grype-vuln-table.txt
@@ -0,0 +1,123 @@
+NAME INSTALLED FIXED IN TYPE VULNERABILITY SEVERITY EPSS RISK
+ip 2.0.1 npm GHSA-2p57-rm9w-gvfp High 86.5% (99th) 67.5
+vm2 3.9.17 3.9.18 npm GHSA-whpj-8f3w-67p5 Critical 69.9% (98th) 65.7
+vm2 3.9.17 npm GHSA-g644-9gfx-q4q4 Critical 39.2% (97th) 36.9
+jsonwebtoken 0.1.0 4.2.2 npm GHSA-c7hr-j4mj-j2w6 Critical 32.5% (96th) 29.2
+jsonwebtoken 0.4.0 4.2.2 npm GHSA-c7hr-j4mj-j2w6 Critical 32.5% (96th) 29.2
+vm2 3.9.17 3.10.0 npm GHSA-cchq-frgv-rjh5 Critical 5.0% (89th) 4.7
+moment 2.0.0 2.29.2 npm GHSA-8hfj-j24r-96c4 High 2.2% (84th) 1.7
+lodash.set 4.3.2 npm GHSA-p6mc-m468-83gw High 2.0% (83rd) 1.5
+engine.io 4.1.2 6.2.1 npm GHSA-r7qp-cfhv-p84w Medium 2.3% (84th) 1.3
+lodash 2.4.2 4.17.12 npm GHSA-jf85-cpcp-j695 Critical 1.2% (78th) 1.1
+moment 2.0.0 2.11.2 npm GHSA-87vv-r9j6-g5qv Medium 1.9% (82nd) 1.1
+crypto-js 3.3.0 4.2.0 npm GHSA-xwcq-pm8m-c4vf Critical 0.8% (74th) 0.7
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-15467 Critical 0.8% (73rd) 0.7
+sanitize-html 1.4.2 2.12.1 npm GHSA-rm97-x556-q36h Medium 1.3% (79th) 0.7
+ws 7.4.6 7.5.10 npm GHSA-3h5v-q93c-6h6q High 0.5% (67th) 0.4
+got 8.3.2 11.8.5 npm GHSA-pfrx-2q88-qq97 Medium 0.8% (73rd) 0.4
+sanitize-html 1.4.2 2.7.1 npm GHSA-cgfm-xwp7-2cvr High 0.4% (63rd) 0.3
+vm2 3.9.17 3.9.18 npm GHSA-p5gc-c584-jj6v Medium 0.6% (68th) 0.3
+tar 4.4.19 6.2.1 npm GHSA-f5x3-32g6-xq36 Medium 0.4% (63rd) 0.3
+lodash 2.4.2 4.17.21 npm GHSA-35jh-r3h4-6jhm High 0.3% (50th) 0.2
+sanitize-html 1.4.2 1.4.3 npm GHSA-3j7m-hmh3-9jmp Medium 0.3% (55th) 0.2
+moment 2.0.0 2.19.3 npm GHSA-446m-mv8f-q348 High 0.2% (46th) 0.2
+notevil 1.3.3 npm GHSA-8g4m-cjm2-96wq Medium 0.3% (53rd) 0.2
+qs 6.13.0 6.14.1 npm GHSA-6rw7-vpxm-498p High 0.2% (44th) 0.2
+express-jwt 0.1.3 6.0.0 npm GHSA-6g6m-m6h5-w9gf High 0.2% (44th) 0.2
+lodash 2.4.2 4.17.11 npm GHSA-4xc9-xhrj-v574 High 0.2% (42nd) 0.2
+sanitize-html 1.4.2 2.3.2 npm GHSA-mjxr-4v3x-q3m4 Medium 0.3% (52nd) 0.1
+sanitize-html 1.4.2 2.3.1 npm GHSA-rjqq-98f6-6j3r Medium 0.3% (52nd) 0.1
+http-cache-semantics 3.8.1 4.1.1 npm GHSA-rc47-6667-2j5j High 0.2% (41st) 0.1
+sanitize-html 1.4.2 1.11.4 npm GHSA-xc6g-ggrc-qq4r Medium 0.3% (51st) 0.1
+socket.io-parser 4.0.5 4.2.3 npm GHSA-cqmj-92xf-r6r9 Medium 0.2% (42nd) 0.1
+braces 2.3.2 3.0.3 npm GHSA-grv7-fg5c-xmjg High 0.2% (36th) 0.1
+lodash 2.4.2 4.17.5 npm GHSA-fvqr-27wr-82fm Medium 0.1% (34th) < 0.1
+socket.io 3.1.2 4.6.2 npm GHSA-25hc-qcg6-38wj Medium 0.1% (33rd) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2018-20796 Negligible 1.5% (80th) < 0.1
+cookie 0.4.2 0.7.0 npm GHSA-pxg6-pf52-xh8x Low 0.2% (42nd) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-69420 High < 0.1% (22nd) < 0.1
+jsonwebtoken 0.1.0 9.0.0 npm GHSA-8cf7-32gw-wr33 High < 0.1% (21st) < 0.1
+jsonwebtoken 0.4.0 9.0.0 npm GHSA-8cf7-32gw-wr33 High < 0.1% (21st) < 0.1
+validator 13.15.15 13.15.22 npm GHSA-vghf-hv5q-vc2g High < 0.1% (22nd) < 0.1
+multer 1.4.5-lts.2 2.0.1 npm GHSA-g5hg-p3ph-g8qg High < 0.1% (20th) < 0.1
+micromatch 3.1.10 4.0.8 npm GHSA-952p-6rrq-rcjv Medium 0.1% (28th) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2025-59465 High < 0.1% (20th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-69421 High < 0.1% (20th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-69419 High < 0.1% (19th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-9192 Negligible 0.9% (74th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010025 Negligible 0.9% (74th) < 0.1
+minimatch 3.0.5 3.1.3 npm GHSA-3ppc-4f35-3m26 High < 0.1% (16th) < 0.1
+minimatch 3.0.8 3.1.3 npm GHSA-3ppc-4f35-3m26 High < 0.1% (16th) < 0.1
+minimatch 3.1.2 3.1.3 npm GHSA-3ppc-4f35-3m26 High < 0.1% (16th) < 0.1
+minimatch 5.1.6 5.1.7 npm GHSA-3ppc-4f35-3m26 High < 0.1% (16th) < 0.1
+minimatch 9.0.5 9.0.6 npm GHSA-3ppc-4f35-3m26 High < 0.1% (16th) < 0.1
+libc6 2.36-9+deb12u10 (won't fix) deb CVE-2025-15281 High < 0.1% (16th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2026-22796 Medium < 0.1% (22nd) < 0.1
+dottie 2.0.6 2.0.7 npm GHSA-r5mx-6wc6-7h9w Medium < 0.1% (20th) < 0.1
+multer 1.4.5-lts.2 2.0.0 npm GHSA-44fp-w29j-9vj5 High < 0.1% (14th) < 0.1
+multer 1.4.5-lts.2 2.1.0 npm GHSA-v52c-386h-88mc High < 0.1% (12th) < 0.1
+multer 1.4.5-lts.2 2.1.0 npm GHSA-xf7r-hgr6-v32p High < 0.1% (12th) < 0.1
+minimatch 3.0.5 3.1.3 npm GHSA-7r86-cg39-jmmj High < 0.1% (13th) < 0.1
+minimatch 3.0.8 3.1.3 npm GHSA-7r86-cg39-jmmj High < 0.1% (13th) < 0.1
+minimatch 3.1.2 3.1.3 npm GHSA-7r86-cg39-jmmj High < 0.1% (13th) < 0.1
+minimatch 5.1.6 5.1.8 npm GHSA-7r86-cg39-jmmj High < 0.1% (13th) < 0.1
+minimatch 9.0.5 9.0.7 npm GHSA-7r86-cg39-jmmj High < 0.1% (13th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010024 Negligible 0.6% (70th) < 0.1
+vm2 3.9.17 3.10.2 npm GHSA-99p7-6v5w-7xg8 Critical < 0.1% (9th) < 0.1
+minimatch 3.0.5 3.1.4 npm GHSA-23c5-xmqv-rm74 High < 0.1% (11th) < 0.1
+minimatch 3.0.8 3.1.4 npm GHSA-23c5-xmqv-rm74 High < 0.1% (11th) < 0.1
+minimatch 3.1.2 3.1.4 npm GHSA-23c5-xmqv-rm74 High < 0.1% (11th) < 0.1
+minimatch 5.1.6 5.1.8 npm GHSA-23c5-xmqv-rm74 High < 0.1% (11th) < 0.1
+minimatch 9.0.5 9.0.7 npm GHSA-23c5-xmqv-rm74 High < 0.1% (11th) < 0.1
+jsonwebtoken 0.1.0 9.0.0 npm GHSA-hjrf-2m68-5959 Medium < 0.1% (18th) < 0.1
+jsonwebtoken 0.4.0 9.0.0 npm GHSA-hjrf-2m68-5959 Medium < 0.1% (18th) < 0.1
+glob 10.4.5 10.5.0 npm GHSA-5j98-mcp5-4vw2 High < 0.1% (11th) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2026-21637 High < 0.1% (11th) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2025-55131 High < 0.1% (8th) < 0.1
+sanitize-html 1.4.2 2.0.0-beta npm GHSA-qhxp-v273-g94h Medium < 0.1% (11th) < 0.1
+tar-fs 2.1.3 2.1.4 npm GHSA-vj76-c3g6-qr5v High < 0.1% (7th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2010-4756 Negligible 0.4% (59th) < 0.1
+validator 13.15.15 13.15.20 npm GHSA-9965-vmph-33xx Medium < 0.1% (9th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.17-1~deb12u3 deb CVE-2025-9230 High < 0.1% (5th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010023 Negligible 0.3% (54th) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2025-59466 High < 0.1% (5th) < 0.1
+lodash 4.17.21 4.17.23 npm GHSA-xxjr-mmjv-4gpg Medium < 0.1% (6th) < 0.1
+libc6 2.36-9+deb12u10 (won't fix) deb CVE-2026-0915 High < 0.1% (4th) < 0.1
+qs 6.13.0 6.14.2 npm GHSA-w7fw-mjwx-w883 Low < 0.1% (11th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.17-1~deb12u3 deb CVE-2025-9232 Medium < 0.1% (6th) < 0.1
+libc6 2.36-9+deb12u10 2.36-9+deb12u11 deb CVE-2025-4802 High < 0.1% (3rd) < 0.1
+tar 4.4.19 7.5.7 npm GHSA-34x7-hfp2-rc4v High < 0.1% (2nd) < 0.1
+tar 6.2.1 7.5.7 npm GHSA-34x7-hfp2-rc4v High < 0.1% (2nd) < 0.1
+tar 7.4.3 7.5.7 npm GHSA-34x7-hfp2-rc4v High < 0.1% (2nd) < 0.1
+js-yaml 3.14.1 3.14.2 npm GHSA-mh29-5h37-fv8m Medium < 0.1% (5th) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2025-55130 Critical < 0.1% (1st) < 0.1
+jsonwebtoken 0.1.0 9.0.0 npm GHSA-qwph-4952-7xr6 Medium < 0.1% (4th) < 0.1
+jsonwebtoken 0.4.0 9.0.0 npm GHSA-qwph-4952-7xr6 Medium < 0.1% (4th) < 0.1
+multer 1.4.5-lts.2 2.0.2 npm GHSA-fjgf-rc76-4x9p High < 0.1% (1st) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2026-22795 Medium < 0.1% (3rd) < 0.1
+tar 4.4.19 7.5.8 npm GHSA-83g3-92jg-28cx High < 0.1% (1st) < 0.1
+tar 6.2.1 7.5.8 npm GHSA-83g3-92jg-28cx High < 0.1% (1st) < 0.1
+tar 7.4.3 7.5.8 npm GHSA-83g3-92jg-28cx High < 0.1% (1st) < 0.1
+multer 1.4.5-lts.2 2.0.0 npm GHSA-4pg4-qvpc-4q3h High < 0.1% (1st) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-68160 Medium < 0.1% (3rd) < 0.1
+jws 0.2.6 3.2.3 npm GHSA-869p-cjfg-cm3x High < 0.1% (0th) < 0.1
+libc6 2.36-9+deb12u10 deb CVE-2019-1010022 Negligible 0.1% (32nd) < 0.1
+libc6 2.36-9+deb12u10 (won't fix) deb CVE-2026-0861 High < 0.1% (0th) < 0.1
+diff 4.0.2 4.0.4 npm GHSA-73rr-hh4g-fpgx Low < 0.1% (4th) < 0.1
+tar 4.4.19 7.5.3 npm GHSA-8qq5-rm4j-mr97 High < 0.1% (0th) < 0.1
+tar 6.2.1 7.5.3 npm GHSA-8qq5-rm4j-mr97 High < 0.1% (0th) < 0.1
+tar 7.4.3 7.5.3 npm GHSA-8qq5-rm4j-mr97 High < 0.1% (0th) < 0.1
+tar 4.4.19 7.5.4 npm GHSA-r6q2-hw4h-h46w High < 0.1% (0th) < 0.1
+tar 6.2.1 7.5.4 npm GHSA-r6q2-hw4h-h46w High < 0.1% (0th) < 0.1
+tar 7.4.3 7.5.4 npm GHSA-r6q2-hw4h-h46w High < 0.1% (0th) < 0.1
+node 22.18.0 20.20.0, *22.22.0, 24.13.0, 25.3.0 binary CVE-2025-55132 Medium < 0.1% (1st) < 0.1
+libc6 2.36-9+deb12u10 2.36-9+deb12u13 deb CVE-2025-8058 Medium < 0.1% (0th) < 0.1
+libssl3 3.0.17-1~deb12u2 deb CVE-2025-27587 Negligible < 0.1% (15th) < 0.1
+gcc-12-base 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+libgcc-s1 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+libgomp1 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+libstdc++6 12.2.0-14+deb12u1 deb CVE-2022-27943 Negligible < 0.1% (15th) < 0.1
+libssl3 3.0.17-1~deb12u2 3.0.18-1~deb12u2 deb CVE-2025-69418 Medium < 0.1% (0th) < 0.1
+marsdb 0.6.11 npm GHSA-5mrr-rgp6-x4gr Critical N/A N/A
+jws 0.2.6 3.0.0 npm GHSA-gjcw-v447-2w7q High N/A N/A
+base64url 0.0.6 3.0.0 npm GHSA-rvg8-pwq2-xj7q Medium N/A N/A
diff --git a/labs/lab4/syft/juice-shop-licenses.txt b/labs/lab4/syft/juice-shop-licenses.txt
new file mode 100644
index 00000000..f3f672fa
--- /dev/null
+++ b/labs/lab4/syft/juice-shop-licenses.txt
@@ -0,0 +1,1129 @@
+Extracting licenses from Syft SBOM...
+1to2 | 1.0.0 | MIT
+@adraffy/ens-normalize | 1.10.1 | MIT
+@babel/helper-string-parser | 7.27.1 | MIT
+@babel/helper-validator-identifier | 7.27.1 | MIT
+@babel/parser | 7.28.3 | MIT
+@babel/types | 7.28.2 | MIT
+@colors/colors | 1.6.0 | MIT
+@colors/colors | 1.6.0 | MIT
+@dabh/diagnostics | 2.0.3 | MIT
+@ethereumjs/rlp | 4.0.1 | MPL-2.0
+@ethereumjs/rlp | 5.0.2 | MPL-2.0
+@gar/promisify | 1.1.3 | MIT
+@isaacs/cliui | 8.0.2 | ISC
+@isaacs/fs-minipass | 4.0.1 | ISC
+@my-scope/package-a | 0.0.0 | MIT
+@my-scope/package-b | 0.0.0 | MIT
+@nlpjs/core | 4.26.1 | MIT
+@nlpjs/core-loader | 4.26.1 | MIT
+@nlpjs/evaluator | 4.26.1 | MIT
+@nlpjs/lang-en | 4.26.1 | MIT
+@nlpjs/lang-en-min | 4.26.1 | MIT
+@nlpjs/language | 4.25.0 | MIT
+@nlpjs/language-min | 4.25.0 | MIT
+@nlpjs/ner | 4.27.0 | MIT
+@nlpjs/neural | 4.25.0 | MIT
+@nlpjs/nlg | 4.26.1 | MIT
+@nlpjs/nlp | 4.27.0 | MIT
+@nlpjs/nlu | 4.27.0 | MIT
+@nlpjs/request | 4.25.0 | MIT
+@nlpjs/sentiment | 4.26.1 | MIT
+@nlpjs/similarity | 4.26.1 | MIT
+@nlpjs/slot | 4.26.1 | MIT
+@noble/curves | 1.2.0 | MIT
+@noble/curves | 1.4.2 | MIT
+@noble/curves | 1.4.2 | MIT
+@noble/hashes | 1.3.2 | MIT
+@noble/hashes | 1.4.0 | MIT
+@noble/hashes | 1.4.0 | MIT
+@noble/hashes | 1.4.0 | MIT
+@npmcli/agent | 3.0.0 | ISC
+@npmcli/fs | 1.1.1 | ISC
+@npmcli/fs | 4.0.0 | ISC
+@npmcli/move-file | 1.1.2 | MIT
+@otplib/core | 12.0.1 | MIT
+@otplib/plugin-crypto | 12.0.1 | MIT
+@otplib/plugin-thirty-two | 12.0.1 | MIT
+@otplib/preset-default | 12.0.1 | MIT
+@otplib/preset-v11 | 12.0.1 | MIT
+@pkgjs/parseargs | 0.11.0 | MIT
+@scarf/scarf | 1.4.0 | Apache-2.0
+@scure/base | 1.1.9 | MIT
+@scure/bip32 | 1.4.0 | MIT
+@scure/bip39 | 1.3.0 | MIT
+@sindresorhus/is | 0.7.0 | MIT
+@swc/helpers | 0.3.17 | MIT
+@tokenizer/token | 0.3.0 | MIT
+@tootallnate/once | 1.1.2 | MIT
+@tootallnate/once | 2.0.0 | MIT
+@types/component-emitter | 1.2.14 | MIT
+@types/cookie | 0.4.1 | MIT
+@types/cors | 2.8.19 | MIT
+@types/debug | 4.1.12 | MIT
+@types/ms | 2.1.0 | MIT
+@types/node | 20.19.12 | MIT
+@types/node | 22.7.5 | MIT
+@types/strip-bom | 3.0.0 | MIT
+@types/strip-json-comments | 0.0.30 | MIT
+@types/triple-beam | 1.3.5 | MIT
+@types/validator | 13.15.3 | MIT
+@types/ws | 8.5.3 | MIT
+abbrev | 1.1.1 | ISC
+abbrev | 3.0.1 | ISC
+abitype | 0.7.1 | MIT
+abort-controller | 3.0.0 | MIT
+accepts | 1.3.8 | MIT
+acorn | 7.4.1 | MIT
+acorn | 8.15.0 | MIT
+acorn-walk | 8.3.4 | MIT
+aes-js | 4.0.0-beta.5 | MIT
+agent-base | 6.0.2 | MIT
+agent-base | 7.1.4 | MIT
+agent-base | 7.1.4 | MIT
+agentkeepalive | 4.6.0 | MIT
+aggregate-error | 3.1.0 | MIT
+ansi-regex | 2.1.1 | MIT
+ansi-regex | 2.1.1 | MIT
+ansi-regex | 2.1.1 | MIT
+ansi-regex | 3.0.1 | MIT
+ansi-regex | 5.0.1 | MIT
+ansi-regex | 6.2.0 | MIT
+ansi-regex | 6.2.0 | MIT
+ansi-styles | 2.2.1 | MIT
+ansi-styles | 3.2.1 | MIT
+ansi-styles | 4.3.0 | MIT
+ansi-styles | 4.3.0 | MIT
+ansi-styles | 4.3.0 | MIT
+ansi-styles | 6.2.1 | MIT
+anymatch | 3.1.3 | ISC
+append-field | 1.0.0 | MIT
+aproba | 1.2.0 | ISC
+archive-type | 4.0.0 | MIT
+archiver | 1.3.0 | MIT
+archiver-utils | 1.3.0 | MIT
+are-we-there-yet | 1.1.7 | ISC
+are-we-there-yet | 3.0.1 | ISC
+arg | 4.1.3 | MIT
+argparse | 1.0.10 | MIT
+arr-diff | 4.0.0 | MIT
+arr-flatten | 1.1.0 | MIT
+arr-union | 3.1.0 | MIT
+array-buffer-byte-length | 1.0.2 | MIT
+array-each | 1.0.1 | MIT
+array-flatten | 1.1.1 | MIT
+array-slice | 1.1.0 | MIT
+array-unique | 0.3.2 | MIT
+asap | 2.0.6 | MIT
+assert-never | 1.4.0 | MIT
+assign-symbols | 1.0.0 | MIT
+async | 2.6.4 | MIT
+async | 2.6.4 | MIT
+async | 3.2.6 | MIT
+at-least-node | 1.0.0 | ISC
+atob | 2.1.2 | (MIT OR Apache-2.0)
+available-typed-arrays | 1.0.7 | MIT
+babel-walk | 3.0.0-canary-5 | MIT
+balanced-match | 1.0.2 | MIT
+base | 0.11.2 | MIT
+base-files | 12.4+deb12u11 | GPL
+base64-arraybuffer | 0.1.4 | MIT
+base64-js | 0.0.8 | MIT
+base64-js | 1.5.1 | MIT
+base64id | 2.0.0 | MIT
+base64url | 0.0.6 | MIT
+basic-auth | 2.0.1 | MIT
+batch | 0.6.1 | MIT
+big-integer | 1.6.52 | Unlicense
+binary | 0.3.0 | MIT
+binary-extensions | 2.3.0 | MIT
+bindings | 1.5.0 | MIT
+bintrees | 1.0.2 | MIT
+bl | 1.2.3 | MIT
+bl | 4.1.0 | MIT
+bluebird | 3.4.7 | MIT
+bluebird | 3.7.2 | MIT
+body-parser | 1.20.3 | MIT
+bower-config | 1.4.3 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 1.1.12 | MIT
+brace-expansion | 2.0.2 | MIT
+braces | 2.3.2 | MIT
+braces | 3.0.3 | MIT
+braces | 3.0.3 | MIT
+braces | 3.0.3 | MIT
+brotli | 1.3.3 | MIT
+buffer | 5.7.1 | MIT
+buffer | 6.0.3 | MIT
+buffer-alloc | 1.2.0 | MIT
+buffer-alloc-unsafe | 1.1.0 | MIT
+buffer-crc32 | 0.2.13 | MIT
+buffer-fill | 1.0.0 | MIT
+buffer-from | 1.1.2 | MIT
+buffer-indexof-polyfill | 1.0.2 | MIT
+busboy | 1.6.0 | MIT
+byline | 4.2.2 | MIT
+bytes | 3.1.2 | MIT
+cacache | 15.3.0 | ISC
+cacache | 19.0.1 | ISC
+cache-base | 1.0.1 | MIT
+cacheable-request | 2.1.4 | MIT
+call-bind | 1.0.8 | MIT
+call-bind-apply-helpers | 1.0.2 | MIT
+call-bound | 1.0.4 | MIT
+camelcase | 5.3.1 | MIT
+chainsaw | 0.1.0 | MIT/X11
+chalk | 1.1.3 | MIT
+chalk | 2.4.2 | MIT
+chalk | 4.1.2 | MIT
+character-parser | 2.2.0 | MIT
+check-dependencies | 1.1.1 | MIT
+check-internet-connected | 2.0.6 | MIT
+check-types | 6.0.0 | MIT
+chokidar | 3.5.1 | MIT
+chownr | 1.1.4 | ISC
+chownr | 1.1.4 | ISC
+chownr | 2.0.0 | ISC
+chownr | 3.0.0 | BlueOak-1.0.0
+clarinet | 0.12.6 | BSD-2-Clause
+class-utils | 0.3.6 | MIT
+clean-stack | 2.2.0 | MIT
+cliui | 6.0.0 | ISC
+clone | 2.1.2 | MIT
+clone-response | 1.0.2 | MIT
+code-point-at | 1.1.0 | MIT
+collection-visit | 1.0.0 | MIT
+color | 3.2.1 | MIT
+color-convert | 1.9.3 | MIT
+color-convert | 2.0.1 | MIT
+color-convert | 2.0.1 | MIT
+color-convert | 2.0.1 | MIT
+color-name | 1.1.3 | MIT
+color-name | 1.1.4 | MIT
+color-name | 1.1.4 | MIT
+color-name | 1.1.4 | MIT
+color-string | 1.9.1 | MIT
+color-support | 1.1.3 | ISC
+colors | 1.1.2 | MIT
+colors | 1.4.0 | MIT
+colorspace | 1.1.4 | MIT
+commander | 2.20.3 | MIT
+commander | 2.20.3 | MIT
+component-emitter | 1.3.1 | MIT
+component-type | 1.2.1 | MIT
+compress-commons | 1.2.2 | MIT
+compressible | 2.0.18 | MIT
+compression | 1.8.1 | MIT
+concat-map | 0.0.1 | MIT
+concat-stream | 1.6.2 | MIT
+config | 3.3.12 | MIT
+console-control-strings | 1.1.0 | ISC
+constantinople | 4.0.1 | MIT
+content-disposition | 0.5.4 | MIT
+content-type | 1.0.5 | MIT
+cookie | 0.4.2 | MIT
+cookie | 0.7.1 | MIT
+cookie | 0.7.2 | MIT
+cookie-parser | 1.4.7 | MIT
+cookie-signature | 1.0.6 | MIT
+copy-descriptor | 0.1.1 | MIT
+core-util-is | 1.0.2 | MIT
+cors | 2.8.5 | MIT
+crc | 3.8.0 | MIT
+crc-32 | 1.2.2 | Apache-2.0
+crc32-stream | 2.0.0 | MIT
+create-require | 1.1.1 | MIT
+cross-fetch | 4.1.0 | MIT
+cross-fetch-polyfill | 0.0.0 | MIT
+cross-spawn | 7.0.6 | MIT
+crypto-js | 3.3.0 | MIT
+dateformat | 4.6.3 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 2.6.9 | MIT
+debug | 3.2.7 | MIT
+debug | 4.3.7 | MIT
+decamelize | 1.2.0 | MIT
+decode-uri-component | 0.2.2 | MIT
+decompress | 4.2.1 | MIT
+decompress-response | 3.3.0 | MIT
+decompress-response | 4.2.1 | MIT
+decompress-response | 6.0.0 | MIT
+decompress-response | 6.0.0 | MIT
+decompress-tar | 4.1.1 | MIT
+decompress-tarbz2 | 4.1.1 | MIT
+decompress-targz | 4.1.1 | MIT
+decompress-unzip | 4.0.1 | MIT
+deep-equal | 2.2.3 | MIT
+deep-extend | 0.6.0 | MIT
+define-data-property | 1.1.4 | MIT
+define-properties | 1.2.1 | MIT
+define-property | 0.2.5 | MIT
+define-property | 0.2.5 | MIT
+define-property | 0.2.5 | MIT
+define-property | 0.2.5 | MIT
+define-property | 0.2.5 | MIT
+define-property | 1.0.0 | MIT
+define-property | 1.0.0 | MIT
+define-property | 1.0.0 | MIT
+define-property | 2.0.2 | MIT
+delegates | 1.0.0 | MIT
+depd | 1.1.2 | MIT
+depd | 2.0.0 | MIT
+destroy | 1.2.0 | MIT
+detect-file | 1.0.0 | MIT
+detect-libc | 1.0.3 | Apache-2.0
+detect-libc | 2.0.4 | Apache-2.0
+detect-libc | 2.0.4 | Apache-2.0
+dfa | 1.2.0 | MIT
+diff | 4.0.2 | BSD-3-Clause
+doctypes | 1.1.0 | MIT
+domelementtype | 1.3.1 | BSD-2-Clause
+domhandler | 2.1.0 | sha256:cb992345949ccd6e8394b2cd6c465f7b897c864f845937dbf64e8997f389e164
+domutils | 1.1.6 | sha256:cb992345949ccd6e8394b2cd6c465f7b897c864f845937dbf64e8997f389e164
+dottie | 2.0.6 | MIT
+double-ended-queue | 0.9.7 | MIT
+download | 8.0.0 | MIT
+dunder-proto | 1.0.1 | MIT
+duplexer2 | 0.1.4 | BSD-3-Clause
+duplexer3 | 0.1.5 | BSD-3-Clause
+dynamic-dedupe | 0.3.0 | MIT
+eastasianwidth | 0.2.0 | MIT
+ee-first | 1.1.1 | MIT
+eivindfjeldstad-dot | 0.0.1 | MIT
+emoji-regex | 8.0.0 | MIT
+emoji-regex | 9.2.2 | MIT
+emoji-regex | 9.2.2 | MIT
+enabled | 2.0.0 | MIT
+encodeurl | 1.0.2 | MIT
+encodeurl | 2.0.0 | MIT
+encoding | 0.1.13 | MIT
+end-of-stream | 1.4.5 | MIT
+engine.io | 4.1.2 | MIT
+engine.io-parser | 4.0.3 | MIT
+env-paths | 2.2.1 | MIT
+err-code | 1.1.2 | MIT
+err-code | 2.0.3 | MIT
+errorhandler | 1.5.1 | MIT
+es-define-property | 1.0.1 | MIT
+es-errors | 1.3.0 | MIT
+es-get-iterator | 1.1.3 | MIT
+es-object-atoms | 1.1.1 | MIT
+escape-html | 1.0.3 | MIT
+escape-string-regexp | 1.0.5 | MIT
+escodegen | 2.1.0 | BSD-2-Clause
+esprima | 1.0.4 | BSD
+esprima | 4.0.1 | BSD-2-Clause
+estraverse | 5.3.0 | BSD-2-Clause
+esutils | 2.0.3 | BSD-2-Clause
+etag | 1.8.1 | MIT
+ethereum-cryptography | 2.2.1 | MIT
+ethers | 6.15.0 | MIT
+event-target-shim | 5.0.1 | MIT
+eventemitter2 | 0.4.14 | MIT
+eventemitter3 | 1.1.1 | MIT
+eventemitter3 | 5.0.1 | MIT
+events | 3.3.0 | MIT
+exit | 0.1.2 | MIT
+expand-brackets | 2.1.4 | MIT
+expand-template | 2.0.3 | (MIT OR WTFPL)
+expand-tilde | 2.0.2 | MIT
+exponential-backoff | 3.1.2 | Apache-2.0
+express | 4.21.2 | MIT
+express-ipfilter | 1.3.2 | MIT
+express-jwt | 0.1.3 | MIT
+express-rate-limit | 7.5.1 | MIT
+express-robots-txt | 0.4.1 | MIT
+express-security.txt | 2.0.0 | ISC
+ext-list | 2.2.2 | MIT
+ext-name | 5.0.0 | MIT
+extend | 3.0.2 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 2.0.1 | MIT
+extend-shallow | 3.0.2 | MIT
+extglob | 2.0.4 | MIT
+fast.js | 0.1.1 | MIT
+fd-slicer | 1.1.0 | MIT
+fdir | 6.5.0 | MIT
+feature-policy | 0.5.0 | MIT
+fecha | 4.2.3 | MIT
+file-js | 0.3.0 | MIT
+file-stream-rotator | 1.0.0 | MIT
+file-type | 11.1.0 | MIT
+file-type | 16.5.4 | MIT
+file-type | 3.9.0 | MIT
+file-type | 4.4.0 | MIT
+file-type | 5.2.0 | MIT
+file-type | 5.2.0 | MIT
+file-type | 6.2.0 | MIT
+file-uri-to-path | 1.0.0 | MIT
+filehound | 1.17.6 | MIT
+filename-reserved-regex | 2.0.0 | MIT
+filenamify | 3.0.0 | MIT
+filesniffer | 1.0.3 | Apache-2.0
+fill-range | 4.0.0 | MIT
+fill-range | 7.1.1 | MIT
+fill-range | 7.1.1 | MIT
+fill-range | 7.1.1 | MIT
+finale-rest | 1.2.2 | MIT
+finalhandler | 1.3.1 | MIT
+find-up | 4.1.0 | MIT
+findup-sync | 2.0.0 | MIT
+findup-sync | 4.0.0 | MIT
+findup-sync | 5.0.0 | MIT
+fined | 1.2.0 | MIT
+flagged-respawn | 1.0.1 | MIT
+fn.name | 1.1.0 | MIT
+fontkit | 1.9.0 | MIT
+for-each | 0.3.5 | MIT
+for-in | 1.0.2 | MIT
+for-own | 1.0.0 | MIT
+foreachasync | 3.0.0 | Apache2
+foreground-child | 3.3.1 | ISC
+formatio | 1.1.1 | BSD-3-Clause
+forwarded | 0.2.0 | MIT
+fragment-cache | 0.2.1 | MIT
+fresh | 0.5.2 | MIT
+from2 | 2.3.0 | MIT
+fs-constants | 1.0.0 | MIT
+fs-extra | 9.1.0 | MIT
+fs-minipass | 1.2.7 | ISC
+fs-minipass | 2.1.0 | ISC
+fs-minipass | 3.0.3 | ISC
+fs.realpath | 1.0.0 | ISC
+fstream | 1.0.12 | ISC
+function-bind | 1.1.2 | MIT
+functions-have-names | 1.2.3 | MIT
+fuzzball | 1.4.0 | GPL-2.0
+gauge | 2.7.4 | ISC
+gauge | 4.0.4 | ISC
+gcc-12-base | 12.2.0-14+deb12u1 | Artistic, GFDL-1.2, GPL, GPL-2, GPL-3, LGPL
+geojson-utils | 1.1.0 | MIT
+get-caller-file | 2.0.5 | ISC
+get-intrinsic | 1.3.0 | MIT
+get-proto | 1.0.1 | MIT
+get-stream | 2.3.1 | MIT
+get-stream | 3.0.0 | MIT
+get-stream | 3.0.0 | MIT
+get-stream | 4.1.0 | MIT
+get-value | 2.0.6 | MIT
+getobject | 1.0.2 | MIT
+github-from-package | 0.0.0 | MIT
+glob | 10.4.5 | ISC
+glob | 7.1.7 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob | 7.2.3 | ISC
+glob-parent | 5.1.2 | ISC
+global-modules | 1.0.0 | MIT
+global-prefix | 1.0.2 | MIT
+gopd | 1.2.0 | MIT
+got | 8.3.2 | MIT
+graceful-fs | 4.2.11 | ISC
+grunt | 1.6.1 | MIT
+grunt-cli | 1.4.3 | MIT
+grunt-contrib-compress | 1.6.0 | MIT
+grunt-known-options | 2.0.0 | MIT
+grunt-legacy-log | 3.0.0 | MIT
+grunt-legacy-log-utils | 2.1.0 | MIT
+grunt-legacy-util | 2.0.1 | MIT
+grunt-replace-json | 0.1.0 | MIT
+handlebars | 4.7.7 | MIT
+has-ansi | 2.0.0 | MIT
+has-bigints | 1.1.0 | MIT
+has-flag | 3.0.0 | MIT
+has-flag | 4.0.0 | MIT
+has-property-descriptors | 1.0.2 | MIT
+has-symbol-support-x | 1.4.2 | MIT
+has-symbols | 1.1.0 | MIT
+has-to-string-tag-x | 1.4.1 | MIT
+has-tostringtag | 1.0.2 | MIT
+has-unicode | 2.0.1 | ISC
+has-value | 0.3.1 | MIT
+has-value | 1.0.0 | MIT
+has-values | 0.1.4 | MIT
+has-values | 1.0.0 | MIT
+hashids | 2.3.0 | MIT
+hasown | 2.0.2 | MIT
+hbs | 4.2.0 | MIT
+he | 0.4.1 | MIT
+heap | 0.2.7 | MIT
+helmet | 4.6.0 | MIT
+hoister | 0.0.2 | MIT
+homedir-polyfill | 1.0.3 | MIT
+hooker | 0.2.3 | MIT
+html-entities | 1.4.0 | MIT
+htmlparser2 | 3.3.0 | MIT
+http-cache-semantics | 3.8.1 | BSD-2-Clause
+http-cache-semantics | 4.2.0 | BSD-2-Clause
+http-cache-semantics | 4.2.0 | BSD-2-Clause
+http-errors | 1.6.3 | MIT
+http-errors | 2.0.0 | MIT
+http-proxy-agent | 4.0.1 | MIT
+http-proxy-agent | 5.0.0 | MIT
+http-proxy-agent | 7.0.2 | MIT
+https-proxy-agent | 5.0.1 | MIT
+https-proxy-agent | 7.0.6 | MIT
+humanize-ms | 1.2.1 | MIT
+i18n | 0.11.1 | MIT
+iconv-lite | 0.4.24 | MIT
+iconv-lite | 0.6.3 | MIT
+iconv-lite | 0.6.3 | MIT
+ieee754 | 1.2.1 | BSD-3-Clause
+ignore-walk | 3.0.4 | ISC
+iltorb | 2.4.5 | MIT
+imurmurhash | 0.1.4 | MIT
+indent-string | 4.0.0 | MIT
+infer-owner | 1.0.4 | ISC
+inflection | 1.13.4 | MIT
+inflight | 1.0.6 | ISC
+inherits | 2.0.3 | ISC
+inherits | 2.0.4 | ISC
+ini | 1.3.8 | ISC
+ini | 1.3.8 | ISC
+internal-slot | 1.1.0 | MIT
+interpret | 1.1.0 | MIT
+into-stream | 3.1.0 | MIT
+invariant | 2.2.4 | MIT
+ip | 2.0.1 | MIT
+ip-address | 10.0.1 | MIT
+ip6 | 0.2.11 | MIT
+ipaddr.js | 1.9.1 | MIT
+is-absolute | 1.0.0 | MIT
+is-accessor-descriptor | 1.0.1 | MIT
+is-arguments | 1.2.0 | MIT
+is-array-buffer | 3.0.5 | MIT
+is-arrayish | 0.3.2 | MIT
+is-bigint | 1.1.0 | MIT
+is-binary-path | 2.1.0 | MIT
+is-boolean-object | 1.2.2 | MIT
+is-buffer | 1.1.6 | MIT
+is-callable | 1.2.7 | MIT
+is-core-module | 2.16.1 | MIT
+is-data-descriptor | 1.0.1 | MIT
+is-date-object | 1.1.0 | MIT
+is-descriptor | 0.1.7 | MIT
+is-descriptor | 0.1.7 | MIT
+is-descriptor | 0.1.7 | MIT
+is-descriptor | 0.1.7 | MIT
+is-descriptor | 0.1.7 | MIT
+is-descriptor | 1.0.3 | MIT
+is-expression | 4.0.0 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 0.1.1 | MIT
+is-extendable | 1.0.1 | MIT
+is-extglob | 2.1.1 | MIT
+is-fullwidth-code-point | 1.0.0 | MIT
+is-fullwidth-code-point | 2.0.0 | MIT
+is-fullwidth-code-point | 3.0.0 | MIT
+is-generator-function | 1.1.0 | MIT
+is-glob | 3.1.0 | MIT
+is-glob | 4.0.3 | MIT
+is-lambda | 1.0.1 | MIT
+is-map | 2.0.3 | MIT
+is-natural-number | 4.0.1 | MIT
+is-number | 3.0.0 | MIT
+is-number | 7.0.0 | MIT
+is-number | 7.0.0 | MIT
+is-number | 7.0.0 | MIT
+is-number-like | 1.0.8 | ISC
+is-number-object | 1.1.1 | MIT
+is-object | 1.0.2 | MIT
+is-plain-obj | 1.1.0 | MIT
+is-plain-object | 2.0.4 | MIT
+is-promise | 2.2.2 | MIT
+is-regex | 1.2.1 | MIT
+is-relative | 1.0.0 | MIT
+is-retry-allowed | 1.2.0 | MIT
+is-set | 2.0.3 | MIT
+is-shared-array-buffer | 1.0.4 | MIT
+is-stream | 1.1.0 | MIT
+is-stream | 2.0.1 | MIT
+is-string | 1.1.1 | MIT
+is-symbol | 1.1.1 | MIT
+is-typed-array | 1.1.15 | MIT
+is-unc-path | 1.0.0 | MIT
+is-weakmap | 2.0.2 | MIT
+is-weakset | 2.0.4 | MIT
+is-windows | 1.0.2 | MIT
+isarray | 0.0.1 | MIT
+isarray | 1.0.0 | MIT
+isarray | 1.0.0 | MIT
+isarray | 2.0.5 | MIT
+isexe | 2.0.0 | ISC
+isexe | 3.1.1 | ISC
+isobject | 2.1.0 | MIT
+isobject | 3.0.1 | MIT
+isomorphic-ws | 5.0.0 | MIT
+isurl | 1.0.0 | MIT
+jackspeak | 3.4.3 | BlueOak-1.0.0
+js-stringify | 1.0.2 | MIT
+js-tokens | 4.0.0 | MIT
+js-yaml | 3.14.1 | MIT
+json-buffer | 3.0.0 | MIT
+json5 | 2.2.3 | MIT
+jsonfile | 6.2.0 | MIT
+jsonwebtoken | 0.1.0 | MIT
+jsonwebtoken | 0.4.0 | MIT
+jssha | 3.3.1 | BSD-3-Clause
+jstransformer | 1.0.0 | MIT
+juice-shop | 19.0.0 | MIT
+juice-shop | 19.0.0 | MIT
+juicy-chat-bot | 0.9.0 | MIT
+jwa | 0.0.1 | MIT
+jws | 0.2.6 | MIT
+keyv | 3.0.0 | MIT
+kind-of | 3.2.2 | MIT
+kind-of | 3.2.2 | MIT
+kind-of | 3.2.2 | MIT
+kind-of | 3.2.2 | MIT
+kind-of | 4.0.0 | MIT
+kind-of | 6.0.3 | MIT
+kuler | 2.0.0 | MIT
+lazystream | 1.0.1 | MIT
+libc6 | 2.36-9+deb12u10 | GPL-2, LGPL-2.1
+libgcc-s1 | 12.2.0-14+deb12u1 | Artistic, GFDL-1.2, GPL, GPL-2, GPL-3, LGPL
+libgomp1 | 12.2.0-14+deb12u1 | Artistic, GFDL-1.2, GPL, GPL-2, GPL-3, LGPL
+libssl3 | 3.0.17-1~deb12u2 | Apache-2.0, Artistic, GPL-1, GPL-1+
+libstdc++6 | 12.2.0-14+deb12u1 | Artistic, GFDL-1.2, GPL, GPL-2, GPL-3, LGPL
+libxmljs2 | 0.37.0 | MIT
+liftup | 3.0.1 | MIT
+linebreak | 1.1.0 | MIT
+listenercount | 1.0.1 | ISC
+ljharb-monorepo-symlink-test | 0.0.0 | MIT
+locate-path | 5.0.0 | MIT
+lodash | 2.4.2 | MIT
+lodash | 4.17.21 | MIT
+lodash.camelcase | 4.3.0 | MIT
+lodash.isfinite | 3.3.2 | MIT
+lodash.set | 4.3.2 | MIT
+logform | 2.7.0 | MIT
+lolex | 1.3.2 | BSD-3-Clause
+loose-envify | 1.4.0 | MIT
+lowercase-keys | 1.0.0 | MIT
+lru-cache | 10.4.3 | ISC
+lru-cache | 10.4.3 | ISC
+lru-cache | 10.4.3 | ISC
+lru-cache | 6.0.0 | ISC
+make-dir | 1.3.0 | MIT
+make-dir | 2.1.0 | MIT
+make-error | 1.3.6 | ISC
+make-fetch-happen | 14.0.3 | ISC
+make-fetch-happen | 9.1.0 | ISC
+make-iterator | 1.0.1 | MIT
+make-plural | 4.3.0 | ISC
+make-plural | 6.2.2 | ISC
+map-cache | 0.2.2 | MIT
+map-visit | 1.0.0 | MIT
+marsdb | 0.6.11 | MIT
+math-interval-parser | 2.0.1 | MIT
+math-intrinsics | 1.1.0 | MIT
+media-typer | 0.3.0 | MIT
+media-types | 10.0.0 | ad-hoc
+median | 0.0.2 | MIT
+merge-descriptors | 1.0.3 | MIT
+messageformat | 2.3.0 | MIT
+messageformat-formatters | 2.0.1 | MIT
+messageformat-parser | 4.1.3 | MIT
+methods | 1.1.2 | MIT
+micromatch | 3.1.10 | MIT
+micromatch | 4.0.8 | MIT
+micromatch | 4.0.8 | MIT
+mime | 1.6.0 | MIT
+mime-db | 1.52.0 | MIT
+mime-types | 2.1.35 | MIT
+mimic-response | 1.0.1 | MIT
+mimic-response | 2.1.0 | MIT
+mimic-response | 3.1.0 | MIT
+mimic-response | 3.1.0 | MIT
+minami | 1.1.1 | Apache-2.0
+minami | 1.1.1 | Apache-2.0
+minami | 1.1.1 | Apache-2.0
+minimatch | 3.0.5 | ISC
+minimatch | 3.0.8 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 3.1.2 | ISC
+minimatch | 5.1.6 | ISC
+minimatch | 9.0.5 | ISC
+minimist | 0.2.4 | MIT
+minimist | 1.2.8 | MIT
+minipass | 2.9.0 | ISC
+minipass | 3.3.6 | ISC
+minipass | 3.3.6 | ISC
+minipass | 3.3.6 | ISC
+minipass | 3.3.6 | ISC
+minipass | 5.0.0 | ISC
+minipass | 7.1.2 | ISC
+minipass-collect | 1.0.2 | ISC
+minipass-collect | 2.0.1 | ISC
+minipass-fetch | 1.4.1 | MIT
+minipass-fetch | 4.0.1 | MIT
+minipass-flush | 1.0.5 | ISC
+minipass-pipeline | 1.2.4 | ISC
+minipass-sized | 1.0.3 | ISC
+minizlib | 1.3.3 | MIT
+minizlib | 2.1.2 | MIT
+minizlib | 3.0.2 | MIT
+mixin-deep | 1.3.2 | MIT
+mkdirp | 0.5.6 | MIT
+mkdirp | 0.5.6 | MIT
+mkdirp | 0.5.6 | MIT
+mkdirp | 1.0.4 | MIT
+mkdirp | 3.0.1 | MIT
+mkdirp | 3.0.1 | MIT
+mkdirp-classic | 0.5.3 | MIT
+moment | 2.0.0 | MIT
+moment | 2.30.1 | MIT
+moment-timezone | 0.5.48 | MIT
+morgan | 1.10.1 | MIT
+mout | 1.2.4 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.0.0 | MIT
+ms | 2.1.3 | MIT
+multer | 1.4.5-lts.2 | MIT
+mustache | 4.2.0 | MIT
+mylib | 0.0.0 | ISC
+nan | 2.22.2 | MIT
+nanomatch | 1.2.13 | MIT
+napi-build-utils | 1.0.2 | MIT
+napi-build-utils | 2.0.0 | MIT
+napi-build-utils | 2.0.0 | MIT
+needle | 2.9.1 | MIT
+negotiator | 0.6.3 | MIT
+negotiator | 0.6.4 | MIT
+negotiator | 1.0.0 | MIT
+neo-async | 2.6.2 | MIT
+netbase | 6.4 | GPL-2
+node-abi | 2.30.1 | MIT
+node-abi | 3.77.0 | MIT
+node-abi | 3.77.0 | MIT
+node-addon-api | 7.1.1 | MIT
+node-fetch | 2.7.0 | MIT
+node-gyp | 11.4.2 | MIT
+node-gyp | 8.4.1 | MIT
+node-pre-gyp | 0.15.0 | BSD-3-Clause
+noop-logger | 0.1.1 | MIT
+nopt | 3.0.6 | ISC
+nopt | 4.0.3 | ISC
+nopt | 4.0.3 | ISC
+nopt | 5.0.0 | ISC
+nopt | 8.1.0 | ISC
+normalize-path | 2.1.1 | MIT
+normalize-path | 3.0.0 | MIT
+normalize-path | 3.0.0 | MIT
+normalize-url | 2.0.1 | MIT
+notevil | 1.3.3 | MIT
+npm-bundled | 1.1.2 | ISC
+npm-normalize-package-bin | 1.0.1 | ISC
+npm-packlist | 1.4.8 | ISC
+npmlog | 4.1.2 | ISC
+npmlog | 6.0.2 | ISC
+number-is-nan | 1.0.1 | MIT
+object-assign | 4.1.1 | MIT
+object-copy | 0.1.0 | MIT
+object-inspect | 1.13.4 | MIT
+object-is | 1.1.6 | MIT
+object-keys | 1.1.1 | MIT
+object-visit | 1.0.1 | MIT
+object.assign | 4.1.7 | MIT
+object.defaults | 1.1.0 | MIT
+object.map | 1.0.1 | MIT
+object.pick | 1.3.0 | MIT
+on-finished | 2.3.0 | MIT
+on-finished | 2.4.1 | MIT
+on-headers | 1.1.0 | MIT
+once | 1.4.0 | ISC
+one-time | 1.0.0 | MIT
+opentype.js | 0.7.3 | MIT
+os-homedir | 1.0.2 | MIT
+os-tmpdir | 1.0.2 | MIT
+osenv | 0.1.5 | ISC
+otplib | 12.0.1 | MIT
+p-cancelable | 0.4.1 | MIT
+p-event | 2.3.1 | MIT
+p-finally | 1.0.0 | MIT
+p-is-promise | 1.1.0 | MIT
+p-limit | 2.3.0 | MIT
+p-locate | 4.1.0 | MIT
+p-map | 4.0.0 | MIT
+p-map | 7.0.3 | MIT
+p-timeout | 2.0.1 | MIT
+p-try | 2.2.0 | MIT
+package-json-from-dist | 1.0.1 | BlueOak-1.0.0
+pako | 0.2.9 | MIT
+parse-filepath | 1.0.2 | MIT
+parse-passwd | 1.0.0 | MIT
+parseurl | 1.3.3 | MIT
+pascalcase | 0.1.1 | MIT
+path-exists | 4.0.0 | MIT
+path-is-absolute | 1.0.1 | MIT
+path-key | 3.1.1 | MIT
+path-parse | 1.0.7 | MIT
+path-root | 0.1.1 | MIT
+path-root-regex | 0.1.2 | MIT
+path-scurry | 1.11.1 | BlueOak-1.0.0
+path-to-regexp | 0.1.12 | MIT
+pdfkit | 0.11.0 | MIT
+peek-readable | 4.1.0 | MIT
+pend | 1.2.0 | MIT
+pg-connection-string | 2.9.1 | MIT
+picomatch | 2.3.1 | MIT
+picomatch | 4.0.3 | MIT
+pify | 2.3.0 | MIT
+pify | 2.3.0 | MIT
+pify | 3.0.0 | MIT
+pify | 3.0.0 | MIT
+pify | 4.0.1 | MIT
+pinkie | 2.0.4 | MIT
+pinkie-promise | 2.0.1 | MIT
+png-js | 1.0.0 | MIT
+posix-character-classes | 0.1.1 | MIT
+possible-typed-array-names | 1.1.0 | MIT
+prebuild-install | 5.3.6 | MIT
+prebuild-install | 7.1.3 | MIT
+prebuild-install | 7.1.3 | MIT
+prepend-http | 2.0.0 | MIT
+pretty-bytes | 4.0.2 | MIT
+proc-log | 5.0.0 | ISC
+process | 0.11.10 | MIT
+process-nextick-args | 2.0.1 | MIT
+prom-client | 14.2.0 | Apache-2.0
+promise | 7.3.1 | MIT
+promise-inflight | 1.0.1 | ISC
+promise-retry | 2.0.1 | MIT
+proper-lockfile | 1.2.0 | MIT
+proxy-addr | 2.0.7 | MIT
+pug | 3.0.3 | MIT
+pug-attrs | 3.0.0 | MIT
+pug-code-gen | 3.0.3 | MIT
+pug-error | 2.1.0 | MIT
+pug-filters | 4.0.0 | MIT
+pug-lexer | 5.0.1 | MIT
+pug-linker | 4.0.0 | MIT
+pug-load | 3.0.0 | MIT
+pug-parser | 6.0.0 | MIT
+pug-runtime | 3.0.1 | MIT
+pug-strip-comments | 2.0.0 | MIT
+pug-walk | 2.0.0 | MIT
+pump | 3.0.3 | MIT
+qs | 6.13.0 | BSD-3-Clause
+query-string | 5.1.1 | MIT
+range-parser | 1.2.1 | MIT
+range_check | 2.0.4 | BSD-2-Clause
+raw-body | 2.5.2 | MIT
+rc | 1.2.8 | (BSD-2-Clause OR MIT OR Apache-2.0)
+readable-stream | 1.0.34 | MIT
+readable-stream | 2.3.8 | MIT
+readable-stream | 3.6.2 | MIT
+readable-stream | 3.6.2 | MIT
+readable-stream | 3.6.2 | MIT
+readable-stream | 3.6.2 | MIT
+readable-stream | 4.7.0 | MIT
+readable-web-to-node-stream | 3.0.4 | MIT
+readdirp | 3.5.0 | MIT
+rechoir | 0.7.1 | MIT
+regex-not | 1.0.2 | MIT
+regexp.prototype.flags | 1.5.4 | MIT
+remove-trailing-separator | 1.1.0 | ISC
+repeat-element | 1.1.4 | MIT
+repeat-string | 1.6.1 | MIT
+replace | 1.2.2 | MIT
+require-directory | 2.1.1 | MIT
+require-main-filename | 2.0.0 | ISC
+resolve | 1.22.10 | MIT
+resolve-dir | 1.0.1 | MIT
+resolve-url | 0.2.1 | MIT
+responselike | 1.0.2 | MIT
+restructure | 2.0.1 | MIT
+ret | 0.1.15 | MIT
+retry | 0.10.1 | MIT
+retry | 0.12.0 | MIT
+retry-as-promised | 7.1.1 | MIT
+rimraf | 2.7.1 | ISC
+rimraf | 2.7.1 | ISC
+rimraf | 2.7.1 | ISC
+rimraf | 3.0.2 | ISC
+safe-buffer | 5.1.2 | MIT
+safe-buffer | 5.1.2 | MIT
+safe-buffer | 5.1.2 | MIT
+safe-buffer | 5.2.1 | MIT
+safe-regex | 1.1.0 | MIT
+safe-regex-test | 1.1.0 | MIT
+safe-stable-stringify | 2.5.0 | MIT
+safer-buffer | 2.1.2 | MIT
+samsam | 1.1.2 | BSD-3-Clause
+sanitize-filename | 1.6.3 | WTFPL OR ISC
+sanitize-html | 1.4.2 | MIT
+sax | 1.4.1 | ISC
+seek-bzip | 1.0.6 | MIT
+semver | 5.7.2 | ISC
+semver | 5.7.2 | ISC
+semver | 5.7.2 | ISC
+semver | 5.7.2 | ISC
+semver | 7.7.2 | ISC
+send | 0.19.0 | MIT
+sequelize | 6.37.7 | MIT
+sequelize-pool | 7.1.0 | MIT
+serve-index | 1.9.1 | MIT
+serve-static | 1.16.2 | MIT
+set-blocking | 2.0.0 | ISC
+set-function-length | 1.2.2 | MIT
+set-function-name | 2.0.2 | MIT
+set-value | 2.0.1 | MIT
+setimmediate | 1.0.5 | MIT
+setprototypeof | 1.1.0 | ISC
+setprototypeof | 1.2.0 | ISC
+shebang-command | 2.0.0 | MIT
+shebang-regex | 3.0.0 | MIT
+side-channel | 1.1.0 | MIT
+side-channel-list | 1.0.0 | MIT
+side-channel-map | 1.0.1 | MIT
+side-channel-weakmap | 1.0.2 | MIT
+signal-exit | 3.0.7 | ISC
+signal-exit | 4.1.0 | ISC
+simple-concat | 1.0.1 | MIT
+simple-get | 3.1.1 | MIT
+simple-get | 4.0.1 | MIT
+simple-get | 4.0.1 | MIT
+simple-swizzle | 0.2.2 | MIT
+sinon | 1.17.7 | BSD-3-Clause
+smart-buffer | 4.2.0 | MIT
+snapdragon | 0.8.2 | MIT
+snapdragon-node | 2.1.1 | MIT
+snapdragon-util | 3.0.1 | MIT
+socket.io | 3.1.2 | MIT
+socket.io-adapter | 2.1.0 | MIT
+socket.io-parser | 4.0.5 | MIT
+socks | 2.8.7 | MIT
+socks-proxy-agent | 6.2.1 | MIT
+socks-proxy-agent | 8.0.5 | MIT
+sort-keys | 1.1.2 | MIT
+sort-keys | 2.0.0 | MIT
+sort-keys-length | 1.0.1 | MIT
+source-map | 0.5.7 | BSD-3-Clause
+source-map | 0.6.1 | BSD-3-Clause
+source-map-resolve | 0.5.3 | MIT
+source-map-support | 0.5.21 | MIT
+source-map-url | 0.4.1 | MIT
+split-string | 3.1.0 | MIT
+sprintf-js | 1.0.3 | BSD-3-Clause
+sprintf-js | 1.1.3 | BSD-3-Clause
+sqlite3 | 5.1.7 | BSD-3-Clause
+ssri | 12.0.0 | ISC
+ssri | 8.0.1 | ISC
+stack-trace | 0.0.10 | MIT
+static-extend | 0.1.2 | MIT
+statuses | 1.5.0 | MIT
+statuses | 2.0.1 | MIT
+stop-iteration-iterator | 1.1.0 | MIT
+stream-buffers | 2.2.0 | Unlicense
+streamsearch | 1.1.0 | MIT
+strict-uri-encode | 1.1.0 | MIT
+string-width | 1.0.2 | MIT
+string-width | 2.1.1 | MIT
+string-width | 4.2.3 | MIT
+string-width | 4.2.3 | MIT
+string-width | 5.1.2 | MIT
+string-width | 5.1.2 | MIT
+string.fromcodepoint | 0.2.1 | MIT
+string.prototype.codepointat | 0.2.1 | MIT
+string_decoder | 0.10.31 | MIT
+string_decoder | 1.1.1 | MIT
+string_decoder | 1.3.0 | MIT
+strip-ansi | 3.0.1 | MIT
+strip-ansi | 3.0.1 | MIT
+strip-ansi | 4.0.0 | MIT
+strip-ansi | 6.0.1 | MIT
+strip-ansi | 6.0.1 | MIT
+strip-ansi | 7.1.0 | MIT
+strip-ansi | 7.1.0 | MIT
+strip-bom | 3.0.0 | MIT
+strip-dirs | 2.1.0 | MIT
+strip-json-comments | 2.0.1 | MIT
+strip-json-comments | 2.0.1 | MIT
+strip-outer | 1.0.1 | MIT
+strtok3 | 6.3.0 | MIT
+supports-color | 2.0.0 | MIT
+supports-color | 5.5.0 | MIT
+supports-color | 7.2.0 | MIT
+supports-preserve-symlinks-flag | 1.0.0 | MIT
+svg-captcha | 1.4.0 | MIT
+swagger-ui-dist | 5.28.1 | Apache-2.0
+swagger-ui-express | 5.0.1 | MIT
+tar | 4.4.19 | ISC
+tar | 6.2.1 | ISC
+tar | 7.4.3 | ISC
+tar-fs | 2.1.3 | MIT
+tar-stream | 1.6.2 | MIT
+tar-stream | 2.2.0 | MIT
+tdigest | 0.1.2 | MIT
+text-hex | 1.0.0 | MIT
+thirty-two | 1.0.2 | MIT
+through | 2.3.8 | MIT
+timed-out | 4.0.1 | MIT
+tiny-inflate | 1.0.3 | MIT
+tinyglobby | 0.2.14 | MIT
+to-buffer | 1.2.1 | MIT
+to-object-path | 0.3.0 | MIT
+to-regex | 3.0.2 | MIT
+to-regex-range | 2.1.1 | MIT
+to-regex-range | 5.0.1 | MIT
+to-regex-range | 5.0.1 | MIT
+to-regex-range | 5.0.1 | MIT
+toidentifier | 1.0.1 | MIT
+token-stream | 1.0.0 | MIT
+token-types | 4.2.1 | MIT
+tr46 | 0.0.3 | MIT
+traverse | 0.3.9 | MIT/X11
+tree-kill | 1.2.2 | MIT
+trim-repeated | 1.0.0 | MIT
+triple-beam | 1.4.1 | MIT
+truncate-utf8-bytes | 1.0.2 | WTFPL
+ts-node | 9.1.1 | MIT
+ts-node-dev | 1.1.8 | MIT
+tsconfig | 7.0.0 | MIT
+tslib | 2.7.0 | 0BSD
+tunnel-agent | 0.6.0 | Apache-2.0
+type-is | 1.6.18 | MIT
+typecast | 0.0.1 | MIT
+typed-array-buffer | 1.0.3 | MIT
+typedarray | 0.0.6 | MIT
+typescript | 5.3.3 | Apache-2.0
+tzdata | 2025b-0+deb12u1 | public-domain
+uglify-js | 3.19.3 | BSD-2-Clause
+unbzip2-stream | 1.4.3 | MIT
+unc-path-regex | 0.1.2 | MIT
+underscore.string | 3.3.6 | MIT
+undici-types | 6.19.8 | MIT
+undici-types | 6.21.0 | MIT
+unicode-properties | 1.4.1 | MIT
+unicode-trie | 2.0.0 | MIT
+union-value | 1.0.1 | MIT
+unique-filename | 1.1.1 | ISC
+unique-filename | 4.0.0 | ISC
+unique-slug | 2.0.2 | ISC
+unique-slug | 5.0.0 | ISC
+unit-compare | 1.0.1 | ISC
+universalify | 2.0.1 | MIT
+unpipe | 1.0.0 | MIT
+unset-value | 1.0.0 | MIT
+untildify | 2.1.0 | MIT
+unzipper | 0.9.15 | MIT
+urix | 0.1.0 | MIT
+url-parse-lax | 3.0.0 | MIT
+url-to-options | 1.0.1 | MIT
+use | 3.1.1 | MIT
+utf8-byte-length | 1.0.5 | (WTFPL OR MIT)
+util | 0.12.5 | MIT
+util-deprecate | 1.0.2 | MIT
+utils-merge | 1.0.1 | MIT
+uuid | 8.3.2 | MIT
+v8flags | 3.2.0 | MIT
+validate | 4.5.1 | MIT
+validator | 13.15.15 | MIT
+vary | 1.1.2 | MIT
+vm2 | 3.9.17 | MIT
+void-elements | 3.1.0 | MIT
+walk | 2.3.15 | (MIT OR Apache-2.0)
+walkdir | 0.0.11 | MIT
+web3 | 4.16.0 | LGPL-3.0
+web3-core | 4.7.1 | LGPL-3.0
+web3-errors | 1.3.1 | LGPL-3.0
+web3-eth | 4.11.1 | LGPL-3.0
+web3-eth-abi | 4.4.1 | LGPL-3.0
+web3-eth-accounts | 4.3.1 | LGPL-3.0
+web3-eth-contract | 4.7.2 | LGPL-3.0
+web3-eth-ens | 4.4.0 | LGPL-3.0
+web3-eth-iban | 4.0.7 | LGPL-3.0
+web3-eth-personal | 4.1.0 | LGPL-3.0
+web3-net | 4.1.0 | LGPL-3.0
+web3-providers-http | 4.2.0 | LGPL-3.0
+web3-providers-ipc | 4.0.7 | LGPL-3.0
+web3-providers-ws | 4.0.8 | LGPL-3.0
+web3-rpc-methods | 1.3.0 | LGPL-3.0
+web3-rpc-providers | 1.0.0-rc.4 | LGPL-3.0
+web3-types | 1.10.0 | LGPL-3.0
+web3-utils | 4.3.3 | LGPL-3.0
+web3-validator | 2.0.6 | LGPL-3.0
+webidl-conversions | 3.0.1 | BSD-2-Clause
+whatwg-url | 5.0.0 | MIT
+which | 1.3.1 | ISC
+which | 2.0.2 | ISC
+which | 5.0.0 | ISC
+which-boxed-primitive | 1.1.1 | MIT
+which-collection | 1.0.2 | MIT
+which-module | 2.0.1 | ISC
+which-pm-runs | 1.1.0 | MIT
+which-typed-array | 1.1.19 | MIT
+wide-align | 1.1.3 | ISC
+wide-align | 1.1.5 | ISC
+winston | 3.17.0 | MIT
+winston-transport | 4.9.0 | MIT
+with | 7.0.2 | MIT
+wkx | 0.5.0 | MIT
+wordwrap | 0.0.3 | MIT
+wordwrap | 1.0.0 | MIT
+wrap-ansi | 6.2.0 | MIT
+wrap-ansi | 7.0.0 | MIT
+wrap-ansi | 8.1.0 | MIT
+wrappy | 1.0.2 | ISC
+ws | 7.4.6 | MIT
+ws | 8.17.1 | MIT
+xtend | 4.0.2 | MIT
+y18n | 4.0.3 | ISC
+yallist | 3.1.1 | ISC
+yallist | 4.0.0 | ISC
+yallist | 4.0.0 | ISC
+yallist | 4.0.0 | ISC
+yallist | 4.0.0 | ISC
+yallist | 5.0.0 | BlueOak-1.0.0
+yaml-schema-validator | 1.2.3 | MIT
+yargs | 15.4.1 | MIT
+yargs-parser | 18.1.3 | ISC
+yauzl | 2.10.0 | MIT
+yn | 3.1.1 | MIT
+z85 | 0.0.2 | MIT
+zip-stream | 1.2.0 | MIT
+zod | 3.25.76 | MIT
diff --git a/labs/lab4/syft/juice-shop-syft-native.json b/labs/lab4/syft/juice-shop-syft-native.json
new file mode 100644
index 00000000..b0639bdd
--- /dev/null
+++ b/labs/lab4/syft/juice-shop-syft-native.json
@@ -0,0 +1 @@
+{"artifacts":[{"id":"3cea2309a653e6ed","name":"1to2","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/nan/tools/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/nan/tools/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/nan/tools/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/nan/tools/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:nodejs:1to2:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:1to2:1to2:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/1to2@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"1to2","version":"1.0.0","author":"Benjamin Byholm (https://github.com/kkoopa/), Mathias Küsel (https://github.com/mathiask88/)","homepage":"","description":"NAN 1 -> 2 Migration Script","url":"git://github.com/nodejs/nan.git","private":false}},{"id":"08449108469244be","name":"@adraffy/ens-normalize","version":"1.10.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@adraffy/ens-normalize/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@adraffy\\/ens-normalize:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens-normalize:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens_normalize:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens_normalize:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@adraffy\\/ens:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:adraffy:\\@adraffy\\/ens-normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:adraffy:\\@adraffy\\/ens_normalize:1.10.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40adraffy/ens-normalize@1.10.1","metadataType":"javascript-npm-package","metadata":{"name":"@adraffy/ens-normalize","version":"1.10.1","author":"raffy.eth (http://raffy.antistupid.com)","homepage":"https://github.com/adraffy/ens-normalize.js#readme","description":"Ethereum Name Service (ENS) Name Normalizer","url":"git+https://github.com/adraffy/ens-normalize.js.git","private":false}},{"id":"27b0de0facbfc672","name":"@babel/helper-string-parser","version":"7.27.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-string-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/helper-string-parser:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-string-parser:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string_parser:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string_parser:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-string:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-string:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_string:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper-string-parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper_string_parser:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/helper-string-parser@7.27.1","metadataType":"javascript-npm-package","metadata":{"name":"@babel/helper-string-parser","version":"7.27.1","author":"The Babel Team (https://babel.dev/team)","homepage":"https://babel.dev/docs/en/next/babel-helper-string-parser","description":"A utility package to parse strings","url":"https://github.com/babel/babel.git","private":false}},{"id":"d07675d36f7c1136","name":"@babel/helper-validator-identifier","version":"7.27.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/helper-validator-identifier/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator-identifier:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator-identifier:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator_identifier:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator_identifier:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper-validator:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper_validator:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@babel\\/helper:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper-validator-identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/helper_validator_identifier:7.27.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/helper-validator-identifier@7.27.1","metadataType":"javascript-npm-package","metadata":{"name":"@babel/helper-validator-identifier","version":"7.27.1","author":"The Babel Team (https://babel.dev/team)","homepage":"","description":"Validate identifier/keywords name","url":"https://github.com/babel/babel.git","private":false}},{"id":"489d0f5c79137732","name":"@babel/parser","version":"7.28.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/parser:\\@babel\\/parser:7.28.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/parser:7.28.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/parser@7.28.3","metadataType":"javascript-npm-package","metadata":{"name":"@babel/parser","version":"7.28.3","author":"The Babel Team (https://babel.dev/team)","homepage":"https://babel.dev/docs/en/next/babel-parser","description":"A JavaScript parser","url":"https://github.com/babel/babel.git","private":false}},{"id":"045074f58c58eebb","name":"@babel/types","version":"7.28.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@babel/types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/types/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@babel/types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@babel/types/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@babel\\/types:\\@babel\\/types:7.28.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:\\@babel\\/types:7.28.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40babel/types@7.28.2","metadataType":"javascript-npm-package","metadata":{"name":"@babel/types","version":"7.28.2","author":"The Babel Team (https://babel.dev/team)","homepage":"https://babel.dev/docs/en/next/babel-types","description":"Babel Types is a Lodash-esque utility library for AST nodes","url":"https://github.com/babel/babel.git","private":false}},{"id":"2aaa7cc50004f91b","name":"@colors/colors","version":"1.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/logform/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@colors\\/colors:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DABH:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40colors/colors@1.6.0","metadataType":"javascript-npm-package","metadata":{"name":"@colors/colors","version":"1.6.0","author":"DABH, DABH (https://github.com/DABH)","homepage":"https://github.com/DABH/colors.js","description":"get colors in your node.js console","url":"http://github.com/DABH/colors.js.git","private":false}},{"id":"3b8ecc6044fe8e57","name":"@colors/colors","version":"1.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/winston/node_modules/@colors/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@colors\\/colors:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DABH:\\@colors\\/colors:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40colors/colors@1.6.0","metadataType":"javascript-npm-package","metadata":{"name":"@colors/colors","version":"1.6.0","author":"DABH, DABH (https://github.com/DABH)","homepage":"https://github.com/DABH/colors.js","description":"get colors in your node.js console","url":"http://github.com/DABH/colors.js.git","private":false}},{"id":"22bb15b4ca9d4d3f","name":"@dabh/diagnostics","version":"2.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@dabh/diagnostics/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@dabh/diagnostics/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@dabh/diagnostics/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@dabh/diagnostics/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@dabh\\/diagnostics:\\@dabh\\/diagnostics:2.0.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:3rd-Eden:\\@dabh\\/diagnostics:2.0.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40dabh/diagnostics@2.0.3","metadataType":"javascript-npm-package","metadata":{"name":"@dabh/diagnostics","version":"2.0.3","author":"Arnout Kazemier, Martijn Swaagman (https://github.com/swaagie), Jarrett Cruger (https://github.com/jcrugzz), Sevastos (https://github.com/sevastos)","homepage":"https://github.com/3rd-Eden/diagnostics","description":"Tools for debugging your node.js modules and event loop","url":"git://github.com/3rd-Eden/diagnostics.git","private":false}},{"id":"2b283938a1553b38","name":"@ethereumjs/rlp","version":"4.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MPL-2.0","spdxExpression":"MPL-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@ethereumjs\\/rlp:\\@ethereumjs\\/rlp:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ethereumjs:\\@ethereumjs\\/rlp:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40ethereumjs/rlp@4.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@ethereumjs/rlp","version":"4.0.1","author":"martin becze , Alex Beregszaszi , Holger Drewes , Paul Miller ","homepage":"https://github.com/ethereumjs/ethereumjs-monorepo/tree/master/packages/rlp#readme","description":"Recursive Length Prefix Encoding Module","url":"https://github.com/ethereumjs/ethereumjs-monorepo.git","private":false}},{"id":"e264462c29df43ed","name":"@ethereumjs/rlp","version":"5.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MPL-2.0","spdxExpression":"MPL-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/web3-eth-contract/node_modules/@ethereumjs/rlp/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@ethereumjs\\/rlp:\\@ethereumjs\\/rlp:5.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ethereumjs:\\@ethereumjs\\/rlp:5.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40ethereumjs/rlp@5.0.2","metadataType":"javascript-npm-package","metadata":{"name":"@ethereumjs/rlp","version":"5.0.2","author":"martin becze , Alex Beregszaszi , Holger Drewes , Paul Miller ","homepage":"https://github.com/ethereumjs/ethereumjs-monorepo/tree/master/packages/rlp#readme","description":"Recursive Length Prefix Encoding Module","url":"https://github.com/ethereumjs/ethereumjs-monorepo.git","private":false}},{"id":"8e41d6aa1fe261a3","name":"@gar/promisify","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@gar/promisify/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@gar/promisify/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@gar/promisify/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@gar/promisify/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@gar\\/promisify:\\@gar\\/promisify:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:wraithgar:\\@gar\\/promisify:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40gar/promisify@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"@gar/promisify","version":"1.1.3","author":"Gar ","homepage":"","description":"Promisify an entire class or object","url":"https://github.com/wraithgar/gar-promisify.git","private":false}},{"id":"1b734807f495fb6f","name":"@isaacs/cliui","version":"8.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@isaacs\\/cliui:\\@isaacs\\/cliui:8.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40isaacs/cliui@8.0.2","metadataType":"javascript-npm-package","metadata":{"name":"@isaacs/cliui","version":"8.0.2","author":"Ben Coe ","homepage":"","description":"easily create complex multi-column command-line-interfaces","url":"yargs/cliui","private":false}},{"id":"0ab257647e45f4d4","name":"@isaacs/fs-minipass","version":"4.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/fs-minipass/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@isaacs\\/fs-minipass:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs-minipass:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs_minipass:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs_minipass:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@isaacs\\/fs:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:\\@isaacs\\/fs-minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:\\@isaacs\\/fs_minipass:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40isaacs/fs-minipass@4.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@isaacs/fs-minipass","version":"4.0.1","author":"Isaac Z. Schlueter","homepage":"","description":"fs read and write streams based on minipass","url":"https://github.com/npm/fs-minipass.git","private":false}},{"id":"e38f30a540597121","name":"@my-scope/package-a","version":"0.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-a/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@my-scope\\/package-a:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package-a:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_a:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_a:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my-scope\\/package-a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my_scope\\/package_a:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40my-scope/package-a@0.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@my-scope/package-a","version":"0.0.0","author":"","homepage":"","description":"","url":"","private":true}},{"id":"7c30bf5441790ef5","name":"@my-scope/package-b","version":"0.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/multirepo/packages/package-b/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@my-scope\\/package-b:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package-b:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_b:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package_b:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my-scope\\/package:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my_scope\\/package:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my-scope\\/package-b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@my:\\@my_scope\\/package_b:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40my-scope/package-b@0.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@my-scope/package-b","version":"0.0.0","author":"","homepage":"","description":"","url":"","private":true}},{"id":"49cbc756c02b244b","name":"@nlpjs/core","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/core:\\@nlpjs\\/core:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/core@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/core","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"52af61e4284d993b","name":"@nlpjs/core-loader","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/core-loader/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/core-loader:\\@nlpjs\\/core-loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core-loader:\\@nlpjs\\/core_loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core_loader:\\@nlpjs\\/core-loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core_loader:\\@nlpjs\\/core_loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core:\\@nlpjs\\/core-loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/core:\\@nlpjs\\/core_loader:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/core-loader@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/core-loader","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"19329a82b3c04a97","name":"@nlpjs/evaluator","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/evaluator/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/evaluator:\\@nlpjs\\/evaluator:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/evaluator@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/evaluator","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Evaluator","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"3b35c82860541774","name":"@nlpjs/lang-en","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang-en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang_en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang-en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang_en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang-en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang_en:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/lang-en@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/lang-en","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"f478f743a248aca5","name":"@nlpjs/lang-en-min","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/lang-en-min/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en-min:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en-min:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en_min:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en_min:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang-en:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang_en:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang-en-min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/lang:\\@nlpjs\\/lang_en_min:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/lang-en-min@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/lang-en-min","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Core","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"ca1d4c9cc3d649fe","name":"@nlpjs/language","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/language/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/language/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/language:\\@nlpjs\\/language:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/language@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/language","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Language guesser","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"49713e5e64515107","name":"@nlpjs/language-min","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/language-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language-min/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/language-min/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/language-min/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/language-min:\\@nlpjs\\/language-min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language-min:\\@nlpjs\\/language_min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language_min:\\@nlpjs\\/language-min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language_min:\\@nlpjs\\/language_min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language:\\@nlpjs\\/language-min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@nlpjs\\/language:\\@nlpjs\\/language_min:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/language-min@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/language-min","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Language guesser","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"3bf94ec08da3b281","name":"@nlpjs/ner","version":"4.27.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/ner/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/ner/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/ner/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/ner/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/ner:\\@nlpjs\\/ner:4.27.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/ner@4.27.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/ner","version":"4.27.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Named Entity Recognition","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"d2908794d58fc9bc","name":"@nlpjs/neural","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/neural/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/neural/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/neural/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/neural/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/neural:\\@nlpjs\\/neural:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/neural@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/neural","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Neural Network","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"d41f6d4e68e9c43d","name":"@nlpjs/nlg","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlg/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlg/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/nlg:\\@nlpjs\\/nlg:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/nlg@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/nlg","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Natural Language Generation","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"f85c5456d515aafd","name":"@nlpjs/nlp","version":"4.27.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlp/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlp/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlp/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/nlp:\\@nlpjs\\/nlp:4.27.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/nlp@4.27.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/nlp","version":"4.27.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Natural Language Processing","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"c449b8b8cc6afd27","name":"@nlpjs/nlu","version":"4.27.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlu/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlu/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/nlu/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/nlu/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/nlu:\\@nlpjs\\/nlu:4.27.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/nlu@4.27.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/nlu","version":"4.27.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Natural Language Understanding","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"8d993f0ba3c63bb7","name":"@nlpjs/request","version":"4.25.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/request/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/request/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/request:\\@nlpjs\\/request:4.25.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/request@4.25.0","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/request","version":"4.25.0","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Request","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"1b3eb8c3cb77af23","name":"@nlpjs/sentiment","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/sentiment/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/sentiment:\\@nlpjs\\/sentiment:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/sentiment@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/sentiment","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Sentiment Analysis","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"203a7b556fc354dd","name":"@nlpjs/similarity","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/similarity/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/similarity/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/similarity/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/similarity/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/similarity:\\@nlpjs\\/similarity:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/similarity@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/similarity","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Similarity","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"6b6febefa6106c5d","name":"@nlpjs/slot","version":"4.26.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@nlpjs/slot/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/slot/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@nlpjs/slot/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@nlpjs/slot/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@nlpjs\\/slot:\\@nlpjs\\/slot:4.26.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40nlpjs/slot@4.26.1","metadataType":"javascript-npm-package","metadata":{"name":"@nlpjs/slot","version":"4.26.1","author":"Jesus Seijas , Jesus Seijas ","homepage":"","description":"Slot filling manager","url":"git+https://github.com/axa-group/nlp.js.git","private":false}},{"id":"2a40db3b54912cbf","name":"@noble/curves","version":"1.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/curves:\\@noble\\/curves:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:paulmillr:\\@noble\\/curves:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/curves@1.2.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/curves","version":"1.2.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal JS implementation of elliptic curve cryptography","url":"https://github.com/paulmillr/noble-curves.git","private":false}},{"id":"a86e0237429a5827","name":"@noble/curves","version":"1.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/curves:\\@noble\\/curves:1.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/curves@1.4.2","metadataType":"javascript-npm-package","metadata":{"name":"@noble/curves","version":"1.4.2","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal JS implementation of elliptic curve cryptography","url":"git+https://github.com/paulmillr/noble-curves.git","private":false}},{"id":"306de5e5675f2410","name":"@noble/curves","version":"1.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/curves/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/curves:\\@noble\\/curves:1.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/curves@1.4.2","metadataType":"javascript-npm-package","metadata":{"name":"@noble/curves","version":"1.4.2","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal JS implementation of elliptic curve cryptography","url":"git+https://github.com/paulmillr/noble-curves.git","private":false}},{"id":"46670510cb133f58","name":"@noble/hashes","version":"1.3.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:paulmillr:\\@noble\\/hashes:1.3.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.3.2","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.3.2","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA2, SHA3, RIPEMD, BLAKE2/3, HMAC, HKDF, PBKDF2, Scrypt","url":"https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"749573321ee941d7","name":"@noble/hashes","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.4.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF & Scrypt","url":"git+https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"a3139241ec1643e6","name":"@noble/hashes","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.4.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF & Scrypt","url":"git+https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"c2a39289ece0eefe","name":"@noble/hashes","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethereum-cryptography/node_modules/@noble/hashes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@noble\\/hashes:\\@noble\\/hashes:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40noble/hashes@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@noble/hashes","version":"1.4.0","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/","description":"Audited & minimal 0-dependency JS implementation of SHA, RIPEMD, BLAKE, HMAC, HKDF, PBKDF & Scrypt","url":"git+https://github.com/paulmillr/noble-hashes.git","private":false}},{"id":"114921a3f2bc9d12","name":"@npmcli/agent","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/agent:\\@npmcli\\/agent:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:\\@npmcli\\/agent:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/agent@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/agent","version":"3.0.0","author":"GitHub Inc.","homepage":"https://github.com/npm/agent#readme","description":"the http/https agent used by the npm cli","url":"git+https://github.com/npm/agent.git","private":false}},{"id":"644572bbb1e01679","name":"@npmcli/fs","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/fs:\\@npmcli\\/fs:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/fs@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/fs","version":"1.1.1","author":"GitHub Inc.","homepage":"","description":"filesystem utilities for the npm cli","url":"","private":false}},{"id":"2f7974422b4dc793","name":"@npmcli/fs","version":"4.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/fs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/fs/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/fs:\\@npmcli\\/fs:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/fs@4.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/fs","version":"4.0.0","author":"GitHub Inc.","homepage":"","description":"filesystem utilities for the npm cli","url":"git+https://github.com/npm/fs.git","private":false}},{"id":"a988a9e98434d4e0","name":"@npmcli/move-file","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/move-file/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/move-file/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/move-file/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/move-file/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@npmcli\\/move-file:\\@npmcli\\/move-file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move-file:\\@npmcli\\/move_file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move_file:\\@npmcli\\/move-file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move_file:\\@npmcli\\/move_file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move:\\@npmcli\\/move-file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@npmcli\\/move:\\@npmcli\\/move_file:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40npmcli/move-file@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"@npmcli/move-file","version":"1.1.2","author":"","homepage":"","description":"move a file (fork of move-file)","url":"git+https://github.com/npm/move-file","private":false}},{"id":"80ec3c5b78ad0cd1","name":"@otplib/core","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/core/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/core/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/core/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/core:\\@otplib\\/core:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/core:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/core@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/core","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"core method for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-core","private":false}},{"id":"a30b3113039a0207","name":"@otplib/plugin-crypto","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-crypto/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-crypto:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-crypto:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_crypto:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_crypto:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin-crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin_crypto:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/plugin-crypto@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/plugin-crypto","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"node crypto plugin for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-plugin-crypto","private":false}},{"id":"e9e61a8a5751393d","name":"@otplib/plugin-thirty-two","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/plugin-thirty-two/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty-two:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty-two:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty_two:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty_two:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin-thirty:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin_thirty:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/plugin:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin-thirty-two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/plugin_thirty_two:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/plugin-thirty-two@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/plugin-thirty-two","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"thirty-two plugin for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-plugin-thirty-two","private":false}},{"id":"8171b09a48e9d93f","name":"@otplib/preset-default","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/preset-default/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-default/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/preset-default/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-default/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/preset-default:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset-default:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_default:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_default:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset-default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset_default:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/preset-default@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/preset-default","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"basic preset for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-preset-default","private":false}},{"id":"1aa44437b113ebed","name":"@otplib/preset-v11","version":"12.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@otplib/preset-v11/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-v11/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@otplib/preset-v11/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@otplib/preset-v11/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@otplib\\/preset-v11:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset-v11:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_v11:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset_v11:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@otplib\\/preset:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset-v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yeojz:\\@otplib\\/preset_v11:12.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40otplib/preset-v11@12.0.1","metadataType":"javascript-npm-package","metadata":{"name":"@otplib/preset-v11","version":"12.0.1","author":"Gerald Yeo ","homepage":"https://yeojz.otplib.dev","description":"v11.x compatible interface preset for otplib","url":"https://github.com/yeojz/otplib/tree/master/packages/otplib-preset-v11","private":false}},{"id":"80ef1a2248d5a920","name":"@pkgjs/parseargs","version":"0.11.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@pkgjs/parseargs/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@pkgjs\\/parseargs:\\@pkgjs\\/parseargs:0.11.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pkgjs:\\@pkgjs\\/parseargs:0.11.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40pkgjs/parseargs@0.11.0","metadataType":"javascript-npm-package","metadata":{"name":"@pkgjs/parseargs","version":"0.11.0","author":"","homepage":"https://github.com/pkgjs/parseargs#readme","description":"Polyfill of future proposal for `util.parseArgs()`","url":"git@github.com:pkgjs/parseargs.git","private":false}},{"id":"19e6077d1014f2df","name":"@scarf/scarf","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scarf/scarf/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scarf/scarf/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"Apache-2.0","spdxExpression":"Apache-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scarf/scarf/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scarf/scarf/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scarf\\/scarf:\\@scarf\\/scarf:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:scarf-sh:\\@scarf\\/scarf:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scarf/scarf@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@scarf/scarf","version":"1.4.0","author":"Scarf Systems","homepage":"https://github.com/scarf-sh/scarf-js","description":"Scarf is like Google Analytics for your npm packages. Gain insights into how your packages are installed and used, and by which companies.","url":"git+https://github.com/scarf-sh/scarf-js.git","private":false}},{"id":"8a8c401a9f2b2c51","name":"@scure/base","version":"1.1.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scure\\/base:\\@scure\\/base:1.1.9:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scure/base@1.1.9","metadataType":"javascript-npm-package","metadata":{"name":"@scure/base","version":"1.1.9","author":"Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/#scure","description":"Secure, audited & 0-dep implementation of base64, bech32, base58, base32 & base16","url":"git+https://github.com/paulmillr/scure-base.git","private":false}},{"id":"5f4817f39b8e1c4d","name":"@scure/bip32","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip32/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scure\\/bip32:\\@scure\\/bip32:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scure/bip32@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"@scure/bip32","version":"1.4.0","author":"Paul Miller (https://paulmillr.com), Patricio Palladino , Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/noble/#scure","description":"Secure, audited & minimal implementation of BIP32 hierarchical deterministic (HD) wallets over secp256k1","url":"git+https://github.com/paulmillr/scure-bip32.git","private":false}},{"id":"0f92a1c1ac31f6b0","name":"@scure/bip39","version":"1.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@scure/bip39/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@scure/bip39/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@scure/bip39/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@scure\\/bip39:\\@scure\\/bip39:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40scure/bip39@1.3.0","metadataType":"javascript-npm-package","metadata":{"name":"@scure/bip39","version":"1.3.0","author":"Paul Miller (https://paulmillr.com), Patricio Palladino , Paul Miller (https://paulmillr.com)","homepage":"https://paulmillr.com/","description":"Secure, audited & minimal implementation of BIP39 mnemonic phrases","url":"git+https://github.com/paulmillr/scure-bip39.git","private":false}},{"id":"a29ebe9c01a24b05","name":"@sindresorhus/is","version":"0.7.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@sindresorhus/is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@sindresorhus/is/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@sindresorhus/is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@sindresorhus/is/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@sindresorhus\\/is:\\@sindresorhus\\/is:0.7.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40sindresorhus/is@0.7.0","metadataType":"javascript-npm-package","metadata":{"name":"@sindresorhus/is","version":"0.7.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Type check values: `is.string('🦄') //=> true`","url":"sindresorhus/is","private":false}},{"id":"079d0d4fdf762801","name":"@swc/helpers","version":"0.3.17","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@swc/helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@swc/helpers/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@swc/helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@swc/helpers/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@swc\\/helpers:\\@swc\\/helpers:0.3.17:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40swc/helpers@0.3.17","metadataType":"javascript-npm-package","metadata":{"name":"@swc/helpers","version":"0.3.17","author":"강동윤 ","homepage":"https://swc.rs","description":"External helpers for the swc project.","url":"git+https://github.com/swc-project/swc.git","private":false}},{"id":"43352d2f6855caf1","name":"@tokenizer/token","version":"0.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@tokenizer/token/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tokenizer/token/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@tokenizer/token/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tokenizer/token/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@tokenizer\\/token:\\@tokenizer\\/token:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:Borewit:\\@tokenizer\\/token:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40tokenizer/token@0.3.0","metadataType":"javascript-npm-package","metadata":{"name":"@tokenizer/token","version":"0.3.0","author":"Borewit (https://github.com/Borewit)","homepage":"","description":"TypeScript definition for strtok3 token","url":"https://github.com/Borewit/tokenizer-token.git","private":false}},{"id":"c5d7a329145ffcc6","name":"@tootallnate/once","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@tootallnate\\/once:\\@tootallnate\\/once:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:\\@tootallnate\\/once:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40tootallnate/once@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"@tootallnate/once","version":"1.1.2","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Creates a Promise that waits for a single event","url":"git://github.com/TooTallNate/once.git","private":false}},{"id":"f544b09023665970","name":"@tootallnate/once","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@tootallnate/once/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@tootallnate/once/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@tootallnate\\/once:\\@tootallnate\\/once:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:\\@tootallnate\\/once:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40tootallnate/once@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@tootallnate/once","version":"2.0.0","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Creates a Promise that waits for a single event","url":"git://github.com/TooTallNate/once.git","private":false}},{"id":"ae93160dfc27d07c","name":"@types/component-emitter","version":"1.2.14","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/component-emitter/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/component-emitter/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/component-emitter:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component-emitter:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component_emitter:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component_emitter:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/component:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/component-emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/component_emitter:1.2.14:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/component-emitter@1.2.14","metadataType":"javascript-npm-package","metadata":{"name":"@types/component-emitter","version":"1.2.14","author":"Peter Snider (https://github.com/psnider)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/component-emitter","description":"TypeScript definitions for component-emitter","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"1339467e13b5c752","name":"@types/cookie","version":"0.4.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/cookie:0.4.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/cookie:\\@types\\/cookie:0.4.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/cookie@0.4.1","metadataType":"javascript-npm-package","metadata":{"name":"@types/cookie","version":"0.4.1","author":"Pine Mizune (https://github.com/pine), Piotr Błażejewicz (https://github.com/peterblazejewicz)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/cookie","description":"TypeScript definitions for cookie","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"bc4bb778990d4ea4","name":"@types/cors","version":"2.8.19","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/cors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/cors:2.8.19:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/cors:\\@types\\/cors:2.8.19:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/cors@2.8.19","metadataType":"javascript-npm-package","metadata":{"name":"@types/cors","version":"2.8.19","author":"Alan Plum (https://github.com/pluma), Gaurav Sharma (https://github.com/gtpan77), Sebastian Beltran (https://github.com/bjohansebas)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/cors","description":"TypeScript definitions for cors","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"6c978939ffb311b0","name":"@types/debug","version":"4.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/debug:4.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/debug:\\@types\\/debug:4.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/debug@4.1.12","metadataType":"javascript-npm-package","metadata":{"name":"@types/debug","version":"4.1.12","author":"Seon-Wook Park (https://github.com/swook), Gal Talmor (https://github.com/galtalmor), John McLaughlin (https://github.com/zamb3zi), Brasten Sager (https://github.com/brasten), Nicolas Penin (https://github.com/npenin), Kristian Brünn (https://github.com/kristianmitk), Caleb Gregory (https://github.com/calebgregory)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/debug","description":"TypeScript definitions for debug","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"495a18008d72fd0f","name":"@types/ms","version":"2.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/ms/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ms/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/ms/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ms/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/ms:2.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/ms:\\@types\\/ms:2.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/ms@2.1.0","metadataType":"javascript-npm-package","metadata":{"name":"@types/ms","version":"2.1.0","author":"Zhiyuan Wang (https://github.com/danny8002)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/ms","description":"TypeScript definitions for ms","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"1a396f39fa44decd","name":"@types/node","version":"20.19.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/node:20.19.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/node:\\@types\\/node:20.19.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/node@20.19.12","metadataType":"javascript-npm-package","metadata":{"name":"@types/node","version":"20.19.12","author":"Microsoft TypeScript (https://github.com/Microsoft), Alberto Schiabel (https://github.com/jkomyno), Andrew Makarov (https://github.com/r3nya), Benjamin Toueg (https://github.com/btoueg), David Junger (https://github.com/touffy), Mohsen Azimi (https://github.com/mohsen1), Nikita Galkin (https://github.com/galkin), Sebastian Silbermann (https://github.com/eps1lon), Wilco Bakker (https://github.com/WilcoBakker), Marcin Kopacz (https://github.com/chyzwar), Trivikram Kamat (https://github.com/trivikr), Junxiao Shi (https://github.com/yoursunny), Ilia Baryshnikov (https://github.com/qwelias), ExE Boss (https://github.com/ExE-Boss), Piotr Błażejewicz (https://github.com/peterblazejewicz), Anna Henningsen (https://github.com/addaleax), Victor Perin (https://github.com/victorperin), NodeJS Contributors (https://github.com/NodeJS), Linus Unnebäck (https://github.com/LinusU), wafuwafu13 (https://github.com/wafuwafu13), Matteo Collina (https://github.com/mcollina), Dmitry Semigradsky (https://github.com/Semigradsky)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node","description":"TypeScript definitions for node","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"6fe716e8b0927a9d","name":"@types/node","version":"22.7.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ethers/node_modules/@types/node/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/node:22.7.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/node:\\@types\\/node:22.7.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/node@22.7.5","metadataType":"javascript-npm-package","metadata":{"name":"@types/node","version":"22.7.5","author":"Microsoft TypeScript (https://github.com/Microsoft), Alberto Schiabel (https://github.com/jkomyno), Alvis HT Tang (https://github.com/alvis), Andrew Makarov (https://github.com/r3nya), Benjamin Toueg (https://github.com/btoueg), Chigozirim C. (https://github.com/smac89), David Junger (https://github.com/touffy), Deividas Bakanas (https://github.com/DeividasBakanas), Eugene Y. Q. Shen (https://github.com/eyqs), Hannes Magnusson (https://github.com/Hannes-Magnusson-CK), Huw (https://github.com/hoo29), Kelvin Jin (https://github.com/kjin), Klaus Meinhardt (https://github.com/ajafff), Lishude (https://github.com/islishude), Mariusz Wiktorczyk (https://github.com/mwiktorczyk), Mohsen Azimi (https://github.com/mohsen1), Nikita Galkin (https://github.com/galkin), Parambir Singh (https://github.com/parambirs), Sebastian Silbermann (https://github.com/eps1lon), Thomas den Hollander (https://github.com/ThomasdenH), Wilco Bakker (https://github.com/WilcoBakker), wwwy3y3 (https://github.com/wwwy3y3), Samuel Ainsworth (https://github.com/samuela), Kyle Uehlein (https://github.com/kuehlein), Thanik Bhongbhibhat (https://github.com/bhongy), Marcin Kopacz (https://github.com/chyzwar), Trivikram Kamat (https://github.com/trivikr), Junxiao Shi (https://github.com/yoursunny), Ilia Baryshnikov (https://github.com/qwelias), ExE Boss (https://github.com/ExE-Boss), Piotr Błażejewicz (https://github.com/peterblazejewicz), Anna Henningsen (https://github.com/addaleax), Victor Perin (https://github.com/victorperin), Yongsheng Zhang (https://github.com/ZYSzys), NodeJS Contributors (https://github.com/NodeJS), Linus Unnebäck (https://github.com/LinusU), wafuwafu13 (https://github.com/wafuwafu13), Matteo Collina (https://github.com/mcollina), Dmitry Semigradsky (https://github.com/Semigradsky)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node","description":"TypeScript definitions for node","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"d3c68c4be4da21f8","name":"@types/strip-bom","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/strip-bom/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-bom/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/strip-bom/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-bom/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/strip-bom:\\@types\\/strip-bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-bom:\\@types\\/strip_bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_bom:\\@types\\/strip-bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_bom:\\@types\\/strip_bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip-bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip_bom:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/strip-bom@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"@types/strip-bom","version":"3.0.0","author":"Mohamed Hegazy ","homepage":"","description":"TypeScript definitions for strip-bom","url":"https://www.github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"a1b120935894d604","name":"@types/strip-json-comments","version":"0.0.30","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/strip-json-comments/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-json-comments/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/strip-json-comments/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/strip-json-comments/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/strip-json-comments:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-json-comments:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json_comments:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json_comments:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-json:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip-json:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip_json:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip-json-comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/strip:\\@types\\/strip_json_comments:0.0.30:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/strip-json-comments@0.0.30","metadataType":"javascript-npm-package","metadata":{"name":"@types/strip-json-comments","version":"0.0.30","author":"Dylan R. E. Moonfire (https://github.com/dmoonfire)","homepage":"","description":"TypeScript definitions for strip-json-comments","url":"https://www.github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"3e3be5c397de8382","name":"@types/triple-beam","version":"1.3.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/triple-beam/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/triple-beam/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/triple-beam/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/triple-beam/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/triple-beam:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple-beam:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple_beam:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple_beam:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple:\\@types\\/triple-beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/triple:\\@types\\/triple_beam:1.3.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/triple-beam@1.3.5","metadataType":"javascript-npm-package","metadata":{"name":"@types/triple-beam","version":"1.3.5","author":"Daniel Byrne (https://github.com/danwbyrne)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/triple-beam","description":"TypeScript definitions for triple-beam","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"28a4e010c7ae7198","name":"@types/validator","version":"13.15.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/validator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/validator/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/validator/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/validator/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:\\@types\\/validator:\\@types\\/validator:13.15.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/validator:13.15.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/validator@13.15.3","metadataType":"javascript-npm-package","metadata":{"name":"@types/validator","version":"13.15.3","author":"tgfjt (https://github.com/tgfjt), Ilya Mochalov (https://github.com/chrootsu), Ayman Nedjmeddine (https://github.com/IOAyman), Louay Alakkad (https://github.com/louy), Bonggyun Lee (https://github.com/deptno), Naoto Yokoyama (https://github.com/builtinnya), Philipp Katz (https://github.com/qqilihq), Jace Warren (https://github.com/keatz55), Munif Tanjim (https://github.com/MunifTanjim), Vlad Poluch (https://github.com/vlapo), Piotr Błażejewicz (https://github.com/peterblazejewicz), Matteo Nista (https://github.com/Mattewn99), Daniel Freire (https://github.com/dcfreire), Rik Smale (https://github.com/WikiRik)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/validator","description":"TypeScript definitions for validator","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"bc7a53b52d363adb","name":"@types/ws","version":"8.5.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@types/ws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ws/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@types/ws/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@types/ws/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:DefinitelyTyped:\\@types\\/ws:8.5.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:\\@types\\/ws:\\@types\\/ws:8.5.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/%40types/ws@8.5.3","metadataType":"javascript-npm-package","metadata":{"name":"@types/ws","version":"8.5.3","author":"Paul Loyd (https://github.com/loyd), Margus Lamp (https://github.com/mlamp), Philippe D'Alva (https://github.com/TitaneBoy), reduckted (https://github.com/reduckted), teidesu (https://github.com/teidesu), Bartosz Wojtkowiak (https://github.com/wojtkowiak), Kyle Hensel (https://github.com/k-yle), Samuel Skeen (https://github.com/cwadrupldijjit)","homepage":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/ws","description":"TypeScript definitions for ws","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git","private":false}},{"id":"7797aed52ef29847","name":"abbrev","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:abbrev:abbrev:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:abbrev:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abbrev@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"abbrev","version":"1.1.1","author":"Isaac Z. Schlueter ","homepage":"","description":"Like ruby's abbrev module, but in js","url":"http://github.com/isaacs/abbrev-js","private":false}},{"id":"bfcf5eaa5daa3133","name":"abbrev","version":"3.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-gyp/node_modules/abbrev/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:abbrev:abbrev:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abbrev@3.0.1","metadataType":"javascript-npm-package","metadata":{"name":"abbrev","version":"3.0.1","author":"GitHub Inc.","homepage":"","description":"Like ruby's abbrev module, but in js","url":"git+https://github.com/npm/abbrev-js.git","private":false}},{"id":"663ac1c9b870ce8a","name":"abitype","version":"0.7.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/abitype/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abitype/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/abitype/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abitype/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:wagmi-dev:abitype:0.7.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abitype:abitype:0.7.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abitype@0.7.1","metadataType":"javascript-npm-package","metadata":{"name":"abitype","version":"0.7.1","author":"","homepage":"","description":"Strict TypeScript types for Ethereum ABIs","url":"https://github.com/wagmi-dev/abitype.git","private":false}},{"id":"7832aa1cacf310b2","name":"abort-controller","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/abort-controller/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abort-controller/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/abort-controller/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/abort-controller/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:abort-controller:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort-controller:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort_controller:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort_controller:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mysticatea:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mysticatea:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort:abort-controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:abort:abort_controller:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/abort-controller@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"abort-controller","version":"3.0.0","author":"Toru Nagashima (https://github.com/mysticatea)","homepage":"https://github.com/mysticatea/abort-controller#readme","description":"An implementation of WHATWG AbortController interface.","url":"git+https://github.com/mysticatea/abort-controller.git","private":false}},{"id":"fe1f2ff03fb9475c","name":"accepts","version":"1.3.8","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/accepts/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/accepts/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/accepts/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/accepts/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:accepts:accepts:1.3.8:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/accepts@1.3.8","metadataType":"javascript-npm-package","metadata":{"name":"accepts","version":"1.3.8","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com)","homepage":"","description":"Higher-level content negotiation","url":"jshttp/accepts","private":false}},{"id":"c0f7127acbceb420","name":"acorn","version":"7.4.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/is-expression/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:acornjs:acorn:7.4.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn:7.4.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/acorn@7.4.1","metadataType":"javascript-npm-package","metadata":{"name":"acorn","version":"7.4.1","author":"Marijn Haverbeke , Ingvar Stepanyan , Adrian Heine","homepage":"https://github.com/acornjs/acorn","description":"ECMAScript parser","url":"https://github.com/acornjs/acorn.git","private":false}},{"id":"facfba058a0afa86","name":"acorn","version":"8.15.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/acorn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:acornjs:acorn:8.15.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn:8.15.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/acorn@8.15.0","metadataType":"javascript-npm-package","metadata":{"name":"acorn","version":"8.15.0","author":"Marijn Haverbeke , Ingvar Stepanyan , Adrian Heine","homepage":"https://github.com/acornjs/acorn","description":"ECMAScript parser","url":"git+https://github.com/acornjs/acorn.git","private":false}},{"id":"dbdb98fb9b57cb53","name":"acorn-walk","version":"8.3.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/acorn-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn-walk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/acorn-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/acorn-walk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:acorn-walk:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn-walk:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn_walk:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn_walk:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acornjs:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acornjs:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn-walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:acorn:acorn_walk:8.3.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/acorn-walk@8.3.4","metadataType":"javascript-npm-package","metadata":{"name":"acorn-walk","version":"8.3.4","author":"Marijn Haverbeke , Ingvar Stepanyan , Adrian Heine","homepage":"https://github.com/acornjs/acorn","description":"ECMAScript (ESTree) AST walker","url":"https://github.com/acornjs/acorn.git","private":false}},{"id":"6ad4b0036eebc3a0","name":"aes-js","version":"4.0.0-beta.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/aes-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aes-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/aes-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aes-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:aes-js:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes-js:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes_js:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes_js:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ricmoo:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ricmoo:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes:aes-js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aes:aes_js:4.0.0-beta.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/aes-js@4.0.0-beta.5","metadataType":"javascript-npm-package","metadata":{"name":"aes-js","version":"4.0.0-beta.5","author":"Richard Moore ","homepage":"","description":"A pure JavaScript implementation of the AES block cipher and all common modes of operation.","url":"git://github.com/ricmoo/aes-js.git","private":false}},{"id":"aeef16c972765f3c","name":"agent-base","version":"6.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent-base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent_base:6.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agent-base@6.0.2","metadataType":"javascript-npm-package","metadata":{"name":"agent-base","version":"6.0.2","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Turn a function into an `http.Agent` instance","url":"git://github.com/TooTallNate/node-agent-base.git","private":false}},{"id":"96ecb0353e427e76","name":"agent-base","version":"7.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@npmcli/agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agent-base@7.1.4","metadataType":"javascript-npm-package","metadata":{"name":"agent-base","version":"7.1.4","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Turn a function into an `http.Agent` instance","url":"https://github.com/TooTallNate/proxy-agents.git","private":false}},{"id":"89a76184ab2e6db2","name":"agent-base","version":"7.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/socks-proxy-agent/node_modules/agent-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:TooTallNate:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent-base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent_base:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent-base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:agent:agent_base:7.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agent-base@7.1.4","metadataType":"javascript-npm-package","metadata":{"name":"agent-base","version":"7.1.4","author":"Nathan Rajlich (http://n8.io/)","homepage":"","description":"Turn a function into an `http.Agent` instance","url":"https://github.com/TooTallNate/proxy-agents.git","private":false}},{"id":"c6a7724321f5beae","name":"agentkeepalive","version":"4.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/agentkeepalive/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agentkeepalive/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/agentkeepalive/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/agentkeepalive/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:agentkeepalive:agentkeepalive:4.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:node-modules:agentkeepalive:4.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/agentkeepalive@4.6.0","metadataType":"javascript-npm-package","metadata":{"name":"agentkeepalive","version":"4.6.0","author":"fengmk2 (https://github.com/fengmk2)","homepage":"","description":"Missing keepalive http.Agent","url":"git://github.com/node-modules/agentkeepalive.git","private":false}},{"id":"7cedce27af4fa8d6","name":"aggregate-error","version":"3.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/aggregate-error/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aggregate-error/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/aggregate-error/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aggregate-error/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:aggregate-error:aggregate-error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate-error:aggregate_error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate_error:aggregate-error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate_error:aggregate_error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate:aggregate-error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aggregate:aggregate_error:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/aggregate-error@3.1.0","metadataType":"javascript-npm-package","metadata":{"name":"aggregate-error","version":"3.1.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Create an error from multiple errors","url":"sindresorhus/aggregate-error","private":false}},{"id":"ba5607392e56dee9","name":"ansi-regex","version":"2.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/gauge/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:2.1.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@2.1.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"2.1.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"2b280fc78a93d0b1","name":"ansi-regex","version":"2.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:2.1.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@2.1.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"2.1.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"b93db3f55b850b14","name":"ansi-regex","version":"2.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/has-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:2.1.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@2.1.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"2.1.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"dddd120589f7009b","name":"ansi-regex","version":"3.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wide-align/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:3.0.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@3.0.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"3.0.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"215b7da2acde9858","name":"ansi-regex","version":"5.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:5.0.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@5.0.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"5.0.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"3f33beb59e12eb10","name":"ansi-regex","version":"6.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/@isaacs/cliui/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:6.2.0:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@6.2.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"6.2.0","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"c7daa267534d8282","name":"ansi-regex","version":"6.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-regex/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-regex_project:ansi-regex:6.2.0:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/ansi-regex@6.2.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-regex","version":"6.2.0","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"Regular expression for matching ANSI escape codes","url":"chalk/ansi-regex","private":false}},{"id":"65b4c3eb14b71ee6","name":"ansi-styles","version":"2.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:2.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@2.2.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"2.2.1","author":"Sindre Sorhus (sindresorhus.com), Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"f879ff424c2ec284","name":"ansi-styles","version":"3.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@3.2.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"3.2.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"c3f3679aac65318b","name":"ansi-styles","version":"4.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@4.3.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"4.3.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"c365b03d53f8ca80","name":"ansi-styles","version":"4.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@4.3.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"4.3.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"f3dee5a49bb85e72","name":"ansi-styles","version":"4.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:4.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@4.3.0","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"4.3.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"8270a49368d729a2","name":"ansi-styles","version":"6.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi/node_modules/ansi-styles/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ansi-styles:ansi-styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi-styles:ansi_styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi-styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi_styles:ansi_styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi-styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ansi:ansi_styles:6.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/ansi-styles@6.2.1","metadataType":"javascript-npm-package","metadata":{"name":"ansi-styles","version":"6.2.1","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"ANSI escape codes for styling strings in the terminal","url":"chalk/ansi-styles","private":false}},{"id":"1fdc06fdab01441e","name":"anymatch","version":"3.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/anymatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/anymatch/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/anymatch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/anymatch/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:anymatch:3.1.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/anymatch@3.1.3","metadataType":"javascript-npm-package","metadata":{"name":"anymatch","version":"3.1.3","author":"Elan Shanker (https://github.com/es128)","homepage":"https://github.com/micromatch/anymatch","description":"Matches strings against configurable strings, globs, regular expressions, and/or functions","url":"https://github.com/micromatch/anymatch","private":false}},{"id":"40d1f9967f309c48","name":"append-field","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/append-field/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/append-field/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/append-field/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/append-field/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:append-field:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append-field:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append_field:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append_field:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:LinusU:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:LinusU:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append:append-field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:append:append_field:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/append-field@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"append-field","version":"1.0.0","author":"Linus Unnebäck ","homepage":"","description":"","url":"http://github.com/LinusU/node-append-field.git","private":false}},{"id":"81de4b22dbb401d0","name":"aproba","version":"1.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/aproba/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aproba/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/aproba/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/aproba/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:aproba:aproba:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:aproba:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/aproba@1.2.0","metadataType":"javascript-npm-package","metadata":{"name":"aproba","version":"1.2.0","author":"Rebecca Turner ","homepage":"https://github.com/iarna/aproba","description":"A ridiculously light-weight argument validator (now browser friendly)","url":"https://github.com/iarna/aproba","private":false}},{"id":"3fb8ce78823b4311","name":"archive-type","version":"4.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archive-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archive-type/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archive-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archive-type/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:archive-type:archive-type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive-type:archive_type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive_type:archive-type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive_type:archive_type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive:archive-type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archive:archive_type:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/archive-type@4.0.0","metadataType":"javascript-npm-package","metadata":{"name":"archive-type","version":"4.0.0","author":"Kevin Mårtensson (https://github.com/kevva)","homepage":"","description":"Detect the archive type of a Buffer/Uint8Array","url":"kevva/archive-type","private":false}},{"id":"dec4b5088a113d49","name":"archiver","version":"1.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:archiverjs:archiver:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver:archiver:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/archiver@1.3.0","metadataType":"javascript-npm-package","metadata":{"name":"archiver","version":"1.3.0","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/node-archiver","description":"a streaming interface for archive generation","url":"https://github.com/archiverjs/node-archiver.git","private":false}},{"id":"35ab1a4a9ad1f907","name":"archiver-utils","version":"1.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:archiver-utils:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver-utils:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver_utils:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver_utils:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver:archiver-utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiver:archiver_utils:1.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/archiver-utils@1.3.0","metadataType":"javascript-npm-package","metadata":{"name":"archiver-utils","version":"1.3.0","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/archiver-utils#readme","description":"utility functions for archiver","url":"https://github.com/archiverjs/archiver-utils.git","private":false}},{"id":"38e39a5c3788e5c4","name":"are-we-there-yet","version":"1.1.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:are-we-there-yet:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there-yet:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are-we-there-yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are_we_there_yet:1.1.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/are-we-there-yet@1.1.7","metadataType":"javascript-npm-package","metadata":{"name":"are-we-there-yet","version":"1.1.7","author":"Rebecca Turner (http://re-becca.org)","homepage":"https://github.com/iarna/are-we-there-yet","description":"Keep track of the overall completion of many disparate processes","url":"https://github.com/iarna/are-we-there-yet.git","private":false}},{"id":"a1e5dbdcb445cc0b","name":"are-we-there-yet","version":"3.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/are-we-there-yet/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:are-we-there-yet:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there-yet:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there_yet:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we-there:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we_there:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are-we:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are_we:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:are:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:are-we-there-yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:are_we_there_yet:3.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/are-we-there-yet@3.0.1","metadataType":"javascript-npm-package","metadata":{"name":"are-we-there-yet","version":"3.0.1","author":"GitHub Inc.","homepage":"https://github.com/npm/are-we-there-yet","description":"Keep track of the overall completion of many disparate processes","url":"https://github.com/npm/are-we-there-yet.git","private":false}},{"id":"1d7fb08b7a508a14","name":"arg","version":"4.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arg/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arg/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arg/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:arg:arg:4.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arg@4.1.3","metadataType":"javascript-npm-package","metadata":{"name":"arg","version":"4.1.3","author":"Josh Junon ","homepage":"","description":"Another simple argument parser","url":"zeit/arg","private":false}},{"id":"d60313d70eaae47d","name":"argparse","version":"1.0.10","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/argparse/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/argparse/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/argparse/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/argparse/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:argparse:argparse:1.0.10:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/argparse@1.0.10","metadataType":"javascript-npm-package","metadata":{"name":"argparse","version":"1.0.10","author":"Eugene Shkuropat, Paul Jacobson","homepage":"","description":"Very powerful CLI arguments parser. Native port of argparse - python's options parsing library","url":"nodeca/argparse","private":false}},{"id":"79c9f00f6f2bc886","name":"arr-diff","version":"4.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arr-diff/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-diff/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arr-diff/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-diff/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-diff:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-diff:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_diff:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_diff:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr-diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr_diff:4.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arr-diff@4.0.0","metadataType":"javascript-npm-package","metadata":{"name":"arr-diff","version":"4.0.0","author":"Jon Schlinkert (https://github.com/jonschlinkert), Jon Schlinkert (http://twitter.com/jonschlinkert), Paul Miller (paulmillr.com)","homepage":"https://github.com/jonschlinkert/arr-diff","description":"Returns an array with only the unique values from the first array, by excluding all values from additional arrays using strict equality for comparisons.","url":"jonschlinkert/arr-diff","private":false}},{"id":"af48b36479290ede","name":"arr-flatten","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arr-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-flatten/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arr-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-flatten/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-flatten:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-flatten:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_flatten:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_flatten:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr-flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr_flatten:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arr-flatten@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"arr-flatten","version":"1.1.0","author":"Jon Schlinkert (https://github.com/jonschlinkert), Jon Schlinkert (http://twitter.com/jonschlinkert), Luke Edwards (https://lukeed.com)","homepage":"https://github.com/jonschlinkert/arr-flatten","description":"Recursively flatten an array or arrays.","url":"jonschlinkert/arr-flatten","private":false}},{"id":"93ff899831bd49b7","name":"arr-union","version":"3.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/arr-union/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-union/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/arr-union/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/arr-union/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-union:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr-union:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_union:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr_union:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr-union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:arr:arr_union:3.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/arr-union@3.1.0","metadataType":"javascript-npm-package","metadata":{"name":"arr-union","version":"3.1.0","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/arr-union","description":"Combines a list of arrays, returning a single array with unique values, using strict equality for comparisons.","url":"jonschlinkert/arr-union","private":false}},{"id":"f2867470e7b27597","name":"array-buffer-byte-length","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-buffer-byte-length/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-buffer-byte-length/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-buffer-byte-length/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-buffer-byte-length/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:array-buffer-byte-length:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer-byte-length:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte_length:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte_length:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer-byte:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer-byte:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer_byte:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-buffer:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_buffer:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-buffer-byte-length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_buffer_byte_length:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-buffer-byte-length@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"array-buffer-byte-length","version":"1.0.2","author":"Jordan Harband ","homepage":"https://github.com/inspect-js/array-buffer-byte-length#readme","description":"Get the byte length of an ArrayBuffer, even in engines without a `.byteLength` method.","url":"git+https://github.com/inspect-js/array-buffer-byte-length.git","private":false}},{"id":"7aadb2fc6095104c","name":"array-each","version":"1.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-each/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-each/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-each/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-each/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-each:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-each:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_each:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_each:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_each:1.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-each@1.0.1","metadataType":"javascript-npm-package","metadata":{"name":"array-each","version":"1.0.1","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/array-each","description":"Loop over each item in an array and call the given function on every element.","url":"jonschlinkert/array-each","private":false}},{"id":"5041c141565d0833","name":"array-flatten","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-flatten/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-flatten/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-flatten/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:array-flatten:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-flatten:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_flatten:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_flatten:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:blakeembrey:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:blakeembrey:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_flatten:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-flatten@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"array-flatten","version":"1.1.1","author":"Blake Embrey (http://blakeembrey.me)","homepage":"https://github.com/blakeembrey/array-flatten","description":"Flatten an array of nested arrays into a single flat array","url":"git://github.com/blakeembrey/array-flatten.git","private":false}},{"id":"a261f10f751ab469","name":"array-slice","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-slice/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-slice/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-slice/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-slice/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-slice:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-slice:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_slice:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_slice:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_slice:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-slice@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"array-slice","version":"1.1.0","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/array-slice","description":"Array-slice method. Slices `array` from the `start` index up to, but not including, the `end` index.","url":"jonschlinkert/array-slice","private":false}},{"id":"9bb35b54a028e73b","name":"array-unique","version":"0.3.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/array-unique/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-unique/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/array-unique/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/array-unique/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-unique:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array-unique:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_unique:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array_unique:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array-unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:array:array_unique:0.3.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/array-unique@0.3.2","metadataType":"javascript-npm-package","metadata":{"name":"array-unique","version":"0.3.2","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/array-unique","description":"Remove duplicate values from an array. Fastest ES5 implementation.","url":"jonschlinkert/array-unique","private":false}},{"id":"1c54e38011c51e5b","name":"asap","version":"2.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/asap/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/asap/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/asap/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/asap/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:kriskowal:asap:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:asap:asap:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/asap@2.0.6","metadataType":"javascript-npm-package","metadata":{"name":"asap","version":"2.0.6","author":"","homepage":"","description":"High-priority task queue for Node.js and browsers","url":"https://github.com/kriskowal/asap.git","private":false}},{"id":"e57cc97cb7061a4e","name":"assert-never","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/assert-never/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assert-never/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/assert-never/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assert-never/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:assert-never:assert-never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert-never:assert_never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert_never:assert-never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert_never:assert_never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert:assert-never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assert:assert_never:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/assert-never@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"assert-never","version":"1.4.0","author":"Daniel Lytkin ","homepage":"","description":"Helper function for exhaustive checks of discriminated unions in TypeScript","url":"aikoven/assert-never","private":false}},{"id":"e6db49d199a690ef","name":"assign-symbols","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/assign-symbols/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assign-symbols/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/assign-symbols/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/assign-symbols/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:assign-symbols:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign-symbols:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign_symbols:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign_symbols:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign:assign-symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:assign:assign_symbols:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/assign-symbols@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"assign-symbols","version":"1.0.0","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/assign-symbols","description":"Assign the enumerable es6 Symbol properties from an object (or objects) to the first object passed on the arguments. Can be used as a supplement to other extend, assign or merge methods as a polyfill for the Symbols part of the es6 Object.assign method.","url":"jonschlinkert/assign-symbols","private":false}},{"id":"50f2f4c26ff2ccab","name":"async","version":"2.6.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/async/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/async/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:caolan:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:async:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/async@2.6.4","metadataType":"javascript-npm-package","metadata":{"name":"async","version":"2.6.4","author":"Caolan McMahon","homepage":"https://caolan.github.io/async/","description":"Higher-order functions and common patterns for asynchronous code","url":"https://github.com/caolan/async.git","private":false}},{"id":"5aa21ddd678e2c5a","name":"async","version":"2.6.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/portscanner/node_modules/async/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:caolan:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:async:async:2.6.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/async@2.6.4","metadataType":"javascript-npm-package","metadata":{"name":"async","version":"2.6.4","author":"Caolan McMahon","homepage":"https://caolan.github.io/async/","description":"Higher-order functions and common patterns for asynchronous code","url":"https://github.com/caolan/async.git","private":false}},{"id":"6753e2a5837ba461","name":"async","version":"3.2.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/async/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/async/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/async/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:caolan:async:3.2.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:async:async:3.2.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/async@3.2.6","metadataType":"javascript-npm-package","metadata":{"name":"async","version":"3.2.6","author":"Caolan McMahon","homepage":"https://caolan.github.io/async/","description":"Higher-order functions and common patterns for asynchronous code","url":"https://github.com/caolan/async.git","private":false}},{"id":"dd9e19320bbf0929","name":"at-least-node","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/at-least-node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/at-least-node/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/at-least-node/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/at-least-node/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:at-least-node:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at-least-node:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least_node:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least_node:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at-least:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at-least:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at_least:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:RyanZim:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:RyanZim:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at:at-least-node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:at:at_least_node:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/at-least-node@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"at-least-node","version":"1.0.0","author":"Ryan Zimmerman ","homepage":"https://github.com/RyanZim/at-least-node#readme","description":"Lightweight Node.js version sniffing/comparison","url":"git+https://github.com/RyanZim/at-least-node.git","private":false}},{"id":"27aacb47fbbddd97","name":"atob","version":"2.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/atob/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/atob/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"(MIT OR Apache-2.0)","spdxExpression":"(MIT OR Apache-2.0)","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/atob/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/atob/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:atob_project:atob:2.1.2:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/atob@2.1.2","metadataType":"javascript-npm-package","metadata":{"name":"atob","version":"2.1.2","author":"AJ ONeal (https://coolaj86.com)","homepage":"https://git.coolaj86.com/coolaj86/atob.js.git","description":"atob for Node.JS and Linux / Mac / Windows CLI (it's a one-liner)","url":"git://git.coolaj86.com/coolaj86/atob.js.git","private":false}},{"id":"91c13e4c18804052","name":"available-typed-arrays","version":"1.0.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/available-typed-arrays/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/available-typed-arrays/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/available-typed-arrays/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/available-typed-arrays/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:available-typed-arrays:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available-typed-arrays:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed_arrays:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed_arrays:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available-typed:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available-typed:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available_typed:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:inspect-js:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available:available-typed-arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:available:available_typed_arrays:1.0.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/available-typed-arrays@1.0.7","metadataType":"javascript-npm-package","metadata":{"name":"available-typed-arrays","version":"1.0.7","author":"Jordan Harband ","homepage":"https://github.com/inspect-js/available-typed-arrays#readme","description":"Returns an array of Typed Array names that are available in the current environment","url":"git+https://github.com/inspect-js/available-typed-arrays.git","private":false}},{"id":"716281520579424d","name":"babel-walk","version":"3.0.0-canary-5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/babel-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/babel-walk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/babel-walk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/babel-walk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:babel-walk:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel-walk:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel_walk:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel_walk:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:babel:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pugjs:babel-walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pugjs:babel_walk:3.0.0-canary-5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/babel-walk@3.0.0-canary-5","metadataType":"javascript-npm-package","metadata":{"name":"babel-walk","version":"3.0.0-canary-5","author":"Timothy Gu ","homepage":"","description":"Lightweight Babel AST traversal","url":"https://github.com/pugjs/babel-walk.git","private":false}},{"id":"956658d078dc7d57","name":"balanced-match","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/balanced-match/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/balanced-match/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/balanced-match/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/balanced-match/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:balanced-match:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced-match:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced_match:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced_match:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced:balanced-match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:balanced:balanced_match:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/balanced-match@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"balanced-match","version":"1.0.2","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/balanced-match","description":"Match balanced character pairs, like \"{\" and \"}\"","url":"git://github.com/juliangruber/balanced-match.git","private":false}},{"id":"1921674c9fb6eba8","name":"base","version":"0.11.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:node-base:base:0.11.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base:base:0.11.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base@0.11.2","metadataType":"javascript-npm-package","metadata":{"name":"base","version":"0.11.2","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), John O'Donnell (https://github.com/criticalmash), Jon Schlinkert (http://twitter.com/jonschlinkert), tunnckoCore (https://i.am.charlike.online), , Brian Woodward (https://github.com/doowb), Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/node-base/base","description":"base is the foundation for creating modular, unit testable and highly pluggable node.js applications, starting with a handful of common methods, like `set`, `get`, `del` and `use`.","url":"node-base/base","private":false}},{"id":"c91bc2e84142f428","name":"base-files","version":"12.4+deb12u11","type":"deb","foundBy":"dpkg-db-cataloger","locations":[{"path":"/var/lib/dpkg/status.d/base-files","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/var/lib/dpkg/status.d/base-files","annotations":{"evidence":"primary"}},{"path":"/usr/share/doc/base-files/copyright","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/usr/share/doc/base-files/copyright","annotations":{"evidence":"supporting"}},{"path":"/var/lib/dpkg/status.d/base-files.md5sums","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/var/lib/dpkg/status.d/base-files.md5sums","annotations":{"evidence":"supporting"}}],"licenses":[{"value":"GPL","spdxExpression":"","type":"declared","urls":[],"locations":[{"path":"/usr/share/doc/base-files/copyright","layerID":"sha256:f464af4b9b251ebe8a7c2f186aff656f0892f6cb159837a6ce8fd63842e83e35","accessPath":"/usr/share/doc/base-files/copyright"}]}],"language":"","cpes":[{"cpe":"cpe:2.3:a:base-files:base-files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base-files:base_files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base_files:base-files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base_files:base_files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base:base-files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base:base_files:12.4\\+deb12u11:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:deb/debian/base-files@12.4%2Bdeb12u11?arch=amd64&distro=debian-12","metadataType":"dpkg-db-entry","metadata":{"package":"base-files","source":"","version":"12.4+deb12u11","sourceVersion":"","architecture":"amd64","maintainer":"Santiago Vila ","installedSize":341,"provides":["base"],"preDepends":["awk"],"files":[{"path":"/usr/lib/os-release","digest":{"algorithm":"md5","value":"07d31e7e63800ab1b7966980709c51eb"},"isConfigFile":false},{"path":"/usr/share/base-files/dot.bashrc","digest":{"algorithm":"md5","value":"0a540d50c157ed0070459b82c358a05a"},"isConfigFile":false},{"path":"/usr/share/base-files/dot.profile","digest":{"algorithm":"md5","value":"d68ce7c7d7d2bb7d48aeb2f137b828e4"},"isConfigFile":false},{"path":"/usr/share/base-files/dot.profile.md5sums","digest":{"algorithm":"md5","value":"6db82730e03aaeeecb8fee76b73d96d4"},"isConfigFile":false},{"path":"/usr/share/base-files/info.dir","digest":{"algorithm":"md5","value":"f9128f409878ce10d54d06488e3ce136"},"isConfigFile":false},{"path":"/usr/share/base-files/motd","digest":{"algorithm":"md5","value":"9830e3dbb6a828f2cc824db8db0ceaf7"},"isConfigFile":false},{"path":"/usr/share/base-files/profile","digest":{"algorithm":"md5","value":"48a30a427d1794feb49f102b87ddce2b"},"isConfigFile":false},{"path":"/usr/share/base-files/profile.md5sums","digest":{"algorithm":"md5","value":"9be77181dd5dcc2b87956e3d45ed191d"},"isConfigFile":false},{"path":"/usr/share/base-files/staff-group-for-usr-local","digest":{"algorithm":"md5","value":"f3b332b9a376a0567236f54d7d87f85e"},"isConfigFile":false},{"path":"/usr/share/common-licenses/Apache-2.0","digest":{"algorithm":"md5","value":"3b83ef96387f14655fc854ddc3c6bd57"},"isConfigFile":false},{"path":"/usr/share/common-licenses/Artistic","digest":{"algorithm":"md5","value":"f921793d03cc6d63ec4b15e9be8fd3f8"},"isConfigFile":false},{"path":"/usr/share/common-licenses/BSD","digest":{"algorithm":"md5","value":"3775480a712fc46a69647678acb234cb"},"isConfigFile":false},{"path":"/usr/share/common-licenses/CC0-1.0","digest":{"algorithm":"md5","value":"65d3616852dbf7b1a6d4b53b00626032"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GFDL-1.2","digest":{"algorithm":"md5","value":"cfe2a5472d5eaa226eae091d4114ce29"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GFDL-1.3","digest":{"algorithm":"md5","value":"a22d0be1ce2284b67950a4d1673dd1b0"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GPL-1","digest":{"algorithm":"md5","value":"5b122a36d0f6dc55279a0ebc69f3c60b"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GPL-2","digest":{"algorithm":"md5","value":"b234ee4d69f5fce4486a80fdaf4a4263"},"isConfigFile":false},{"path":"/usr/share/common-licenses/GPL-3","digest":{"algorithm":"md5","value":"1ebbd3e34237af26da5dc08a4e440464"},"isConfigFile":false},{"path":"/usr/share/common-licenses/LGPL-2","digest":{"algorithm":"md5","value":"4cf66a4984120007c9881cc871cf49db"},"isConfigFile":false},{"path":"/usr/share/common-licenses/LGPL-2.1","digest":{"algorithm":"md5","value":"4fbd65380cdd255951079008b364516c"},"isConfigFile":false},{"path":"/usr/share/common-licenses/LGPL-3","digest":{"algorithm":"md5","value":"3000208d539ec061b899bce1d9ce9404"},"isConfigFile":false},{"path":"/usr/share/common-licenses/MPL-1.1","digest":{"algorithm":"md5","value":"0c5913925d40b124fb52ce84c5deb3f3"},"isConfigFile":false},{"path":"/usr/share/common-licenses/MPL-2.0","digest":{"algorithm":"md5","value":"815ca599c9df247a0c7f619bab123dad"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/README","digest":{"algorithm":"md5","value":"af032ddc1821dfc3eb1dbb5883910119"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/README.FHS","digest":{"algorithm":"md5","value":"fbd937e067f0a83fb9422713a6b84a8a"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/changelog.gz","digest":{"algorithm":"md5","value":"3fa5ee8dc0d994cdc2c4f7022606f81e"},"isConfigFile":false},{"path":"/usr/share/doc/base-files/copyright","digest":{"algorithm":"md5","value":"1b8bb96d42614948cb7de2882e191734"},"isConfigFile":false},{"path":"/usr/share/lintian/overrides/base-files","digest":{"algorithm":"md5","value":"9dbaaf7a8333c30200f3d11e831acb82"},"isConfigFile":false}]}},{"id":"7b4063d10599bfae","name":"base64-arraybuffer","version":"0.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64-arraybuffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-arraybuffer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64-arraybuffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-arraybuffer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:base64-arraybuffer:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-arraybuffer:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_arraybuffer:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_arraybuffer:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:niklasvh:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:niklasvh:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64-arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64_arraybuffer:0.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64-arraybuffer@0.1.4","metadataType":"javascript-npm-package","metadata":{"name":"base64-arraybuffer","version":"0.1.4","author":"Niklas von Hertzen (http://hertzen.com)","homepage":"https://github.com/niklasvh/base64-arraybuffer","description":"Encode/decode base64 data into ArrayBuffers","url":"https://github.com/niklasvh/base64-arraybuffer","private":false}},{"id":"6f1f1a7796cb63d0","name":"base64-js","version":"0.0.8","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/linebreak/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:beatgammit:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beatgammit:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64-js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64_js:0.0.8:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64-js@0.0.8","metadataType":"javascript-npm-package","metadata":{"name":"base64-js","version":"0.0.8","author":"T. Jameson Little ","homepage":"","description":"Base64 encoding/decoding in pure JS","url":"git://github.com/beatgammit/base64-js.git","private":false}},{"id":"c493a9a41b36da0b","name":"base64-js","version":"1.5.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:beatgammit:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beatgammit:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64-js:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64_js:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64-js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64:base64_js:1.5.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64-js@1.5.1","metadataType":"javascript-npm-package","metadata":{"name":"base64-js","version":"1.5.1","author":"T. Jameson Little ","homepage":"https://github.com/beatgammit/base64-js","description":"Base64 encoding/decoding in pure JS","url":"git://github.com/beatgammit/base64-js.git","private":false}},{"id":"d1750eb90689f1a4","name":"base64id","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64id/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64id/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64id/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64id/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:base64id:base64id:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:faeldt:base64id:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64id@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"base64id","version":"2.0.0","author":"Kristian Faeldt ","homepage":"","description":"Generates a base64 id","url":"https://github.com/faeldt/base64id.git","private":false}},{"id":"2f8a9d6c7656ba10","name":"base64url","version":"0.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/base64url/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64url/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/base64url/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/base64url/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brianloveswords:base64url:0.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:base64url:base64url:0.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/base64url@0.0.6","metadataType":"javascript-npm-package","metadata":{"name":"base64url","version":"0.0.6","author":"Brian J Brennan","homepage":"","description":"For encoding to/from base64urls","url":"git://github.com/brianloveswords/base64url.git","private":false}},{"id":"580ca5f2beaae938","name":"basic-auth","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/morgan/node_modules/basic-auth/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:basic-auth:basic-auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic-auth:basic_auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic_auth:basic-auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic_auth:basic_auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic:basic-auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:basic:basic_auth:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/basic-auth@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"basic-auth","version":"2.0.1","author":"","homepage":"","description":"node.js basic auth parser","url":"jshttp/basic-auth","private":false}},{"id":"344c43aaf43bb8dc","name":"batch","version":"0.6.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/batch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/batch/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/batch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/batch/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:visionmedia:batch:0.6.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:batch:batch:0.6.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/batch@0.6.1","metadataType":"javascript-npm-package","metadata":{"name":"batch","version":"0.6.1","author":"TJ Holowaychuk ","homepage":"","description":"Simple async batch with concurrency control and progress reporting.","url":"https://github.com/visionmedia/batch.git","private":false}},{"id":"99a08ef6ddd74ba7","name":"baz","version":"UNKNOWN","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/baz/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/baz/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:baz:baz:*:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/baz","metadataType":"javascript-npm-package","metadata":{"name":"baz","version":"","author":"","homepage":"","description":"","url":"","private":false}},{"id":"ac8f35c9bc6d4edc","name":"beep-boop","version":"1.2.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/github-from-package/example/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/github-from-package/example/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:beep-boop:beep-boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep-boop:beep_boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep_boop:beep-boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep_boop:beep_boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep:beep-boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:beep:beep_boop:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/beep-boop@1.2.3","metadataType":"javascript-npm-package","metadata":{"name":"beep-boop","version":"1.2.3","author":"","homepage":"","description":"","url":"git@github.com:substack/beep-boop.git","private":false}},{"id":"6efaee3d2e9117ff","name":"big-integer","version":"1.6.52","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/big-integer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/big-integer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"Unlicense","spdxExpression":"Unlicense","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/big-integer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/big-integer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:big-integer:big-integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big-integer:big_integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big_integer:big-integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big_integer:big_integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big:big-integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:big:big_integer:1.6.52:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/big-integer@1.6.52","metadataType":"javascript-npm-package","metadata":{"name":"big-integer","version":"1.6.52","author":"Peter Olson ","homepage":"","description":"An arbitrary length integer library for Javascript","url":"git@github.com:peterolson/BigInteger.js.git","private":false}},{"id":"aac28aacec14e6f2","name":"binary","version":"0.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/binary/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/binary/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:substack:binary:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary:binary:0.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/binary@0.3.0","metadataType":"javascript-npm-package","metadata":{"name":"binary","version":"0.3.0","author":"James Halliday (http://substack.net)","homepage":"","description":"Unpack multibyte binary values from buffers","url":"http://github.com/substack/node-binary.git","private":false}},{"id":"cdea7c486a93d741","name":"binary-extensions","version":"2.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/binary-extensions/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary-extensions/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/binary-extensions/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/binary-extensions/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:binary-extensions:binary-extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary-extensions:binary_extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary_extensions:binary-extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary_extensions:binary_extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary:binary-extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:binary:binary_extensions:2.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/binary-extensions@2.3.0","metadataType":"javascript-npm-package","metadata":{"name":"binary-extensions","version":"2.3.0","author":"Sindre Sorhus (https://sindresorhus.com)","homepage":"","description":"List of binary file extensions","url":"sindresorhus/binary-extensions","private":false}},{"id":"848e919a5348c76e","name":"bindings","version":"1.5.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bindings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bindings/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bindings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bindings/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:TooTallNate:bindings:1.5.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bindings:bindings:1.5.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bindings@1.5.0","metadataType":"javascript-npm-package","metadata":{"name":"bindings","version":"1.5.0","author":"Nathan Rajlich (http://tootallnate.net)","homepage":"https://github.com/TooTallNate/node-bindings","description":"Helper module for loading your native module's .node file","url":"git://github.com/TooTallNate/node-bindings.git","private":false}},{"id":"db53f4ebaee4e2cf","name":"bintrees","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bintrees/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bintrees/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bintrees/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bintrees/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:bintrees:bintrees:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:vadimg:bintrees:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bintrees@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"bintrees","version":"1.0.2","author":"Vadim Graboys ","homepage":"","description":"Binary Search Trees","url":"git://github.com/vadimg/js_bintrees.git","private":false}},{"id":"1d71c68896a44c86","name":"bl","version":"1.2.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bl/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bl/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:rvagg:bl:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bl:bl:1.2.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bl@1.2.3","metadataType":"javascript-npm-package","metadata":{"name":"bl","version":"1.2.3","author":"Rod Vagg (https://github.com/rvagg), Matteo Collina (https://github.com/mcollina), Jarett Cruger (https://github.com/jcrugzz)","homepage":"https://github.com/rvagg/bl","description":"Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!","url":"https://github.com/rvagg/bl.git","private":false}},{"id":"846a0edd607229fd","name":"bl","version":"4.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/bl/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:rvagg:bl:4.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bl:bl:4.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bl@4.1.0","metadataType":"javascript-npm-package","metadata":{"name":"bl","version":"4.1.0","author":"Rod Vagg (https://github.com/rvagg), Matteo Collina (https://github.com/mcollina), Jarett Cruger (https://github.com/jcrugzz)","homepage":"https://github.com/rvagg/bl","description":"Buffer List: collect buffers and access with a standard readable Buffer interface, streamable too!","url":"https://github.com/rvagg/bl.git","private":false}},{"id":"441b568aa058ddd4","name":"bluebird","version":"3.4.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/unzipper/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:petkaantonov:bluebird:3.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bluebird:bluebird:3.4.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bluebird@3.4.7","metadataType":"javascript-npm-package","metadata":{"name":"bluebird","version":"3.4.7","author":"Petka Antonov (http://github.com/petkaantonov/)","homepage":"https://github.com/petkaantonov/bluebird","description":"Full featured Promises/A+ implementation with exceptionally good performance","url":"git://github.com/petkaantonov/bluebird.git","private":false}},{"id":"45ec017cc93f373c","name":"bluebird","version":"3.7.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bluebird/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bluebird/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:petkaantonov:bluebird:3.7.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bluebird:bluebird:3.7.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bluebird@3.7.2","metadataType":"javascript-npm-package","metadata":{"name":"bluebird","version":"3.7.2","author":"Petka Antonov (http://github.com/petkaantonov/)","homepage":"https://github.com/petkaantonov/bluebird","description":"Full featured Promises/A+ implementation with exceptionally good performance","url":"git://github.com/petkaantonov/bluebird.git","private":false}},{"id":"d8348f0566c46229","name":"body-parser","version":"1.20.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/body-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/body-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:openjsf:body-parser:1.20.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/body-parser@1.20.3","metadataType":"javascript-npm-package","metadata":{"name":"body-parser","version":"1.20.3","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com)","homepage":"","description":"Node.js body parsing middleware","url":"expressjs/body-parser","private":false}},{"id":"2c560d35b75226b0","name":"bower-config","version":"1.4.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bower-config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bower-config/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bower-config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bower-config/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:bower-config:bower-config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower-config:bower_config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower_config:bower-config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower_config:bower_config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower:bower-config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:bower:bower_config:1.4.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bower-config@1.4.3","metadataType":"javascript-npm-package","metadata":{"name":"bower-config","version":"1.4.3","author":"Twitter","homepage":"http://bower.io","description":"The Bower config reader and writer.","url":"https://github.com/bower/bower/tree/master/packages/bower-config","private":false}},{"id":"79ca6b57cb6da8f4","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver-utils/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"edfc435f78ffbb1c","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/archiver/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"38ff028c7c458475","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/file-js/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"c861e69821b6b8fe","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/fstream/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"70266c742ac992ba","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"e9b43263265b984a","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ignore-walk/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"28fb5bb71047516a","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"098d823421bc1197","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"17d5b1f1f2c265c0","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/rimraf/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"ec01b45e50a80fc7","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"204df6e1c0323307","name":"brace-expansion","version":"1.1.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/ts-node-dev/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:1.1.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@1.1.12","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"1.1.12","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"1fcda56aa7b9b39c","name":"brace-expansion","version":"2.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/brace-expansion/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brace-expansion/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brace-expansion:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace-expansion:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace_expansion:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:juliangruber:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace-expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brace:brace_expansion:2.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brace-expansion@2.0.2","metadataType":"javascript-npm-package","metadata":{"name":"brace-expansion","version":"2.0.2","author":"Julian Gruber (http://juliangruber.com)","homepage":"https://github.com/juliangruber/brace-expansion","description":"Brace expansion as known from sh/bash","url":"git://github.com/juliangruber/brace-expansion.git","private":false}},{"id":"e18c817c2057c675","name":"braces","version":"2.3.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:2.3.2:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"},{"cpe":"cpe:2.3:a:jonschlinkert:braces:2.3.2:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@2.3.2","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"2.3.2","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"1fea4d70444c02f0","name":"braces","version":"3.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"},{"cpe":"cpe:2.3:a:jonschlinkert:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@3.0.3","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"3.0.3","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"05e4a42f1d20184c","name":"braces","version":"3.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"},{"cpe":"cpe:2.3:a:jonschlinkert:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@3.0.3","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"3.0.3","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"7300fec6ea68a472","name":"braces","version":"3.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/liftup/node_modules/braces/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:braces_project:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"},{"cpe":"cpe:2.3:a:jonschlinkert:braces:3.0.3:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/braces@3.0.3","metadataType":"javascript-npm-package","metadata":{"name":"braces","version":"3.0.3","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Elan Shanker (https://github.com/es128), Eugene Sharygin (https://github.com/eush77), hemanth.hm (http://h3manth.com), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/micromatch/braces","description":"Bash-like brace expansion, implemented in JavaScript. Safer than other brace expansion libs, with complete support for the Bash 4.3 braces specification, without sacrificing speed.","url":"micromatch/braces","private":false}},{"id":"470bc485996d4bbe","name":"brotli","version":"1.3.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/brotli/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brotli/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/brotli/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/brotli/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:devongovett:brotli:1.3.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brotli:brotli:1.3.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/brotli@1.3.3","metadataType":"javascript-npm-package","metadata":{"name":"brotli","version":"1.3.3","author":"Devon Govett ","homepage":"https://github.com/devongovett/brotli.js","description":"A port of the Brotli compression algorithm as used in WOFF2","url":"https://github.com/devongovett/brotli.js.git","private":false}},{"id":"0ec800aec91252a5","name":"browser_field","version":"UNKNOWN","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/resolve/test/resolver/browser_field/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/resolve/test/resolver/browser_field/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:browser-field:browser-field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser-field:browser_field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser_field:browser-field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser_field:browser_field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser:browser-field:*:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:browser:browser_field:*:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/browser_field","metadataType":"javascript-npm-package","metadata":{"name":"browser_field","version":"","author":"","homepage":"","description":"","url":"","private":false}},{"id":"8160d61272f16fc2","name":"buffer","version":"5.7.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer:buffer:5.7.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:feross:buffer:5.7.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer@5.7.1","metadataType":"javascript-npm-package","metadata":{"name":"buffer","version":"5.7.1","author":"Feross Aboukhadijeh (https://feross.org), Romain Beauxis , James Halliday ","homepage":"https://github.com/feross/buffer","description":"Node.js Buffer API, for the browser","url":"git://github.com/feross/buffer.git","private":false}},{"id":"b34920cb2184e6ad","name":"buffer","version":"6.0.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/readable-web-to-node-stream/node_modules/buffer/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer:buffer:6.0.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:feross:buffer:6.0.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer@6.0.3","metadataType":"javascript-npm-package","metadata":{"name":"buffer","version":"6.0.3","author":"Feross Aboukhadijeh (https://feross.org), Romain Beauxis , James Halliday ","homepage":"https://github.com/feross/buffer","description":"Node.js Buffer API, for the browser","url":"git://github.com/feross/buffer.git","private":false}},{"id":"0215db4a4aa6cd05","name":"buffer-alloc","version":"1.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-alloc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-alloc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-alloc:buffer-alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc:buffer_alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer-alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer_alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_alloc:1.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-alloc@1.2.0","metadataType":"javascript-npm-package","metadata":{"name":"buffer-alloc","version":"1.2.0","author":"","homepage":"","description":"","url":"LinusU/buffer-alloc","private":false}},{"id":"72525885a05217f9","name":"buffer-alloc-unsafe","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-alloc-unsafe/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-alloc-unsafe:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc-unsafe:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc_unsafe:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc_unsafe:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-alloc:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_alloc:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-alloc-unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_alloc_unsafe:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-alloc-unsafe@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"buffer-alloc-unsafe","version":"1.1.0","author":"","homepage":"","description":"","url":"LinusU/buffer-alloc-unsafe","private":false}},{"id":"018e707480d9a394","name":"buffer-crc32","version":"0.2.13","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-crc32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-crc32/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-crc32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-crc32/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:brianloveswords:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brianloveswords:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-crc32:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-crc32:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_crc32:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_crc32:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_crc32:0.2.13:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-crc32@0.2.13","metadataType":"javascript-npm-package","metadata":{"name":"buffer-crc32","version":"0.2.13","author":"Brian J. Brennan , Vladimir Kuznetsov","homepage":"https://github.com/brianloveswords/buffer-crc32","description":"A pure javascript CRC32 algorithm that plays nice with binary data","url":"git://github.com/brianloveswords/buffer-crc32.git","private":false}},{"id":"b5b4b05d23ef0590","name":"buffer-fill","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-fill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-fill/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-fill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-fill/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-fill:buffer-fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-fill:buffer_fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_fill:buffer-fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_fill:buffer_fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_fill:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-fill@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"buffer-fill","version":"1.0.0","author":"","homepage":"","description":"","url":"LinusU/buffer-fill","private":false}},{"id":"d2869a97005ddd30","name":"buffer-from","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-from/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-from/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-from/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-from/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-from:buffer-from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-from:buffer_from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_from:buffer-from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_from:buffer_from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_from:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-from@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"buffer-from","version":"1.1.2","author":"","homepage":"","description":"","url":"LinusU/buffer-from","private":false}},{"id":"08bc6bd9a895200f","name":"buffer-indexof-polyfill","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffer-indexof-polyfill/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:buffer-indexof-polyfill:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-indexof-polyfill:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof_polyfill:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof_polyfill:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-indexof:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer-indexof:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer_indexof:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sarosia:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sarosia:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer-indexof-polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffer:buffer_indexof_polyfill:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffer-indexof-polyfill@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"buffer-indexof-polyfill","version":"1.0.2","author":"https://github.com/sarosia","homepage":"https://github.com/sarosia/buffer-indexof-polyfill#readme","description":"This is a polyfill for Buffer#indexOf introduced in NodeJS 4.0.","url":"git+https://github.com/sarosia/buffer-indexof-polyfill.git","private":false}},{"id":"fd60bbd17e6803d8","name":"buffers","version":"0.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/buffers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/buffers/package.json","annotations":{"evidence":"primary"}}],"licenses":[],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:substack:buffers:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:buffers:buffers:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/buffers@0.1.1","metadataType":"javascript-npm-package","metadata":{"name":"buffers","version":"0.1.1","author":"James Halliday (http://substack.net)","homepage":"","description":"Treat a collection of Buffers as a single contiguous partially mutable Buffer.","url":"http://github.com/substack/node-buffers.git","private":false}},{"id":"72b84630ff8aade7","name":"busboy","version":"1.6.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/busboy/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/busboy/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/busboy/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/busboy/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:busboy:busboy:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mscdex:busboy:1.6.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/busboy@1.6.0","metadataType":"javascript-npm-package","metadata":{"name":"busboy","version":"1.6.0","author":"Brian White ","homepage":"","description":"A streaming parser for HTML form data for node.js","url":"http://github.com/mscdex/busboy.git","private":false}},{"id":"1db66371bc7880de","name":"byline","version":"4.2.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/byline/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/byline/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/byline/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/byline/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jahewson:byline:4.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:byline:byline:4.2.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/byline@4.2.2","metadataType":"javascript-npm-package","metadata":{"name":"byline","version":"4.2.2","author":"John Hewson","homepage":"https://github.com/jahewson/node-byline","description":"simple line-by-line stream reader","url":"https://github.com/jahewson/node-byline","private":false}},{"id":"1d0cce2090c4dc09","name":"bytes","version":"3.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/bytes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bytes/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/bytes/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/bytes/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:bytes:bytes:3.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/bytes@3.1.2","metadataType":"javascript-npm-package","metadata":{"name":"bytes","version":"3.1.2","author":"TJ Holowaychuk (http://tjholowaychuk.com), Jed Watson , Théo FIDRY ","homepage":"","description":"Utility to parse a string bytes to bytes and vice-versa","url":"visionmedia/bytes.js","private":false}},{"id":"f5c0681a2e946e2d","name":"cacache","version":"15.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cacache:cacache:15.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:npm:cacache:15.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cacache@15.3.0","metadataType":"javascript-npm-package","metadata":{"name":"cacache","version":"15.3.0","author":"","homepage":"","description":"Fast, fault-tolerant, cross-platform, disk-based, data-agnostic, content-addressable cache.","url":"https://github.com/npm/cacache","private":false}},{"id":"ace0af3ce948f36b","name":"cacache","version":"19.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cacache/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacache/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cacache:cacache:19.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cacache@19.0.1","metadataType":"javascript-npm-package","metadata":{"name":"cacache","version":"19.0.1","author":"GitHub Inc.","homepage":"","description":"Fast, fault-tolerant, cross-platform, disk-based, data-agnostic, content-addressable cache.","url":"git+https://github.com/npm/cacache.git","private":false}},{"id":"baaa5d54fe4a3c13","name":"cache-base","version":"1.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cache-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cache-base/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cache-base/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cache-base/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cache-base_project:cache-base:1.0.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/cache-base@1.0.1","metadataType":"javascript-npm-package","metadata":{"name":"cache-base","version":"1.0.1","author":"Jon Schlinkert (https://github.com/jonschlinkert), Jon Schlinkert (http://twitter.com/jonschlinkert), ","homepage":"https://github.com/jonschlinkert/cache-base","description":"Basic object cache with `get`, `set`, `del`, and `has` methods for node.js/javascript projects.","url":"jonschlinkert/cache-base","private":false}},{"id":"346e1627c1f72870","name":"cacheable-request","version":"2.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cacheable-request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacheable-request/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cacheable-request/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cacheable-request/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cacheable-request:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable-request:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable_request:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable_request:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable:cacheable-request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cacheable:cacheable_request:2.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cacheable-request@2.1.4","metadataType":"javascript-npm-package","metadata":{"name":"cacheable-request","version":"2.1.4","author":"Luke Childs (http://lukechilds.co.uk)","homepage":"https://github.com/lukechilds/cacheable-request","description":"Wrap native HTTP requests with RFC compliant cache support","url":"git+https://github.com/lukechilds/cacheable-request.git","private":false}},{"id":"b538562043029461","name":"call-bind","version":"1.0.8","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/call-bind/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/call-bind/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:call-bind:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call-bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call_bind:1.0.8:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/call-bind@1.0.8","metadataType":"javascript-npm-package","metadata":{"name":"call-bind","version":"1.0.8","author":"Jordan Harband ","homepage":"https://github.com/ljharb/call-bind#readme","description":"Robustly `.call.bind()` a function","url":"git+https://github.com/ljharb/call-bind.git","private":false}},{"id":"0d18b02f5378691f","name":"call-bind-apply-helpers","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bind-apply-helpers/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:call-bind-apply-helpers:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind-apply-helpers:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply_helpers:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply_helpers:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind-apply:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind-apply:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind_apply:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bind:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bind:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call-bind-apply-helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call_bind_apply_helpers:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/call-bind-apply-helpers@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"call-bind-apply-helpers","version":"1.0.2","author":"Jordan Harband ","homepage":"https://github.com/ljharb/call-bind-apply-helpers#readme","description":"Helper functions around Function call/apply/bind, for use in `call-bind`","url":"git+https://github.com/ljharb/call-bind-apply-helpers.git","private":false}},{"id":"44af6e189fe32d87","name":"call-bound","version":"1.0.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/call-bound/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bound/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/call-bound/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/call-bound/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:call-bound:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call-bound:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bound:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call_bound:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ljharb:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call-bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:call:call_bound:1.0.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/call-bound@1.0.4","metadataType":"javascript-npm-package","metadata":{"name":"call-bound","version":"1.0.4","author":"Jordan Harband ","homepage":"https://github.com/ljharb/call-bound#readme","description":"Robust call-bound JavaScript intrinsics, using `call-bind` and `get-intrinsic`.","url":"git+https://github.com/ljharb/call-bound.git","private":false}},{"id":"92e4f8e8e365d6ef","name":"camelcase","version":"5.3.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/camelcase/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/camelcase/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/camelcase/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/camelcase/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:camelcase:camelcase:5.3.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/camelcase@5.3.1","metadataType":"javascript-npm-package","metadata":{"name":"camelcase","version":"5.3.1","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Convert a dash/dot/underscore/space separated string to camelCase or PascalCase: `foo-bar` → `fooBar`","url":"sindresorhus/camelcase","private":false}},{"id":"6e4c3d3622249d54","name":"chainsaw","version":"0.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chainsaw/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chainsaw/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT/X11","spdxExpression":"","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chainsaw/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chainsaw/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chainsaw:chainsaw:0.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:substack:chainsaw:0.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chainsaw@0.1.0","metadataType":"javascript-npm-package","metadata":{"name":"chainsaw","version":"0.1.0","author":"James Halliday (http://substack.net)","homepage":"","description":"Build chainable fluent interfaces the easy way... with a freakin' chainsaw!","url":"http://github.com/substack/node-chainsaw.git","private":false}},{"id":"af9826c69b6847f8","name":"chalk","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-contrib-compress/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chalk:chalk:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chalk@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"chalk","version":"1.1.3","author":"Sindre Sorhus (sindresorhus.com), Joshua Appelman (jbnicolai.com), JD Ballard (github.com/qix-)","homepage":"","description":"Terminal string styling done right. Much color.","url":"chalk/chalk","private":false}},{"id":"015bdd0e54562d25","name":"chalk","version":"2.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chalk:chalk:2.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chalk@2.4.2","metadataType":"javascript-npm-package","metadata":{"name":"chalk","version":"2.4.2","author":"","homepage":"","description":"Terminal string styling done right","url":"chalk/chalk","private":false}},{"id":"7fe24d7225fc8b9a","name":"chalk","version":"4.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/chalk/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chalk:chalk:4.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chalk@4.1.2","metadataType":"javascript-npm-package","metadata":{"name":"chalk","version":"4.1.2","author":"","homepage":"","description":"Terminal string styling done right","url":"chalk/chalk","private":false}},{"id":"34bd9ccc72e70b6f","name":"character-parser","version":"2.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/character-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/character-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/character-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/character-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:character-parser:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character-parser:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character_parser:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character_parser:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ForbesLindesay:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:ForbesLindesay:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character:character-parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:character:character_parser:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/character-parser@2.2.0","metadataType":"javascript-npm-package","metadata":{"name":"character-parser","version":"2.2.0","author":"ForbesLindesay","homepage":"","description":"Parse JavaScript one character at a time to look for snippets in Templates. This is not a validator, it's just designed to allow you to have sections of JavaScript delimited by brackets robustly.","url":"https://github.com/ForbesLindesay/character-parser.git","private":false}},{"id":"0eb2e961c16ff8ae","name":"check-dependencies","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/check-dependencies/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-dependencies/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/check-dependencies/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-dependencies/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:check-dependencies:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-dependencies:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_dependencies:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_dependencies:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mgol:check-dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:mgol:check_dependencies:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/check-dependencies@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"check-dependencies","version":"1.1.1","author":"Michał Gołębiowski-Owczarek ","homepage":"https://github.com/mgol/check-dependencies","description":"Checks if currently installed npm/bower dependencies are installed in the exact same versions that are specified in package.json/bower.json","url":"https://github.com/mgol/check-dependencies.git","private":false}},{"id":"c843870ea5cc0a9b","name":"check-internet-connected","version":"2.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/check-internet-connected/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-internet-connected/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/check-internet-connected/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-internet-connected/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:check-internet-connected:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-internet-connected:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet_connected:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet_connected:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-internet:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-internet:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_internet:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aankur:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:aankur:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check-internet-connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check_internet_connected:2.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/check-internet-connected@2.0.6","metadataType":"javascript-npm-package","metadata":{"name":"check-internet-connected","version":"2.0.6","author":"Ankur Deep Jaiswal ","homepage":"https://github.com/aankur/check-internet-connected","description":"Utility to check if internet is connected or not","url":"aankur/check-internet-connected","private":false}},{"id":"85b9eff83ffcd831","name":"check-types","version":"6.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/check-types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-types/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/check-types/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/check-types/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:check-types:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check-types:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_types:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check_types:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:philbooth:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:philbooth:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check-types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:check:check_types:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/check-types@6.0.0","metadataType":"javascript-npm-package","metadata":{"name":"check-types","version":"6.0.0","author":"Phil Booth (https://github.com/philbooth)","homepage":"https://github.com/philbooth/check-types.js","description":"A little library for asserting types and values.","url":"https://github.com/philbooth/check-types.js.git","private":false}},{"id":"4d185a05cefa7d0a","name":"chokidar","version":"3.5.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chokidar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chokidar/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chokidar/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:paulmillr:chokidar:3.5.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:chokidar:chokidar:3.5.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chokidar@3.5.1","metadataType":"javascript-npm-package","metadata":{"name":"chokidar","version":"3.5.1","author":"Paul Miller (https://paulmillr.com), Paul Miller (https://paulmillr.com), Elan Shanker","homepage":"https://github.com/paulmillr/chokidar","description":"Minimal and efficient cross-platform file watching library","url":"git+https://github.com/paulmillr/chokidar.git","private":false}},{"id":"7ebcfb2902378122","name":"chownr","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/node-pre-gyp/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"1.1.4","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"671f64716b19d5fb","name":"chownr","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/tar-fs/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"1.1.4","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"3189617deb2bc884","name":"chownr","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/sqlite3/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"2.0.0","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"fffff6468e7930c0","name":"chownr","version":"3.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"BlueOak-1.0.0","spdxExpression":"BlueOak-1.0.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/chownr/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/chownr/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:chownr:chownr:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:chownr:3.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/chownr@3.0.0","metadataType":"javascript-npm-package","metadata":{"name":"chownr","version":"3.0.0","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"like `chown -R`","url":"git://github.com/isaacs/chownr.git","private":false}},{"id":"6cef1d3c36e6024e","name":"clarinet","version":"0.12.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clarinet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clarinet/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"BSD-2-Clause","spdxExpression":"BSD-2-Clause","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clarinet/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clarinet/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clarinet:clarinet:0.12.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:dscape:clarinet:0.12.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clarinet@0.12.6","metadataType":"javascript-npm-package","metadata":{"name":"clarinet","version":"0.12.6","author":"Nuno Job (http://nunojob.com/), Jann Horn (https://github.com/thejh), Justin Makeig (http://www.audiblepop.com), Roly Fentanes (http://about.me/roly), John Lancaster (http://jlank.com)","homepage":"https://github.com/dscape/clarinet","description":"SAX based evented streaming JSON parser in JavaScript (browser and node)","url":"http://github.com/dscape/clarinet.git","private":false}},{"id":"a7e36e39ff61aea5","name":"class-utils","version":"0.3.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/class-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/class-utils/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/class-utils/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/class-utils/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:jonschlinkert:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class-utils:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class-utils:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class_utils:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class_utils:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class:class-utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:class:class_utils:0.3.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/class-utils@0.3.6","metadataType":"javascript-npm-package","metadata":{"name":"class-utils","version":"0.3.6","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Jon Schlinkert (http://twitter.com/jonschlinkert), ","homepage":"https://github.com/jonschlinkert/class-utils","description":"Utils for working with JavaScript classes and prototype methods.","url":"jonschlinkert/class-utils","private":false}},{"id":"08eaf1d1a1378cc5","name":"clean-stack","version":"2.2.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clean-stack/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clean-stack/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clean-stack/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clean-stack/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clean-stack:clean-stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean-stack:clean_stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean_stack:clean-stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean_stack:clean_stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean:clean-stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clean:clean_stack:2.2.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clean-stack@2.2.0","metadataType":"javascript-npm-package","metadata":{"name":"clean-stack","version":"2.2.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"Clean up error stack traces","url":"sindresorhus/clean-stack","private":false}},{"id":"6fb115e3b5d5d3f2","name":"cliui","version":"6.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/cliui/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cliui:cliui:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:yargs:cliui:6.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cliui@6.0.0","metadataType":"javascript-npm-package","metadata":{"name":"cliui","version":"6.0.0","author":"Ben Coe ","homepage":"","description":"easily create complex multi-column command-line-interfaces","url":"http://github.com/yargs/cliui.git","private":false}},{"id":"080e255664d33bc7","name":"clone","version":"2.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clone/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clone/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clone:clone:2.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:pvorb:clone:2.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clone@2.1.2","metadataType":"javascript-npm-package","metadata":{"name":"clone","version":"2.1.2","author":"Paul Vorbach (http://paul.vorba.ch/), Blake Miner (http://www.blakeminer.com/), Tian You (http://blog.axqd.net/), George Stagas (http://stagas.com/), Tobiasz Cudnik (https://github.com/TobiaszCudnik), Pavel Lang (https://github.com/langpavel), Dan MacTough (http://yabfog.com/), w1nk (https://github.com/w1nk), Hugh Kennedy (http://twitter.com/hughskennedy), Dustin Diaz (http://dustindiaz.com), Ilya Shaisultanov (https://github.com/diversario), Nathan MacInnes (http://macinn.es/), Benjamin E. Coe (https://twitter.com/benjamincoe), Nathan Zadoks (https://github.com/nathan7), Róbert Oroszi (https://github.com/oroce), Aurélio A. Heckert (http://softwarelivre.org/aurium), Guy Ellis (http://www.guyellisrocks.com/), fscherwi (https://fscherwi.github.io), rictic (https://github.com/rictic), Martin Jurča (https://github.com/jurca), Misery Lee (https://github.com/miserylee), Clemens Wolff (https://github.com/c-w)","homepage":"","description":"deep cloning of objects and arrays","url":"git://github.com/pvorb/node-clone.git","private":false}},{"id":"1ca687973f79cd5a","name":"clone-response","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/clone-response/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone-response/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/clone-response/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/clone-response/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:clone-response:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone-response:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone_response:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone_response:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:lukechilds:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone:clone-response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:clone:clone_response:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/clone-response@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"clone-response","version":"1.0.2","author":"Luke Childs (http://lukechilds.co.uk)","homepage":"https://github.com/lukechilds/clone-response","description":"Clone a Node.js HTTP response stream","url":"git+https://github.com/lukechilds/clone-response.git","private":false}},{"id":"15db8f5283662b54","name":"code-point-at","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/code-point-at/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/code-point-at/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/code-point-at/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/code-point-at/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:code-point-at:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code-point-at:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point_at:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point_at:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code-point:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code-point:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code_point:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code:code-point-at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:code:code_point_at:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/code-point-at@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"code-point-at","version":"1.1.0","author":"Sindre Sorhus (sindresorhus.com)","homepage":"","description":"ES2015 `String#codePointAt()` ponyfill","url":"sindresorhus/code-point-at","private":false}},{"id":"d87950bd24d66a30","name":"collection-visit","version":"1.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/collection-visit/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/collection-visit/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/collection-visit/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/collection-visit/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:collection-visit:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection-visit:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection_visit:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection_visit:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection:collection-visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:collection:collection_visit:1.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/collection-visit@1.0.0","metadataType":"javascript-npm-package","metadata":{"name":"collection-visit","version":"1.0.0","author":"Jon Schlinkert (https://github.com/jonschlinkert), Brian Woodward (https://twitter.com/doowb), Jon Schlinkert (http://twitter.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/collection-visit","description":"Visit a method over the items in an object, or map visit over the objects in an array.","url":"jonschlinkert/collection-visit","private":false}},{"id":"2774fa6f21932145","name":"color","version":"3.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color:color:3.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color@3.2.1","metadataType":"javascript-npm-package","metadata":{"name":"color","version":"3.2.1","author":"Josh Junon , Heather Arthur , Maxime Thirouin","homepage":"","description":"Color conversion and manipulation with CSS string support","url":"Qix-/color","private":false}},{"id":"832fbb197a382df6","name":"color-convert","version":"1.9.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:1.9.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@1.9.3","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"1.9.3","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"ad73ceb607fdd321","name":"color-convert","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"2.0.1","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"c216a258a2dd7fdf","name":"color-convert","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"2.0.1","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"d7906a8074d4b4f9","name":"color-convert","version":"2.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-convert/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_convert:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_convert:2.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-convert@2.0.1","metadataType":"javascript-npm-package","metadata":{"name":"color-convert","version":"2.0.1","author":"Heather Arthur ","homepage":"","description":"Plain color conversion functions","url":"Qix-/color-convert","private":false}},{"id":"92662d8a3adbe0c9","name":"color-name","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:dfcreative:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:dfcreative:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.3","author":"DY ","homepage":"https://github.com/dfcreative/color-name","description":"A list of color names and its values","url":"git@github.com:dfcreative/color-name.git","private":false}},{"id":"a184510682ce4734","name":"color-name","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log-utils/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.4","author":"DY ","homepage":"https://github.com/colorjs/color-name","description":"A list of color names and its values","url":"git@github.com:colorjs/color-name.git","private":false}},{"id":"a80b99ad61e48555","name":"color-name","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/replace/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.4","author":"DY ","homepage":"https://github.com/colorjs/color-name","description":"A list of color names and its values","url":"git@github.com:colorjs/color-name.git","private":false}},{"id":"01c750f52978cfc6","name":"color-name","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/wrap-ansi-cjs/node_modules/color-name/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_name:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:colorjs:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_name:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-name@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"color-name","version":"1.1.4","author":"DY ","homepage":"https://github.com/colorjs/color-name","description":"A list of color names and its values","url":"git@github.com:colorjs/color-name.git","private":false}},{"id":"7e888fa51e3748f2","name":"color-string","version":"1.9.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-string/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-string/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-string/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-string/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-string_project:color-string:1.9.1:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/color-string@1.9.1","metadataType":"javascript-npm-package","metadata":{"name":"color-string","version":"1.9.1","author":"Heather Arthur , Maxime Thirouin, Dyma Ywanov , Josh Junon","homepage":"","description":"Parser and generator for CSS color strings","url":"Qix-/color-string","private":false}},{"id":"a1e232528ce637f4","name":"color-support","version":"1.1.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/color-support/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-support/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/color-support/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/color-support/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:color-support:color-support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color-support:color_support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_support:color-support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color_support:color_support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color-support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:color:color_support:1.1.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/color-support@1.1.3","metadataType":"javascript-npm-package","metadata":{"name":"color-support","version":"1.1.3","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"A module which will endeavor to guess your terminal's level of color support.","url":"git+https://github.com/isaacs/color-support.git","private":false}},{"id":"774e316934f12a96","name":"colors","version":"1.1.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/grunt-legacy-log/node_modules/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:colors:colors:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:Marak:colors:1.1.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/colors@1.1.2","metadataType":"javascript-npm-package","metadata":{"name":"colors","version":"1.1.2","author":"Marak Squires","homepage":"https://github.com/Marak/colors.js","description":"get colors in your node.js console","url":"http://github.com/Marak/colors.js.git","private":false}},{"id":"ba9f99e8572f2682","name":"colors","version":"1.4.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/colors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:colors:colors:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:Marak:colors:1.4.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/colors@1.4.0","metadataType":"javascript-npm-package","metadata":{"name":"colors","version":"1.4.0","author":"Marak Squires, DABH (https://github.com/DABH)","homepage":"https://github.com/Marak/colors.js","description":"get colors in your node.js console","url":"http://github.com/Marak/colors.js.git","private":false}},{"id":"84bcfa432cfdd0d0","name":"colorspace","version":"1.1.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/colorspace/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colorspace/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/colorspace/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/colorspace/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:colorspace:colorspace:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:3rd-Eden:colorspace:1.1.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/colorspace@1.1.4","metadataType":"javascript-npm-package","metadata":{"name":"colorspace","version":"1.1.4","author":"Arnout Kazemier","homepage":"https://github.com/3rd-Eden/colorspace","description":"Generate HEX colors for a given namespace.","url":"https://github.com/3rd-Eden/colorspace","private":false}},{"id":"23da7748c749bc68","name":"commander","version":"2.20.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/seek-bzip/node_modules/commander/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:commander:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:tj:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/commander@2.20.3","metadataType":"javascript-npm-package","metadata":{"name":"commander","version":"2.20.3","author":"TJ Holowaychuk ","homepage":"","description":"the complete solution for node.js command-line programs","url":"https://github.com/tj/commander.js.git","private":false}},{"id":"3facda85b5f59f2a","name":"commander","version":"2.20.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/yaml-schema-validator/node_modules/commander/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:commander:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:tj:commander:2.20.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/commander@2.20.3","metadataType":"javascript-npm-package","metadata":{"name":"commander","version":"2.20.3","author":"TJ Holowaychuk ","homepage":"","description":"the complete solution for node.js command-line programs","url":"https://github.com/tj/commander.js.git","private":false}},{"id":"ebc8491ac18b63ae","name":"component-emitter","version":"1.3.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-emitter/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/component-emitter/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-emitter/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:component-emitter:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component-emitter:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_emitter:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_emitter:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sindresorhus:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:sindresorhus:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component-emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component_emitter:1.3.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/component-emitter@1.3.1","metadataType":"javascript-npm-package","metadata":{"name":"component-emitter","version":"1.3.1","author":"","homepage":"","description":"Event emitter","url":"https://github.com/sindresorhus/component-emitter.git","private":false}},{"id":"e91a1227114ad372","name":"component-type","version":"1.2.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/component-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-type/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/component-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/component-type/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:component-type:component-type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component-type:component_type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_type:component-type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component_type:component_type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component-type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:component:component_type:1.2.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/component-type@1.2.1","metadataType":"javascript-npm-package","metadata":{"name":"component-type","version":"1.2.1","author":"","homepage":"","description":"Cross-browser type assertions (less broken typeof)","url":"https://github.com/component/type.git","private":false}},{"id":"798bc97add5e6f68","name":"compress-commons","version":"1.2.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/compress-commons/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compress-commons/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/compress-commons/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compress-commons/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:compress-commons:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress-commons:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress_commons:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress_commons:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress:compress-commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:compress:compress_commons:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/compress-commons@1.2.2","metadataType":"javascript-npm-package","metadata":{"name":"compress-commons","version":"1.2.2","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/node-compress-commons","description":"a library that defines a common interface for working with archive formats within node","url":"https://github.com/archiverjs/node-compress-commons.git","private":false}},{"id":"d33659b98b525c44","name":"compressible","version":"2.0.18","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/compressible/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compressible/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/compressible/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compressible/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:compressible:compressible:2.0.18:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/compressible@2.0.18","metadataType":"javascript-npm-package","metadata":{"name":"compressible","version":"2.0.18","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com), Jeremiah Senkpiel (https://searchbeam.jit.su)","homepage":"","description":"Compressible Content-Type / mime checking","url":"jshttp/compressible","private":false}},{"id":"828f0284d303f177","name":"compression","version":"1.8.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/compression/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compression/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/compression/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compression/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:compression:compression:1.8.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/compression@1.8.1","metadataType":"javascript-npm-package","metadata":{"name":"compression","version":"1.8.1","author":"Douglas Christopher Wilson , Jonathan Ong (http://jongleberry.com)","homepage":"","description":"Node.js compression middleware","url":"expressjs/compression","private":false}},{"id":"e899cd35e0ecfcf6","name":"concat-map","version":"0.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/concat-map/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-map/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/concat-map/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-map/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:concat-map:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat-map:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_map:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_map:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:substack:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:substack:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat-map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat_map:0.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/concat-map@0.0.1","metadataType":"javascript-npm-package","metadata":{"name":"concat-map","version":"0.0.1","author":"James Halliday (http://substack.net)","homepage":"","description":"concatenative mapdashery","url":"git://github.com/substack/node-concat-map.git","private":false}},{"id":"3cf686e52af98b9c","name":"concat-stream","version":"1.6.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/concat-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-stream/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/concat-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/concat-stream/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:concat-stream:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat-stream:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_stream:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat_stream:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:maxogden:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:maxogden:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat-stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:concat:concat_stream:1.6.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/concat-stream@1.6.2","metadataType":"javascript-npm-package","metadata":{"name":"concat-stream","version":"1.6.2","author":"Max Ogden ","homepage":"","description":"writable stream that concatenates strings or binary data and calls a callback with the result","url":"http://github.com/maxogden/concat-stream.git","private":false}},{"id":"f5d30e88e089520d","name":"config","version":"3.3.12","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/config/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/config/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/config/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:node-config:config:3.3.12:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:config:config:3.3.12:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/config@3.3.12","metadataType":"javascript-npm-package","metadata":{"name":"config","version":"3.3.12","author":"Loren West ","homepage":"http://github.com/node-config/node-config.git","description":"Configuration control for production node deployments","url":"http://github.com/node-config/node-config.git","private":false}},{"id":"62af6322c8da5d46","name":"console-control-strings","version":"1.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/console-control-strings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/console-control-strings/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"ISC","spdxExpression":"ISC","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/console-control-strings/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/console-control-strings/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:console-control-strings:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console-control-strings:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control_strings:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control_strings:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console-control:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console-control:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console_control:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:console:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:console-control-strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:iarna:console_control_strings:1.1.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/console-control-strings@1.1.0","metadataType":"javascript-npm-package","metadata":{"name":"console-control-strings","version":"1.1.0","author":"Rebecca Turner (http://re-becca.org/)","homepage":"","description":"A library of cross-platform tested terminal/console command strings for doing things like color and cursor positioning. This is a subset of both ansi and vt100. All control codes included work on both Windows & Unix-like OSes, except where noted.","url":"https://github.com/iarna/console-control-strings","private":false}},{"id":"64ecabe801d13657","name":"constantinople","version":"4.0.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/constantinople/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/constantinople/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/constantinople/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/constantinople/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:ForbesLindesay:constantinople:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:constantinople:constantinople:4.0.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/constantinople@4.0.1","metadataType":"javascript-npm-package","metadata":{"name":"constantinople","version":"4.0.1","author":"ForbesLindesay","homepage":"","description":"Determine whether a JavaScript expression evaluates to a constant","url":"https://github.com/ForbesLindesay/constantinople.git","private":false}},{"id":"6d99ffbaf9a3dbf2","name":"content-disposition","version":"0.5.4","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/content-disposition/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-disposition/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/content-disposition/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-disposition/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:content-disposition:content-disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content-disposition:content_disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_disposition:content-disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_disposition:content_disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content-disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content_disposition:0.5.4:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/content-disposition@0.5.4","metadataType":"javascript-npm-package","metadata":{"name":"content-disposition","version":"0.5.4","author":"Douglas Christopher Wilson ","homepage":"","description":"Create and parse Content-Disposition header","url":"jshttp/content-disposition","private":false}},{"id":"1e680466175b93f0","name":"content-type","version":"1.0.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/content-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-type/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/content-type/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/content-type/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:content-type:content-type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content-type:content_type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_type:content-type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content_type:content_type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content-type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:content:content_type:1.0.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/content-type@1.0.5","metadataType":"javascript-npm-package","metadata":{"name":"content-type","version":"1.0.5","author":"Douglas Christopher Wilson ","homepage":"","description":"Create and parse HTTP Content-Type header","url":"jshttp/content-type","private":false}},{"id":"299182936c2fe78a","name":"cookie","version":"0.4.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/engine.io/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie:cookie:0.4.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie@0.4.2","metadataType":"javascript-npm-package","metadata":{"name":"cookie","version":"0.4.2","author":"Roman Shtylman , Douglas Christopher Wilson ","homepage":"","description":"HTTP server cookie parsing and serialization","url":"jshttp/cookie","private":false}},{"id":"5f1423a9340f2ecc","name":"cookie","version":"0.7.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/express/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/express/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie:cookie:0.7.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie@0.7.1","metadataType":"javascript-npm-package","metadata":{"name":"cookie","version":"0.7.1","author":"Roman Shtylman , Douglas Christopher Wilson ","homepage":"","description":"HTTP server cookie parsing and serialization","url":"jshttp/cookie","private":false}},{"id":"f30613fbb68ad643","name":"cookie","version":"0.7.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cookie/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie:cookie:0.7.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie@0.7.2","metadataType":"javascript-npm-package","metadata":{"name":"cookie","version":"0.7.2","author":"Roman Shtylman , Douglas Christopher Wilson ","homepage":"","description":"HTTP server cookie parsing and serialization","url":"jshttp/cookie","private":false}},{"id":"52b0adc8ff09f017","name":"cookie-parser","version":"1.4.7","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cookie-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-parser/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cookie-parser/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-parser/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie-parser:cookie-parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie-parser:cookie_parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie_parser:cookie-parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie_parser:cookie_parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie:cookie-parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cookie:cookie_parser:1.4.7:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cookie-parser@1.4.7","metadataType":"javascript-npm-package","metadata":{"name":"cookie-parser","version":"1.4.7","author":"TJ Holowaychuk (http://tjholowaychuk.com), Douglas Christopher Wilson ","homepage":"","description":"Parse HTTP request cookies","url":"expressjs/cookie-parser","private":false}},{"id":"f7961879936cc1c0","name":"cookie-signature","version":"1.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cookie-signature/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-signature/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cookie-signature/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cookie-signature/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cookie-signature_project:cookie-signature:1.0.6:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/cookie-signature@1.0.6","metadataType":"javascript-npm-package","metadata":{"name":"cookie-signature","version":"1.0.6","author":"TJ Holowaychuk ","homepage":"","description":"Sign and unsign cookies","url":"https://github.com/visionmedia/node-cookie-signature.git","private":false}},{"id":"84bc1ef1a454e04d","name":"copy-descriptor","version":"0.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/copy-descriptor/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/copy-descriptor/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/copy-descriptor/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/copy-descriptor/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:copy-descriptor:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy-descriptor:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy_descriptor:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy_descriptor:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:jonschlinkert:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy:copy-descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:copy:copy_descriptor:0.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/copy-descriptor@0.1.1","metadataType":"javascript-npm-package","metadata":{"name":"copy-descriptor","version":"0.1.1","author":"Jon Schlinkert (https://github.com/jonschlinkert)","homepage":"https://github.com/jonschlinkert/copy-descriptor","description":"Copy a descriptor from object A to object B","url":"jonschlinkert/copy-descriptor","private":false}},{"id":"36ced86f8d381680","name":"core-util-is","version":"1.0.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/core-util-is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/core-util-is/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/core-util-is/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/core-util-is/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:core-util-is:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core-util-is:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util_is:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util_is:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core-util:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core-util:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core_util:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:isaacs:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core:core-util-is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:core:core_util_is:1.0.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/core-util-is@1.0.2","metadataType":"javascript-npm-package","metadata":{"name":"core-util-is","version":"1.0.2","author":"Isaac Z. Schlueter (http://blog.izs.me/)","homepage":"","description":"The `util.is*` functions introduced in Node v0.12.","url":"git://github.com/isaacs/core-util-is","private":false}},{"id":"9f4d3a70130c3163","name":"cors","version":"2.8.5","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cors/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cors/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cors/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cors:cors:2.8.5:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cors@2.8.5","metadataType":"javascript-npm-package","metadata":{"name":"cors","version":"2.8.5","author":"Troy Goode (https://github.com/troygoode/)","homepage":"","description":"Node.js CORS middleware","url":"expressjs/cors","private":false}},{"id":"5e060917a7b152aa","name":"crc","version":"3.8.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crc/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:alexgorbatchev:crc:3.8.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc:crc:3.8.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crc@3.8.0","metadataType":"javascript-npm-package","metadata":{"name":"crc","version":"3.8.0","author":"Alex Gorbatchev (https://github.com/alexgorbatchev)","homepage":"https://github.com/alexgorbatchev/node-crc","description":"Module for calculating Cyclic Redundancy Check (CRC) for Node.js and the Browser.","url":"git://github.com/alexgorbatchev/node-crc.git","private":false}},{"id":"65ce75ba55690187","name":"crc-32","version":"1.2.2","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crc-32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc-32/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"Apache-2.0","spdxExpression":"Apache-2.0","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crc-32/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc-32/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:SheetJS:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:SheetJS:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc-32:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc-32:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc_32:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc_32:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc:crc-32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc:crc_32:1.2.2:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crc-32@1.2.2","metadataType":"javascript-npm-package","metadata":{"name":"crc-32","version":"1.2.2","author":"sheetjs","homepage":"https://sheetjs.com/","description":"Pure-JS CRC-32","url":"git://github.com/SheetJS/js-crc32.git","private":false}},{"id":"828196a2c6a9e027","name":"crc32-stream","version":"2.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crc32-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc32-stream/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crc32-stream/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crc32-stream/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:crc32-stream:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32-stream:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32_stream:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32_stream:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:archiverjs:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32:crc32-stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crc32:crc32_stream:2.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crc32-stream@2.0.0","metadataType":"javascript-npm-package","metadata":{"name":"crc32-stream","version":"2.0.0","author":"Chris Talkington (http://christalkington.com/)","homepage":"https://github.com/archiverjs/node-crc32-stream","description":"a streaming CRC32 checksumer","url":"https://github.com/archiverjs/node-crc32-stream.git","private":false}},{"id":"fbc0fafe2877b078","name":"create-require","version":"1.1.1","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/create-require/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/create-require/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/create-require/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/create-require/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:create-require:create-require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create-require:create_require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create_require:create-require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create_require:create_require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create:create-require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:create:create_require:1.1.1:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/create-require@1.1.1","metadataType":"javascript-npm-package","metadata":{"name":"create-require","version":"1.1.1","author":"Maël Nison , Paul Soporan , Pooya Parsa ","homepage":"","description":"Polyfill for Node.js module.createRequire (<= v12.2.0)","url":"nuxt-contrib/create-require","private":false}},{"id":"28238b546a501760","name":"cross-fetch","version":"4.1.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cross-fetch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cross-fetch/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cross-fetch_project:cross-fetch:4.1.0:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/cross-fetch@4.1.0","metadataType":"javascript-npm-package","metadata":{"name":"cross-fetch","version":"4.1.0","author":"Leonardo Quixada ","homepage":"https://github.com/lquixada/cross-fetch","description":"Universal WHATWG Fetch API for Node, Browsers and React Native","url":"https://github.com/lquixada/cross-fetch.git","private":false}},{"id":"50b42809242de976","name":"cross-fetch-polyfill","version":"0.0.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-fetch/polyfill/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cross-fetch-polyfill:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-fetch-polyfill:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch_polyfill:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch_polyfill:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-fetch:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-fetch:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_fetch:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross-fetch-polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross_fetch_polyfill:0.0.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cross-fetch-polyfill@0.0.0","metadataType":"javascript-npm-package","metadata":{"name":"cross-fetch-polyfill","version":"0.0.0","author":"","homepage":"","description":"","url":"","private":false}},{"id":"1b99c2dc3022043f","name":"cross-spawn","version":"7.0.6","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/cross-spawn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-spawn/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/cross-spawn/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/cross-spawn/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:cross-spawn:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross-spawn:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_spawn:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross_spawn:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:moxystudio:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:moxystudio:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross-spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:cross:cross_spawn:7.0.6:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/cross-spawn@7.0.6","metadataType":"javascript-npm-package","metadata":{"name":"cross-spawn","version":"7.0.6","author":"André Cruz ","homepage":"https://github.com/moxystudio/node-cross-spawn","description":"Cross platform child_process#spawn and child_process#spawnSync","url":"git@github.com:moxystudio/node-cross-spawn.git","private":false}},{"id":"c00a8b8b043aae72","name":"crypto-js","version":"3.3.0","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/crypto-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crypto-js/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/crypto-js/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/crypto-js/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:crypto-js:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto-js:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto_js:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto_js:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:crypto:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brix:crypto-js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:brix:crypto_js:3.3.0:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/crypto-js@3.3.0","metadataType":"javascript-npm-package","metadata":{"name":"crypto-js","version":"3.3.0","author":"Evan Vosberg (http://github.com/evanvosberg)","homepage":"http://github.com/brix/crypto-js","description":"JavaScript library of crypto standards.","url":"http://github.com/brix/crypto-js.git","private":false}},{"id":"a64626d34d414995","name":"dateformat","version":"4.6.3","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/dateformat/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/dateformat/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/dateformat/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/dateformat/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:dateformat:dateformat:4.6.3:*:*:*:*:*:*:*","source":"syft-generated"},{"cpe":"cpe:2.3:a:felixge:dateformat:4.6.3:*:*:*:*:*:*:*","source":"syft-generated"}],"purl":"pkg:npm/dateformat@4.6.3","metadataType":"javascript-npm-package","metadata":{"name":"dateformat","version":"4.6.3","author":"Steven Levithan, Steven Levithan, Felix Geisendörfer , Christoph Tavan , Jon Schlinkert (https://github.com/jonschlinkert), Felix Geisendörfer ","homepage":"https://github.com/felixge/node-dateformat","description":"A node.js package for Steven Levithan's excellent dateFormat() function.","url":"https://github.com/felixge/node-dateformat.git","private":false}},{"id":"13ce5d31ef865754","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/body-parser/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich (http://n8.io), Andrew Rhyne ","homepage":"","description":"small debugging utility","url":"git://github.com/visionmedia/debug.git","private":false}},{"id":"07994462f17337cd","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/compression/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compression/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/compression/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/compression/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich (http://n8.io), Andrew Rhyne ","homepage":"","description":"small debugging utility","url":"git://github.com/visionmedia/debug.git","private":false}},{"id":"18b6649e0a78c9a1","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/expand-brackets/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/expand-brackets/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/expand-brackets/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/expand-brackets/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich (http://n8.io), Andrew Rhyne ","homepage":"","description":"small debugging utility","url":"git://github.com/visionmedia/debug.git","private":false}},{"id":"36ba4b44e6e4cfc1","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/express/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/express/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/express/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich (http://n8.io), Andrew Rhyne ","homepage":"","description":"small debugging utility","url":"git://github.com/visionmedia/debug.git","private":false}},{"id":"7ef811ee564508d1","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/finalhandler/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/finalhandler/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/finalhandler/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/finalhandler/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich (http://n8.io), Andrew Rhyne ","homepage":"","description":"small debugging utility","url":"git://github.com/visionmedia/debug.git","private":false}},{"id":"1eaad6013e183bbc","name":"debug","version":"2.6.9","type":"npm","foundBy":"javascript-package-cataloger","locations":[{"path":"/juice-shop/node_modules/morgan/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/morgan/node_modules/debug/package.json","annotations":{"evidence":"primary"}}],"licenses":[{"value":"MIT","spdxExpression":"MIT","type":"declared","urls":[],"locations":[{"path":"/juice-shop/node_modules/morgan/node_modules/debug/package.json","layerID":"sha256:1e8da654b2e057ef43f26384aa9c71d2bdafdc4de0248cf1cfd44c4867559123","accessPath":"/juice-shop/node_modules/morgan/node_modules/debug/package.json","annotations":{"evidence":"primary"}}]}],"language":"javascript","cpes":[{"cpe":"cpe:2.3:a:debug_project:debug:2.6.9:*:*:*:*:node.js:*:*","source":"nvd-cpe-dictionary"}],"purl":"pkg:npm/debug@2.6.9","metadataType":"javascript-npm-package","metadata":{"name":"debug","version":"2.6.9","author":"TJ Holowaychuk , Nathan Rajlich