Veracode Security Scan #27
nightlyScan.yml
on: schedule
Veracode SCA scan
41s
Veracode SAST policy scan
8m 23s
Annotations
1 error and 3 warnings
Veracode SCA scan
Veraocde SCA Scan failed with exit code 7
Veracode SCA agent scanning engine ready
Running the NPM scanner
npm WARN config only Use `--omit=dev` to omit dev dependencies from the install.
Scanning completed
Found 960 lines of code
Processing results...
Processing results complete
Summary Report
Scan ID b05e40f1-fdce-4169-be5d-d908efe9e84b
Scan Date & Time May 04 2024 04:05AM UTC
Account type ENTERPRISE
Scan engine 3.8.61 (latest 3.8.61)
Analysis time 33 seconds
User runner
Project /home/runner/work/uploadandscan-action/uploadandscan-action
Package Manager(s) NPM
Open-Source Libraries
Total Libraries 141
Direct Libraries 5
Transitive Libraries 136
Vulnerable Libraries 3
Third Party Code 99.9%
Security
With Vulnerable Methods 0
Critical Risk Vulnerabilities 0
High Risk Vulnerabilities 1
Medium Risk Vulnerabilities 4
Low Risk Vulnerabilities 0
Vulnerabilities - Public Data
CVE-2023-26159 Medium Risk Open Redirect follow-redirects 1.15.2
CVE-2024-28849 Medium Risk Credential Leakage follow-redirects 1.15.2
Vulnerabilities - Premium Data
NO-CVE High Risk Prototype Pollution axios 1.6.2
NO-CVE Medium Risk Regular Expression Denial Of Service (ReDoS) axios 1.6.2
NO-CVE Medium Risk Memory Leak inflight 1.0.6
Licenses
Unique Library Licenses 8
Libraries Using GPL 1
Libraries With High Risk License 1
Libraries With Medium Risk License 0
Libraries With Low Risk License 143
Libraries With Multiple Licenses 3
Libraries With Unassessable License 0
Libraries With Unrecognizable License 0
Issues
Issue ID Issue Type Severity Description Library Name & Version In Use
287821592 Vulnerability 7.5 NO-CVE: Prototype Pollution axios 1.6.2
287821593 Vulnerability 5.3 NO-CVE: Regular Expression Denial Of Service (ReDoS) axios 1.6.2
287821594 Vulnerability 6.5 CVE-2024-28849: Credential Leakage follow-redirects 1.15.2
287821595 Vulnerability 6.1 CVE-2023-26159: Open Redirect follow-redirects 1.15.2
287821596 Vulnerability 6.2 NO-CVE: Memory Leak inflight 1.0.6
287821597 Outdated Library 3.0 Latest version at scan: 2.1.3 @actions/artifact 1.1.1
287821599 Outdated Library 3.0 Latest version at scan: 9.0.4 minimatch 9.0.3
287821600 Outdated Library 3.0 Latest version at scan: 0.6.2 xml2js 0.6.0
287821601 License 1.0 Library has High-Risk License sjcl 1.0.8
292310212 Outdated Library 3.0 Latest version at scan: 1.7.0-beta.0 axios 1.6.2
Full Report Details https://sca.analysiscenter.veracode.com/teams/PaainWzy/scans/65744388
|
Veracode SCA scan
Node.js 16 actions are deprecated. Please update the following actions to use Node.js 20: actions/checkout@v3, veracode/veracode-sca@v2.1.9. For more information see: https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/.
|
Deprecation notice: v1, v2, and v3 of the artifact actions
The following artifacts were uploaded using a version of actions/upload-artifact that is scheduled for deprecation: "Veracode Agent Based SCA Results".
Please update your workflow to use v4 of the artifact actions.
Learn more: https://github.blog/changelog/2024-04-16-deprecation-notice-v3-of-the-artifact-actions/
|
Veracode SAST policy scan
Node.js 16 actions are deprecated. Please update the following actions to use Node.js 20: actions/checkout@v3. For more information see: https://github.blog/changelog/2023-09-22-github-actions-transitioning-from-node-16-to-node-20/.
|
Artifacts
Produced during runtime
Name | Size | |
---|---|---|
Veracode Agent Based SCA Results
Expired
|
3.8 KB |
|