GHAS Summary Report - Sun May 18 2025 #134
Description
GHAS Metrics Summary
Repository octofelickz/dvcsharp-api
Dependabot
- Open Alerts: 31
- Fixed in the past X days: 0
- Opened in the past X days: 0
- Frequency: daily
- MTTR:
- MTTD:
Dependabot - top 10
| Package | Severity | Vulnerable versions | Patched version | CVE | CVSS | Link |
|---|---|---|---|---|---|---|
| System.Text.Encodings.Web | critical | >= 4.0.0, < 4.5.1 | 4.5.1 | CVE-2021-26701 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H | https://github.com/octofelickz/dvcsharp-api/security/dependabot/7 |
| Microsoft.NETCore.App | high | >= 1.0.0, < 2.0.3 | 2.0.3 | CVE-2017-11770 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | https://github.com/octofelickz/dvcsharp-api/security/dependabot/31 |
| System.Text.RegularExpressions | high | >= 4.3.0, < 4.3.1 | 4.3.1 | CVE-2019-0820 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | https://github.com/octofelickz/dvcsharp-api/security/dependabot/30 |
| System.Net.Http | high | < 4.3.4 | 4.3.4 | CVE-2018-8292 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N | https://github.com/octofelickz/dvcsharp-api/security/dependabot/29 |
| System.Net.Security | high | = 4.3.0 | 4.3.1 | CVE-2017-0249 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L | https://github.com/octofelickz/dvcsharp-api/security/dependabot/27 |
| System.Net.Security | high | = 4.3.0 | 4.3.1 | CVE-2017-0247 | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | https://github.com/octofelickz/dvcsharp-api/security/dependabot/26 |
| System.Data.SqlClient | high | < 4.8.6 | 4.8.6 | CVE-2024-0056 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N | https://github.com/octofelickz/dvcsharp-api/security/dependabot/23 |
| Microsoft.AspNetCore.Server.Kestrel.Transport.Libuv | high | <= 2.1.39 | 2.1.40 | CVE-2023-38180 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | https://github.com/octofelickz/dvcsharp-api/security/dependabot/21 |
| Microsoft.AspNetCore.Identity | high | < 2.1.39 | 2.1.39 | CVE-2023-33170 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | https://github.com/octofelickz/dvcsharp-api/security/dependabot/20 |
| Newtonsoft.Json | high | < 13.0.1 | 13.0.1 | CVE-2024-21907 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | https://github.com/octofelickz/dvcsharp-api/security/dependabot/18 |
Code Scanning
- Open Alerts: 27
- Fixed in the past X days: 5
- Opened in the past X days: 0
- Frequency: daily
- MTTR: 32 days, 8 hours, 10 minutes, 50 seconds
- MTTD:
Code Scanning - top 10
| Vulnerability | Severity | Weakness | Tool | Vulnerable file | Link |
|---|---|---|---|---|---|
| cs/xml/insecure-dtd-handling | critical | CWE-611, CWE-776, CWE-827 | CodeQL | Controllers/ImportsController.cs#L29 | https://github.com/octofelickz/dvcsharp-api/security/code-scanning/4 |
| cs/user-controlled-bypass | high | CWE-247, CWE-350, CWE-807 | CodeQL | Controllers/AuthorizationsController.cs#L53 | https://github.com/octofelickz/dvcsharp-api/security/code-scanning/2 |
| generic.secrets.security.detected-jwt-token.detected-jwt-token | error | CWE-321 | Semgrep OSS | documentation-dvcsharp-book/data/DVCSharp_postman_v2.json#L141 | https://github.com/octofelickz/dvcsharp-api/security/code-scanning/27 |
| generic.secrets.security.detected-jwt-token.detected-jwt-token | error | CWE-321 | Semgrep OSS | documentation-dvcsharp-book/data/DVCSharp_postman_v2.json#L108 | https://github.com/octofelickz/dvcsharp-api/security/code-scanning/26 |
| generic.secrets.security.detected-jwt-token.detected-jwt-token | error | CWE-321 | Semgrep OSS | documentation-dvcsharp-book/data/DVCSharp_postman_v2.json#L73 | https://github.com/octofelickz/dvcsharp-api/security/code-scanning/25 |
| generic.secrets.security.detected-jwt-token.detected-jwt-token | error | CWE-321 | Semgrep OSS | documentation-dvcsharp-book/data/DVCSharp_postman_v2.json#L46 | https://github.com/octofelickz/dvcsharp-api/security/code-scanning/24 |
| generic.secrets.security.detected-jwt-token.detected-jwt-token | error | CWE-321 | Semgrep OSS | documentation-dvcsharp-book/attacks/ssrf.md#L30 | https://github.com/octofelickz/dvcsharp-api/security/code-scanning/23 |
| generic.secrets.security.detected-jwt-token.detected-jwt-token | error | CWE-321 | Semgrep OSS | documentation-dvcsharp-book/attacks/sso-cookie-auth-bypass.md#L29 | https://github.com/octofelickz/dvcsharp-api/security/code-scanning/22 |
| generic.secrets.security.detected-jwt-token.detected-jwt-token | error | CWE-321 | Semgrep OSS | documentation-dvcsharp-book/attacks/privilege-escalation.md#L20 | https://github.com/octofelickz/dvcsharp-api/security/code-scanning/21 |
| generic.secrets.security.detected-generic-secret.detected-generic-secret | error | CWE-798 | Semgrep OSS | documentation-dvcsharp-book/attacks/insecure-jwt-usage.md#L14 | https://github.com/octofelickz/dvcsharp-api/security/code-scanning/20 |