Press CTR-C to copy XML [help]


Dependency-Check is an open source tool performing a best effort analysis of 3rd party dependencies; false positives and false negatives may exist in the analysis performed by the tool. Use of the tool and the reporting provided constitutes acceptance for use in an AS IS condition, and there are NO warranties, implied or otherwise, with regard to the analysis or its use. Any use of the tool and the reporting provided is at the user’s risk. In no event shall the copyright holder or OWASP be held liable for any damages whatsoever arising out of or in connection with the use of this tool, the analysis performed, or the resulting report.

How to read the report | Suppressing false positives | Getting Help: github issues

 Sponsor

Project: Testing

Scan Information (show all):

Summary

Display: Showing Vulnerable Dependencies (click to show all)

DependencyVulnerability IDsPackageHighest SeverityCVE CountConfidenceEvidence Count
APF.Core3.1.AWS:6.0.0.*pkg:nuget/APF.Core3.1.AWS@6.0.0.%2A 08
APF.Core3.1:6.0.0.*pkg:nuget/APF.Core3.1@6.0.0.%2A 08
APF.Core3.1:6.0.0.8pkg:nuget/APF.Core3.1@6.0.0.8 08
AWSSDK.Core:3.7.102.4pkg:nuget/AWSSDK.Core@3.7.102.4 06
AWSSDK.DynamoDBv2:3.7.101.1pkg:nuget/AWSSDK.DynamoDBv2@3.7.101.1 06
AWSSDK.DynamoDBv2:3.7.101.5pkg:nuget/AWSSDK.DynamoDBv2@3.7.101.5 06
AWSSDK.Extensions.NETCore.Setup:3.7.2pkg:nuget/AWSSDK.Extensions.NETCore.Setup@3.7.2 08
AWSSDK.Lambda:3.7.9.3pkg:nuget/AWSSDK.Lambda@3.7.9.3 06
AWSSDK.RDS:3.7.103.1pkg:nuget/AWSSDK.RDS@3.7.103.1 06
AWSSDK.S3:3.7.9.23pkg:nuget/AWSSDK.S3@3.7.9.23 06
AWSSDK.SimpleNotificationService:3.7.100.31pkg:nuget/AWSSDK.SimpleNotificationService@3.7.100.31 06
Adapter.Tests.csproj 02
Adapter.csproj 02
Amazon.Lambda.Core:2.1.0pkg:nuget/Amazon.Lambda.Core@2.1.0 08
Amazon.Lambda.SNSEvents:2.0.0pkg:nuget/Amazon.Lambda.SNSEvents@2.0.0 08
Amazon.Lambda.Serialization.Json:2.1.0pkg:nuget/Amazon.Lambda.Serialization.Json@2.1.0 08
Amazon.Lambda.TestUtilities:2.0.0pkg:nuget/Amazon.Lambda.TestUtilities@2.0.0 08
AwsParameterStore.Microsoft.Extensions.Configuration:0.7.0pkg:nuget/AwsParameterStore.Microsoft.Extensions.Configuration@0.7.0 08
CashFreeSettlementAdapter.Tests.csproj 02
CashFreeSettlementAdapter.csproj 02
CommonUtility.js 00
CsvHelper:27.1.1pkg:nuget/CsvHelper@27.1.1 04
CustomErrors.js 00
Dapper:2.1.35pkg:nuget/Dapper@2.1.35 04
DokuSettlementAdapter.csproj 02
DummyAdapter.Tests.csproj 02
DummyAdapter.csproj 02
DummySettlementAdapter.Tests.csproj 02
DummySettlementAdapter.csproj 02
EPPlus:6.2.4pkg:nuget/EPPlus@6.2.4 04
EasebuzzSettlementAdapter.csproj 02
ExceptionMapper.js 00
Hashids.net:1.3.0pkg:nuget/Hashids.net@1.3.0 06
ISVHandler.js 00
KotakUPISettlementAdapter.csproj 02
Lumigo.DotNET:1.0.45pkg:nuget/Lumigo.DotNET@1.0.45 06
MSTest.TestAdapter:1.2.0pkg:nuget/MSTest.TestAdapter@1.2.0 06
MSTest.TestFramework:1.2.0pkg:nuget/MSTest.TestFramework@1.2.0 06
MailKit:2.5.0pkg:nuget/MailKit@2.5.0 04
Microsoft.AspNetCore.Mvc.NewtonsoftJson:3.1.0cpe:2.3:a:asp-project:asp-project:3.1.0:*:*:*:*:*:*:*pkg:nuget/Microsoft.AspNetCore.Mvc.NewtonsoftJson@3.1.0 0Low8
Microsoft.EntityFrameworkCore.Sqlite:3.1.3cpe:2.3:a:sqlite:sqlite:3.1.3:*:*:*:*:*:*:*pkg:nuget/Microsoft.EntityFrameworkCore.Sqlite@3.1.3CRITICAL24Low8
Microsoft.Extensions.Configuration.EnvironmentVariables:6.0.1pkg:nuget/Microsoft.Extensions.Configuration.EnvironmentVariables@6.0.1 08
Microsoft.Extensions.Configuration.Json:6.0.0pkg:nuget/Microsoft.Extensions.Configuration.Json@6.0.0 08
Microsoft.Extensions.Configuration:6.0.1pkg:nuget/Microsoft.Extensions.Configuration@6.0.1 08
Microsoft.Extensions.Logging.Console:6.0.0pkg:nuget/Microsoft.Extensions.Logging.Console@6.0.0 08
Microsoft.NET.Test.Sdk:15.5.0pkg:nuget/Microsoft.NET.Test.Sdk@15.5.0 08
Microsoft.NET.Test.Sdk:15.6.0pkg:nuget/Microsoft.NET.Test.Sdk@15.6.0 08
Moq:4.8.2pkg:nuget/Moq@4.8.2 04
PayoutIdMigrationHandler.csproj 02
Pomelo.EntityFrameworkCore.MySql:6.0.2cpe:2.3:a:mysql:mysql:6.0.2:*:*:*:*:*:*:*
cpe:2.3:a:www-sql_project:www-sql:6.0.2:*:*:*:*:*:*:*		pkg:nuget/Pomelo.EntityFrameworkCore.MySql@6.0.2 0Low8
PostSettlementHandler.csproj 02
ProcessSettlementService.js 00
SSH.NET:2016.1.0cpe:2.3:a:ssh:ssh:2016.1.0:*:*:*:*:*:*:*
cpe:2.3:a:ssh.net_project:ssh.net:2016.1.0:*:*:*:*:*:*:*		pkg:nuget/SSH.NET@2016.1.0 0Low6
SSMParameters.js 00
SSMParameters.js 00
Stripe.net:41.13.0cpe:2.3:a:stripe:stripe:41.13.0:*:*:*:*:*:*:*pkg:nuget/Stripe.net@41.13.0 0Low6
System.Net.Http:4.3.4pkg:nuget/System.Net.Http@4.3.4 08
Transactions.Common.csproj 02
WinSCP:5.17.10cpe:2.3:a:winscp:winscp:5.17.10:*:*:*:*:*:*:*pkg:nuget/WinSCP@5.17.10MEDIUM2Low4
coverlet.collector:1.2.0pkg:nuget/coverlet.collector@1.2.0 06
coverlet.msbuild:2.8.0pkg:nuget/coverlet.msbuild@2.8.0 06
database.js 00
database.js 00
database.js 00
dbDataModels.js 00
index.js 00
index.js 00
index.js 00
kotakRefundRepository.js 00
kotakSettlementRepository.js 00
package.json 00
package.json 00
package.json 00
xunit.runner.visualstudio:2.3.1pkg:nuget/xunit.runner.visualstudio@2.3.1 08
xunit:2.3.1pkg:nuget/xunit@2.3.1 04

Dependencies (vulnerable)

APF.Core3.1.AWS:6.0.0.*

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

APF.Core3.1:6.0.0.*

File Path: D:\Auropayrepos\Adapters\src\CashFreeSettlementAdapter\CashFreeSettlementAdapter.csproj

Identifiers

APF.Core3.1:6.0.0.8

File Path: D:\Auropayrepos\Adapters\src\Adapter\Adapter.csproj

Identifiers

AWSSDK.Core:3.7.102.4

File Path: D:\Auropayrepos\Adapters\src\Adapter\Adapter.csproj

Identifiers

AWSSDK.DynamoDBv2:3.7.101.1

File Path: D:\Auropayrepos\Adapters\src\Transactions.Common\Transactions.Common.csproj

Identifiers

AWSSDK.DynamoDBv2:3.7.101.5

File Path: D:\Auropayrepos\Adapters\src\Adapter\Adapter.csproj

Identifiers

AWSSDK.Extensions.NETCore.Setup:3.7.2

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

AWSSDK.Lambda:3.7.9.3

File Path: D:\Auropayrepos\Adapters\src\Transactions.Common\Transactions.Common.csproj

Identifiers

AWSSDK.RDS:3.7.103.1

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

AWSSDK.S3:3.7.9.23

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

AWSSDK.SimpleNotificationService:3.7.100.31

File Path: D:\Auropayrepos\Adapters\src\Adapter\Adapter.csproj

Identifiers

Adapter.Tests.csproj

File Path: D:\Auropayrepos\Adapters\test\Adapter.Tests\Adapter.Tests.csproj
MD5: 4c0b613d67b3643fd3b5c833b4d11c9e
SHA1: 0082f5035754833279eeab19713b00e01f1bb882
SHA256:7d6ee73e926397ca1b2e8ce1d5a640c589ea50c953923bcef7144c9c1a93cd2f

Identifiers

  • None

Adapter.csproj

File Path: D:\Auropayrepos\Adapters\src\Adapter\Adapter.csproj
MD5: f6602f58c317e5ac6977c3ae5bfc2280
SHA1: 07cba85ed6ed946d7b2e3473adafa3b3415808bb
SHA256:ebb150738e6ee8a012939c7580dbec30d94239ee1496d088561b252af67c1e26

Identifiers

  • None

Amazon.Lambda.Core:2.1.0

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

Amazon.Lambda.SNSEvents:2.0.0

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

Amazon.Lambda.Serialization.Json:2.1.0

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

Amazon.Lambda.TestUtilities:2.0.0

File Path: D:\Auropayrepos\Adapters\src\EasebuzzSettlementAdapter\EasebuzzSettlementAdapter.csproj

Identifiers

AwsParameterStore.Microsoft.Extensions.Configuration:0.7.0

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

CashFreeSettlementAdapter.Tests.csproj

File Path: D:\Auropayrepos\Adapters\test\CashFreeSettlementAdapter.Tests\CashFreeSettlementAdapter.Tests.csproj
MD5: e18997099057635160c6c3e21d366049
SHA1: 1423abb7278a3b581af0df810d8b65a04efd0a3d
SHA256:ed305669e1965a99dff257a33f24686b8f669544e4330501ae19e6e5446fbcd1

Identifiers

  • None

CashFreeSettlementAdapter.csproj

File Path: D:\Auropayrepos\Adapters\src\CashFreeSettlementAdapter\CashFreeSettlementAdapter.csproj
MD5: a97b95ec222034159e312f672c6136bb
SHA1: 5765d83585e99b639f4681042362fc58ed50a05d
SHA256:39eeaddf2668c7b35af93cb6a7f6bcf15f7e81266659e2577fa67a223017189e

Identifiers

  • None

CommonUtility.js

File Path: D:\Auropayrepos\Adapters\src\ExcelUtilityHandlerNode\utils\CommonUtility.js
MD5: 601a98f73d32c6514d60b072657922df
SHA1: fcc4a2e1d1541bf1fe1f6e827de2bbd0bb0834e7
SHA256:55427b9c4025634980a9410109bb8b11c6f35692fa903235dbf15caf19000323

Identifiers

  • None

CsvHelper:27.1.1

File Path: D:\Auropayrepos\Adapters\src\Adapter\Adapter.csproj

Identifiers

CustomErrors.js

File Path: D:\Auropayrepos\Adapters\src\ExcelUtilityHandlerNode\exceptions\CustomErrors.js
MD5: b47d6fdf8bb3d16db299f3333b805734
SHA1: 3390566c7e89cc7cc17d9d2a5ab7de5f046355ba
SHA256:153adab223ec354945b62ed9c932ad23611b189366d04b26450c22b69c6dd89e

Identifiers

  • None

Dapper:2.1.35

File Path: D:\Auropayrepos\Adapters\src\Adapter\Adapter.csproj

Identifiers

DokuSettlementAdapter.csproj

File Path: D:\Auropayrepos\Adapters\src\DokuSettlementAdapter\DokuSettlementAdapter.csproj
MD5: f765997f33a415223de81f8092ed6b32
SHA1: 3660adb62f3841ff758ba9d6769f7483baa150ee
SHA256:75db730a5cb52011df28ef1402f37041d06c2969639f241e4896615c509a488f

Identifiers

  • None

DummyAdapter.Tests.csproj

File Path: D:\Auropayrepos\Adapters\test\DummyAdapter.Tests\DummyAdapter.Tests.csproj
MD5: 4825106043362e05fcd864eda662c0c2
SHA1: 90dc31db251b28fce9e5f9d452aba4492b217768
SHA256:68288a81d03336e5af8052c986af9dbf8d7cd3f1a379bd7c0bb46480c44b91b8

Identifiers

  • None

DummyAdapter.csproj

File Path: D:\Auropayrepos\Adapters\src\DummyAdapter\DummyAdapter.csproj
MD5: 2260c5ce62c2fd6f97b69d939bd93055
SHA1: 69ec1238cea4962d9e268d033f46f0c9adcf320f
SHA256:865c973a8177cea3d8a8e7efb97af09a75f802802b9a16a3adf84a25baca994d

Identifiers

  • None

DummySettlementAdapter.Tests.csproj

File Path: D:\Auropayrepos\Adapters\test\DummySettlementAdapter.Tests\DummySettlementAdapter.Tests.csproj
MD5: 01b8d38e7d9e4575ca19aceead1effd4
SHA1: dcce56d2eaa7dba374177b0bfc999812bef8408f
SHA256:39cb12f9a266cd5cef4fa23792fb0b58f498d900ee1385110261f6fac2a88aba

Identifiers

  • None

DummySettlementAdapter.csproj

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj
MD5: 6fe65aebfcacdc898ac0009d92645e25
SHA1: 7f735a4040e8bafdfa5a3608f8eff70e4d41c2ba
SHA256:a3bd31c93dca940afe909e27f95845064c8b84ff0e4a58334c1840adf5a36413

Identifiers

  • None

EPPlus:6.2.4

File Path: D:\Auropayrepos\Adapters\src\KotakUPISettlementAdapter\KotakUPISettlementAdapter.csproj

Identifiers

EasebuzzSettlementAdapter.csproj

File Path: D:\Auropayrepos\Adapters\src\EasebuzzSettlementAdapter\EasebuzzSettlementAdapter.csproj
MD5: a4fb1b76c0a935973052e4bfd7c7cc5f
SHA1: 5b5a217617a0e668bef2c15ac752a9098ab13ee5
SHA256:2eca750f403d62783c1d39c5d8120f69652b31b4b9c6c9665e882a7a10b474f1

Identifiers

  • None

ExceptionMapper.js

File Path: D:\Auropayrepos\Adapters\src\ExcelUtilityHandlerNode\exceptions\ExceptionMapper.js
MD5: a2764c476099900847c0bd3c911f93c1
SHA1: 7dcde25990f4e0b09193864d93b5c088814ec88b
SHA256:4814b59ca493f8ef1acb9f5396f8e350d2365e651d90d3987ba857b7b8856cdd

Identifiers

  • None

Hashids.net:1.3.0

File Path: D:\Auropayrepos\Adapters\src\Adapter\Adapter.csproj

Identifiers

ISVHandler.js

File Path: D:\Auropayrepos\Adapters\src\ExcelUtilityHandlerNode\ISVHandler.js
MD5: f2f52d0bcbf757117898cd37d2683c59
SHA1: 2e9e6279af6d93b1944d23f38d6fbb0d09556006
SHA256:ef1abcb55da9317626726c0ddd83cd5ea30c556a4d93077c87084224e68c75df

Identifiers

  • None

KotakUPISettlementAdapter.csproj

File Path: D:\Auropayrepos\Adapters\src\KotakUPISettlementAdapter\KotakUPISettlementAdapter.csproj
MD5: 3238a17ed34a0bd478b189785f0d95f6
SHA1: 92802a2a180b33b89efa0e0afcc500c855945a1d
SHA256:d881236ba71e71db9fdd4d6d2c6d8b21afcb10fe554d826e0646392a7f91c30a

Identifiers

  • None

Lumigo.DotNET:1.0.45

File Path: D:\Auropayrepos\Adapters\src\EasebuzzSettlementAdapter\EasebuzzSettlementAdapter.csproj

Identifiers

MSTest.TestAdapter:1.2.0

File Path: D:\Auropayrepos\Adapters\test\DummyAdapter.Tests\DummyAdapter.Tests.csproj

Identifiers

MSTest.TestFramework:1.2.0

File Path: D:\Auropayrepos\Adapters\test\DummyAdapter.Tests\DummyAdapter.Tests.csproj

Identifiers

MailKit:2.5.0

File Path: D:\Auropayrepos\Adapters\src\KotakUPISettlementAdapter\KotakUPISettlementAdapter.csproj

Identifiers

Microsoft.AspNetCore.Mvc.NewtonsoftJson:3.1.0

File Path: D:\Auropayrepos\Adapters\src\Transactions.Common\Transactions.Common.csproj

Identifiers

Microsoft.EntityFrameworkCore.Sqlite:3.1.3

File Path: D:\Auropayrepos\Adapters\test\Adapter.Tests\Adapter.Tests.csproj

Identifiers

CVE-2017-10989  

The getNodeSize function in ext/rtree/rtree.c in SQLite through 3.19.3, as used in GDAL and other products, mishandles undersized RTree blobs in a crafted database, leading to a heap-based buffer over-read or possibly unspecified other impact.
CWE-125 Out-of-bounds Read

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

CVE-2019-19646  

pragma.c in SQLite through 3.30.1 mishandles NOT NULL in an integrity_check PRAGMA command in certain cases of generated columns.
CWE-754 Improper Check for Unusual or Exceptional Conditions

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2020-11656  

In SQLite through 3.31.1, the ALTER TABLE implementation has a use-after-free, as demonstrated by an ORDER BY clause that belongs to a compound SELECT statement.
CWE-416 Use After Free

CVSSv3:
  • Base Score: CRITICAL (9.8)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2015-5895  

Multiple unspecified vulnerabilities in SQLite before 3.8.10.2, as used in Apple iOS before 9, have unknown impact and attack vectors.
NVD-CWE-noinfo

CVSSv2:
  • Base Score: HIGH (10.0)
  • Vector: /AV:N/AC:L/Au:N/C:C/I:C/A:C

References:

Vulnerable Software & Versions:

CVE-2018-20346  

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries that occur after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases), aka Magellan.
CWE-190 Integer Overflow or Wraparound

CVSSv3:
  • Base Score: HIGH (8.1)
  • Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:2.2/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2018-20506  

SQLite before 3.25.3, when the FTS3 extension is enabled, encounters an integer overflow (and resultant buffer overflow) for FTS3 queries in a "merge" operation that occurs after crafted changes to FTS3 shadow tables, allowing remote attackers to execute arbitrary code by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases). This is a different vulnerability than CVE-2018-20346.
CWE-190 Integer Overflow or Wraparound

CVSSv3:
  • Base Score: HIGH (8.1)
  • Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:2.2/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2015-3414  

SQLite before 3.8.9 does not properly implement the dequoting of collation-sequence names, which allows context-dependent attackers to cause a denial of service (uninitialized memory access and application crash) or possibly have unspecified other impact via a crafted COLLATE clause, as demonstrated by COLLATE"""""""" at the end of a SELECT statement.
CWE-908 Use of Uninitialized Resource

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2015-3415  

The sqlite3VdbeExec function in vdbe.c in SQLite before 3.8.9 does not properly implement comparison operators, which allows context-dependent attackers to cause a denial of service (invalid free operation) or possibly have unspecified other impact via a crafted CHECK clause, as demonstrated by CHECK(0&O>O) in a CREATE TABLE statement.
CWE-404 Improper Resource Shutdown or Release

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2015-3416  

The sqlite3VXPrintf function in printf.c in SQLite before 3.8.9 does not properly handle precision and width values during floating-point conversions, which allows context-dependent attackers to cause a denial of service (integer overflow and stack-based buffer overflow) or possibly have unspecified other impact via large integers in a crafted printf function call in a SELECT statement.
CWE-190 Integer Overflow or Wraparound

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2015-3717  

Multiple buffer overflows in the printf functionality in SQLite, as used in Apple iOS before 8.4 and OS X before 10.10.4, allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via unspecified vectors.
CWE-120 Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')

CVSSv2:
  • Base Score: HIGH (7.5)
  • Vector: /AV:N/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

CVE-2018-20505  

SQLite 3.25.2, when queries are run on a table with a malformed PRIMARY KEY, allows remote attackers to cause a denial of service (application crash) by leveraging the ability to run arbitrary SQL statements (such as in certain WebSQL use cases).
CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2018-8740  

In SQLite through 3.22.0, databases whose schema is corrupted using a CREATE TABLE AS statement could cause a NULL pointer dereference, related to build.c and prepare.c.
CWE-476 NULL Pointer Dereference

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions:

CVE-2020-11655  

SQLite through 3.31.1 allows attackers to cause a denial of service (segmentation fault) via a malformed window-function query because the AggInfo object's initialization is mishandled.
CWE-665 Improper Initialization

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (5.0)
  • Vector: /AV:N/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2022-35737  

SQLite 1.0.12 through 3.39.x before 3.39.2 sometimes allows an array-bounds overflow if billions of bytes are used in a string argument to a C API.
CWE-129 Improper Validation of Array Index

CVSSv3:
  • Base Score: HIGH (7.5)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:3.9/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2023-7104  

A vulnerability was found in SQLite SQLite3 up to 3.43.0 and classified as critical. This issue affects the function sessionReadRecord of the file ext/session/sqlite3session.c of the component make alltest Handler. The manipulation leads to heap-based buffer overflow. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-248999.
CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer, CWE-122 Heap-based Buffer Overflow

CVSSv3:
  • Base Score: HIGH (7.3)
  • Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:3.9/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (5.2)
  • Vector: /AV:A/AC:L/Au:S/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

CVE-2020-13630  

ext/fts3/fts3.c in SQLite before 3.32.0 has a use-after-free in fts3EvalNextRow, related to the snippet feature.
CWE-416 Use After Free

CVSSv3:
  • Base Score: HIGH (7.0)
  • Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:1.0/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (4.4)
  • Vector: /AV:L/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2015-6607  

SQLite before 3.8.9, as used in Android before 5.1.1 LMY48T, allows attackers to gain privileges via a crafted application, aka internal bug 20099586.
CWE-264 Permissions, Privileges, and Access Controls

CVSSv2:
  • Base Score: MEDIUM (6.8)
  • Vector: /AV:N/AC:M/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

CVE-2016-6153  

os_unix.c in SQLite before 3.13.0 improperly implements the temporary directory search algorithm, which might allow local users to obtain sensitive information, cause a denial of service (application crash), or have unspecified other impact by leveraging use of the current working directory for temporary files.
CWE-20 Improper Input Validation

CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:2.5/RC:R/MAV:A
CVSSv2:
  • Base Score: MEDIUM (4.6)
  • Vector: /AV:L/AC:L/Au:N/C:P/I:P/A:P

References:

Vulnerable Software & Versions:

CVE-2019-19645  

alter.c in SQLite through 3.30.1 allows attackers to trigger infinite recursion via certain types of self-referential views in conjunction with ALTER TABLE statements.
CWE-674 Uncontrolled Recursion

CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.8/RC:R/MAV:A
CVSSv2:
  • Base Score: LOW (2.1)
  • Vector: /AV:L/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2020-13434  

SQLite through 3.32.0 has an integer overflow in sqlite3_str_vappendf in printf.c.
CWE-190 Integer Overflow or Wraparound

CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.8/RC:R/MAV:A
CVSSv2:
  • Base Score: LOW (2.1)
  • Vector: /AV:L/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2020-13435  

SQLite through 3.32.0 has a segmentation fault in sqlite3ExprCodeTarget in expr.c.
CWE-476 NULL Pointer Dereference

CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.8/RC:R/MAV:A
CVSSv2:
  • Base Score: LOW (2.1)
  • Vector: /AV:L/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions:

CVE-2020-13631  

SQLite before 3.32.0 allows a virtual table to be renamed to the name of one of its shadow tables, related to alter.c and build.c.
NVD-CWE-noinfo

CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:1.8/RC:R/MAV:A
CVSSv2:
  • Base Score: LOW (2.1)
  • Vector: /AV:L/AC:L/Au:N/C:N/I:P/A:N

References:

Vulnerable Software & Versions: (show all)

CVE-2020-13632  

ext/fts3/fts3_snippet.c in SQLite before 3.32.0 has a NULL pointer dereference via a crafted matchinfo() query.
CWE-476 NULL Pointer Dereference

CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.8/RC:R/MAV:A
CVSSv2:
  • Base Score: LOW (2.1)
  • Vector: /AV:L/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

CVE-2020-15358  

In SQLite before 3.32.3, select.c mishandles query-flattener optimization, leading to a multiSelectOrderBy heap overflow because of misuse of transitive properties for constant propagation.
CWE-787 Out-of-bounds Write

CVSSv3:
  • Base Score: MEDIUM (5.5)
  • Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:1.8/RC:R/MAV:A
CVSSv2:
  • Base Score: LOW (2.1)
  • Vector: /AV:L/AC:L/Au:N/C:N/I:N/A:P

References:

Vulnerable Software & Versions: (show all)

Microsoft.Extensions.Configuration.EnvironmentVariables:6.0.1

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

Microsoft.Extensions.Configuration.Json:6.0.0

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

Microsoft.Extensions.Configuration:6.0.1

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

Microsoft.Extensions.Logging.Console:6.0.0

File Path: D:\Auropayrepos\Adapters\src\DummySettlementAdapter\DummySettlementAdapter.csproj

Identifiers

Microsoft.NET.Test.Sdk:15.5.0

File Path: D:\Auropayrepos\Adapters\test\DummyAdapter.Tests\DummyAdapter.Tests.csproj

Identifiers

Microsoft.NET.Test.Sdk:15.6.0

File Path: D:\Auropayrepos\Adapters\test\CashFreeSettlementAdapter.Tests\CashFreeSettlementAdapter.Tests.csproj

Identifiers

Moq:4.8.2

File Path: D:\Auropayrepos\Adapters\test\DummyAdapter.Tests\DummyAdapter.Tests.csproj

Identifiers

PayoutIdMigrationHandler.csproj

File Path: D:\Auropayrepos\Adapters\src\PayoutIdMigrationHandler\PayoutIdMigrationHandler.csproj
MD5: fd75b4d29c5604ff4ea75c5ecca7eee9
SHA1: 10bd2efe82a0c86506d338a01ecf718397504d3c
SHA256:190f2121bee8e6c6250f1122e0287afbef79dbc908edd15d40a374c5a97ecbd1

Identifiers

  • None

Pomelo.EntityFrameworkCore.MySql:6.0.2

File Path: D:\Auropayrepos\Adapters\src\Adapter\Adapter.csproj

Identifiers

PostSettlementHandler.csproj

File Path: D:\Auropayrepos\Adapters\src\PostSettlementHandler\PostSettlementHandler.csproj
MD5: 939e4fd374df64940aa525fc1c996cb6
SHA1: 1774d0fec0a021e37d629842597584f610c29f4d
SHA256:d7e2f1393ea9d840850cc0dad59194afb879f30ebd81983ce8bed6493259246a

Identifiers

  • None

ProcessSettlementService.js

File Path: D:\Auropayrepos\Adapters\src\Transactions.Common\Services\Impl\ProcessSettlementService.js
MD5: 2e3edcd8e70a964ee22625ad55d12bd6
SHA1: 39305a50c0b6d5d0df5752c25421db1ebb6c2eb5
SHA256:68fc11d661c334da8dfb9d48ac8523d3a533e93cb358f6151fe449f4abf0fc41

Identifiers

  • None

SSH.NET:2016.1.0

File Path: D:\Auropayrepos\Adapters\src\Adapter\Adapter.csproj

Identifiers

  • pkg:nuget/SSH.NET@2016.1.0  (Confidence:Highest)
  • cpe:2.3:a:ssh:ssh:2016.1.0:*:*:*:*:*:*:*  (Confidence:Low)  
  • cpe:2.3:a:ssh.net_project:ssh.net:2016.1.0:*:*:*:*:*:*:*  (Confidence:Low)  

SSMParameters.js

File Path: D:\Auropayrepos\Adapters\src\ExcelUtilityHandlerNode\config\SSMParameters.js
MD5: f4acaf5420e28fe4886e22c17ec2c0bd
SHA1: 21d0cb0a4be4e442eab8239d7411e30c7d08c062
SHA256:3d758901fbcad9ec113b3aa3f2145d07a75ab333a03e652fc32b0072ec82a45c

Identifiers

  • None

SSMParameters.js

File Path: D:\Auropayrepos\Adapters\src\KotakProcessFileHandler\config\SSMParameters.js
MD5: 05e248ff6cccaebede220c7cd442fe86
SHA1: 653a6474a3f302e0bd5808f1cd3c5b76516c730b
SHA256:9ddf4e6ca3a9e4767252b759c90eaff826e9eb0b4e69a32f6964c942f4ab9ea3

Identifiers

  • None

Stripe.net:41.13.0

File Path: D:\Auropayrepos\Adapters\src\PayoutIdMigrationHandler\PayoutIdMigrationHandler.csproj

Identifiers

System.Net.Http:4.3.4

File Path: D:\Auropayrepos\Adapters\src\EasebuzzSettlementAdapter\EasebuzzSettlementAdapter.csproj

Identifiers

Transactions.Common.csproj

File Path: D:\Auropayrepos\Adapters\src\Transactions.Common\Transactions.Common.csproj
MD5: 929cc0adf6fd528272cb1886a114dc24
SHA1: c6bd931c0a828158a2df74303b40115aca3b3cf3
SHA256:ccc49209b99bc7e58498ff762d8757dd7d203bef9a66f79914dc8ed9fb9dc81e

Identifiers

  • None

WinSCP:5.17.10

File Path: D:\Auropayrepos\Adapters\src\Adapter\Adapter.csproj

Identifiers

  • pkg:nuget/WinSCP@5.17.10  (Confidence:Highest)
  • cpe:2.3:a:winscp:winscp:5.17.10:*:*:*:*:*:*:*  (Confidence:Low)  

CVE-2023-48795  

The SSH transport protocol with certain OpenSSH extensions, found in OpenSSH before 9.6 and other products, allows remote attackers to bypass integrity checks such that some packets are omitted (from the extension negotiation message), and a client and server may consequently end up with a connection for which some security features have been downgraded or disabled, aka a Terrapin attack. This occurs because the SSH Binary Packet Protocol (BPP), implemented by these extensions, mishandles the handshake phase and mishandles use of sequence numbers. For example, there is an effective attack against SSH's use of ChaCha20-Poly1305 (and CBC with Encrypt-then-MAC). The bypass occurs in chacha20-poly1305@openssh.com and (if CBC is used) the -etm@openssh.com MAC algorithms. This also affects Maverick Synergy Java SSH API before 3.1.0-SNAPSHOT, Dropbear through 2022.83, Ssh before 5.1.1 in Erlang/OTP, PuTTY before 0.80, AsyncSSH before 2.14.2, golang.org/x/crypto before 0.17.0, libssh before 0.10.6, libssh2 through 1.11.0, Thorn Tech SFTP Gateway before 3.4.6, Tera Term before 5.1, Paramiko before 3.4.0, jsch before 0.2.15, SFTPGo before 2.5.6, Netgate pfSense Plus through 23.09.1, Netgate pfSense CE through 2.7.2, HPN-SSH through 18.2.0, ProFTPD before 1.3.8b (and before 1.3.9rc2), ORYX CycloneSSH before 2.3.4, NetSarang XShell 7 before Build 0144, CrushFTP before 10.6.0, ConnectBot SSH library before 2.2.22, Apache MINA sshd through 2.11.0, sshj through 0.37.0, TinySSH through 20230101, trilead-ssh2 6401, LANCOM LCOS and LANconfig, FileZilla before 3.66.4, Nova before 11.8, PKIX-SSH before 14.4, SecureCRT before 9.4.3, Transmit5 before 5.10.4, Win32-OpenSSH before 9.5.0.0p1-Beta, WinSCP before 6.2.2, Bitvise SSH Server before 9.32, Bitvise SSH Client before 9.33, KiTTY through 0.76.1.13, the net-ssh gem 7.2.0 for Ruby, the mscdex ssh2 module before 1.15.0 for Node.js, the thrussh library before 0.35.1 for Rust, and the Russh crate before 0.40.2 for Rust.
CWE-354 Improper Validation of Integrity Check Value

CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N/E:2.2/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

CVE-2024-31497  

In PuTTY 0.68 through 0.80 before 0.81, biased ECDSA nonce generation allows an attacker to recover a user's NIST P-521 secret key via a quick attack in approximately 60 signatures. This is especially important in a scenario where an adversary is able to read messages signed by PuTTY or Pageant. The required set of signed messages may be publicly readable because they are stored in a public Git service that supports use of SSH for commit signing, and the signatures were made by Pageant through an agent-forwarding mechanism. In other words, an adversary may already have enough signature information to compromise a victim's private key, even if there is no further use of vulnerable PuTTY versions. After a key compromise, an adversary may be able to conduct supply-chain attacks on software maintained in Git. A second, independent scenario is that the adversary is an operator of an SSH server to which the victim authenticates (for remote login or file copy), even though this server is not fully trusted by the victim, and the victim uses the same private key for SSH connections to other services operated by other entities. Here, the rogue server operator (who would otherwise have no way to determine the victim's private key) can derive the victim's private key, and then use it for unauthorized access to those other services. If the other services include Git services, then again it may be possible to conduct supply-chain attacks on software maintained in Git. This also affects, for example, FileZilla before 3.67.0, WinSCP before 6.3.3, TortoiseGit before 2.15.0.1, and TortoiseSVN through 1.14.6.
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

CVSSv3:
  • Base Score: MEDIUM (5.9)
  • Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:2.2/RC:R/MAV:A

References:

Vulnerable Software & Versions: (show all)

coverlet.collector:1.2.0

File Path: D:\Auropayrepos\Adapters\test\Adapter.Tests\Adapter.Tests.csproj

Identifiers

coverlet.msbuild:2.8.0

File Path: D:\Auropayrepos\Adapters\test\Adapter.Tests\Adapter.Tests.csproj

Identifiers

database.js

File Path: D:\Auropayrepos\Adapters\src\ExcelUtilityHandlerNode\db\database.js
MD5: 583df8367a0c538038585af892712ce0
SHA1: 2157065e08470ac1657b8d5daafc68479d290627
SHA256:565ea2bcf384de59de65970e34d118748eea9f937a1e45d55302554490f7e205

Identifiers

  • None

database.js

File Path: D:\Auropayrepos\Adapters\src\KotakProcessFileHandler\db\database.js
MD5: 282b10b6b7b29365130f4efb1d715bab
SHA1: 4daaab0950dad991e33d795b78155d2f5e056463
SHA256:03e3f202c2b36252298aa069183efeb833cff185afbb110a31a94a820b13c95c

Identifiers

  • None

database.js

File Path: D:\Auropayrepos\Adapters\src\KotakProcessRefundHandler\db\database.js
MD5: 07d5c2f4a6f1344772b0552aaf4b7f55
SHA1: 740bec37011a1a13e6dc1876400fe5cf3e711661
SHA256:ef5abb03cb277c03c9a8da680f97128723d0081dc2f192c2864d995aa072ade2

Identifiers

  • None

dbDataModels.js

File Path: D:\Auropayrepos\Adapters\src\ExcelUtilityHandlerNode\dbDataModels.js
MD5: d757e67b45e5251640faa27a0456add5
SHA1: c76a3fefa03a93e91ea2189d556cccb48e9a656a
SHA256:8200cf196aa2711ff0e61eabf92e73d3df198009d8cf02f1400873ae808fe151

Identifiers

  • None

index.js

File Path: D:\Auropayrepos\Adapters\src\ExcelUtilityHandlerNode\index.js
MD5: 075c255d140f02f6578bd09951436f0a
SHA1: 447a07b589fc5f8d4efdac647f6b10c2c8f6080b
SHA256:0dfca3b7bd2571d07657445da3136ac5be60ba0c5e86236cd41644734bde52e9

Identifiers

  • None

index.js

File Path: D:\Auropayrepos\Adapters\src\KotakProcessFileHandler\index.js
MD5: c49ec7bb4109f555470f970739dbe844
SHA1: ec99ba36464a1a45e2d1d6a835601a23578a5eda
SHA256:ff4d1ffe7abbf5ceb2887ce8b76d4776781c0e499584496af4775d6a50afe713

Identifiers

  • None

index.js

File Path: D:\Auropayrepos\Adapters\src\KotakProcessRefundHandler\index.js
MD5: a6a4fca4ace0ee726fddbb4639a9e8da
SHA1: dcb492d5e0128417291568b6cde51f81c422cf4a
SHA256:55e80e00910a79428cb9c625edf43276b388b1067066c557b65a1b79f211e8e1

Identifiers

  • None

kotakRefundRepository.js

File Path: D:\Auropayrepos\Adapters\src\KotakProcessRefundHandler\kotakRefundRepository.js
MD5: f0fa6e7dc72d1fcdb5c9bf3b596d0cc5
SHA1: 0353c9b36a37ec80d4e552283bd1d6030c8b4d3b
SHA256:060ab7fb2328ca43a9bdc0e87312738e3e9293e876224921f0bf707c463a6058

Identifiers

  • None

kotakSettlementRepository.js

File Path: D:\Auropayrepos\Adapters\src\KotakProcessFileHandler\kotakSettlementRepository.js
MD5: 1d5d1e1fa3f345af40a6164ba26bba2b
SHA1: bbf66cd69fd28da58d121b5f1f9c25ef54a8bcfa
SHA256:7ea13089e09d63c4a55515c93bcec5dc28ab8ec67c23a86c1a8a8acc216827c7

Identifiers

  • None

package.json

File Path: D:\Auropayrepos\Adapters\src\ExcelUtilityHandlerNode\package.json
MD5: d50ae981d5eeb553cae2e595ba7944dc
SHA1: f14099a437cbbf56a465cd32b34c47747bab67c1
SHA256:a20cf837489963960982f6187884eaebaff731fb832955bef25223c13b98c55a

Identifiers

  • None

package.json

File Path: D:\Auropayrepos\Adapters\src\KotakProcessFileHandler\package.json
MD5: 801a37c1b7645111fb715221b80c1994
SHA1: 47706baf277c2776821c959a42aef650b56a1714
SHA256:1b3fb9362bb4f2ff92f4680da8127bc299863554a064451245081cb2e5ec53ea

Identifiers

  • None

package.json

File Path: D:\Auropayrepos\Adapters\src\Transactions.Common\Services\Impl\package.json
MD5: 7f0fcadee13ddfe78e9eff2b80d8cc62
SHA1: bc3bbaedf57bcb57855c72f17c66e2a6b8823e2c
SHA256:5d40427b2249957dff97bd925e5f5c7345eae29689360bff6a321940b8b3ff76

Identifiers

  • None

xunit.runner.visualstudio:2.3.1

File Path: D:\Auropayrepos\Adapters\test\DummySettlementAdapter.Tests\DummySettlementAdapter.Tests.csproj

Identifiers

xunit:2.3.1

File Path: D:\Auropayrepos\Adapters\test\DummySettlementAdapter.Tests\DummySettlementAdapter.Tests.csproj

Identifiers



This report contains data retrieved from the National Vulnerability Database.
This report may contain data retrieved from the CISA Known Exploited Vulnerability Catalog.
This report may contain data retrieved from the Github Advisory Database (via NPM Audit API).
This report may contain data retrieved from RetireJS.
This report may contain data retrieved from the Sonatype OSS Index.